# HubX Meta Pixel redirect analysis **Source:** Proxyman HAR captured August 11, 2026 **Landing URL:** `http://aivideoart.co/get-started-v5?target=meta&deep_link_value=genericDance` **Observed browser request:** HTTPS **Analysis date:** August 16, 2026 ## Executive conclusion - **`_fbp`: created.** The page creates a first-party `_fbp` cookie after the click when one is not already present. A later same-origin request confirms both `_fbp` and `fbp_auto_set`. - **`_fbc`: not created in this session.** The implementation creates `_fbc` only when `fbclid` is present. This landing URL had no `fbclid`. - **Redirect identifiers: missing.** The AppsFlyer OneLink request contained no `fbp`, `fbc`, or `fbclid` parameter. - **Meta events delivered: none.** The page was configured with Meta Pixel ID `467581009113723`, but the Meta library connection failed and there were no `facebook.com/tr` requests. - **Likely ordering defect:** the OneLink was generated before the click-time fallback `_fbp` was created, so the newly created identifier was not appended to the outbound redirect. ## Meta Ad Library verification The exact destination was verified in the official Meta Ad Library: - **Library ID:** [`1768878227328932`](https://www.facebook.com/ads/library/?id=1768878227328932) - **Advertiser:** AI Video Generator - **Status:** Active; started running July 6, 2026 - **Primary text:** “💃 Make anyone dance with AI Video” - **Headline:** “🤣🕺 Join AI Dance Trend” - **CTA:** Download - **Display domain:** `AIVIDEOART.CO` - **Destination:** `https://aivideoart.co/get-started-v5?target=meta&deep_link_value=genericDance` The Ad Library CTA is wrapped by `https://l.facebook.com/l.php`. Its encoded `u` parameter is the exact AIVideoArt destination above; its `h` parameter is Facebook's link-safety token. Requesting that wrapper returned HTTP 200 with a one-second refresh to the exact destination. The wrapper did **not** add `fbclid`, `fbp`, `fbc`, or UTM parameters. Therefore, the lack of `fbclid` in this landing flow is expected for the Ad Library preview link. The page's current conditions consequently suppress Meta `PageView` and `Lead`, while `_fbc` cannot be constructed. The HAR does not contain the preceding `l.facebook.com` request and does contain a Safari/Google autocomplete request with the full destination immediately before navigation. The HAR therefore confirms that the official Ad Library destination was opened, but it cannot prove whether the CTA was clicked directly or its destination was copied or entered in Safari. ## Captured sequence | UTC time | Evidence | | --- | --- | | 21:04:13.569 | Landing document returns HTTP 200. This is not an HTTP redirect. | | 21:04:18.148 | Connection to `connect.facebook.net` fails with Proxyman status 999. | | 21:04:18.653 | AppsFlyer OneLink is requested without `fbp`, `fbc`, or `fbclid`. | | 21:04:18.697 | First-party telemetry records a successful clipboard-copy action. | | 21:04:19.336 | AppsFlyer impression request is sent. | | 21:04:19.971 | A same-origin request carries `_fbp` and `fbp_auto_set`, confirming client-side creation. | The document response includes `X-Middleware-Rewrite` to an internal Next.js path. That is a server-side rewrite, not a browser-visible redirect. The AppsFlyer request later returns HTTP 301 to the Apple App Store. ## Cookie behavior Before the click, captured requests contained other first-party tracking cookies but no `_fbp` or `_fbc`. After the click, a request to `aivideoart.co` contained: - `_fbp` - `fbp_auto_set` - the previously existing first-party cookies No captured request contained `_fbc`, `fbc_auto_set`, or `fbclid`. The referenced client code: - Reads `_fbp` and `_fbc` from first-party cookies. - Creates `_fbp` with a generated `fb...` value when a Meta-targeted click occurs and `_fbp` is missing. - Creates `_fbc` as `fb...` only when `fbclid` exists and `_fbc` is missing. - Sets the generated-cookie marker for 90 days at `Path=/`. - Does not explicitly specify `Secure` or `SameSite` in those setters. Cookie names use the Meta-standard leading underscore (`_fbp`, `_fbc`). The corresponding AppsFlyer query parameters omit the underscore (`fbp`, `fbc`). ## Meta Pixel behavior The captured HTML configures Meta Pixel ID `467581009113723` and installs the normal `fbq` bootstrap for `connect.facebook.net/en_US/fbevents.js`. The referenced application code is designed to: 1. Initialize the pixel with a hashed external identifier. 2. Track `PageView` with a generated event ID, but only when `fbclid` is non-null. 3. Track `Lead` with a generated event ID on the smart-link click, also only when `fbclid` is non-null. 4. Send matching first-party `page_view` and `form_start` data to `data.aivideoart.co/api/customEventPush` when the client reports that the pixel event fired. For this session: - The URL had no `fbclid`, so the `PageView` and `Lead` conditions were false. - The connection to `connect.facebook.net` returned Proxyman status 999 (`Error`). - No request for `fbevents.js` completed. - No `facebook.com/tr` event beacon appears in the HAR. - No Meta browser event is evidenced as delivered. The pixel initialization may have been queued in the local `fbq` stub, but it was not transmitted in the capture. ## What the redirect actually passed The AppsFlyer OneLink request included: - `pid=facebook_w2a` - Generic campaign, channel, ad, and ad-set placeholders - `deep_link_value=genericDance` - The browser user-agent - A persistent 64-character hashed `external_id` - AppsFlyer smart-script parameters It did **not** include: - `fbclid` - `fbp` - `fbc` The OneLink returned HTTP 301 to the Apple App Store. A separate AppsFlyer impression request contained the generic attribution fields and deep-link value, but no Meta click or browser identifiers. ## First-party event actually observed The only related POST observed at `data.aivideoart.co/api/customEventPush` was clipboard/debug telemetry. Its payload contained: - An event ID with an `-error` suffix - The original landing URL - A redacted hashed external identifier - The browser user-agent - An `item_name` describing “Clipboard write success on first stage” and embedding the generated OneLink It did not contain an `event_name`, `fbp`, `fbc`, or `fbclid`. This is first-party operational telemetry, not evidence of a Meta Pixel event. ## Implementation issue The smart link is constructed during page initialization using the cookie values available at that time. The fallback `_fbp` is created later, during the click handler. The already-created OneLink is not regenerated after `_fbp` appears. Result: the site creates `_fbp`, but the outbound AppsFlyer click does not receive it. A robust implementation would establish the necessary identifier before generating the OneLink, or rebuild the URL immediately after creating `_fbp` and before navigation. ## Broader HAR exposure The analyzed HAR is approximately 700 MB and contains 1,586 entries spanning about 30 minutes. It captures substantially more than the HubX landing flow, including Google, iCloud, Slack, WhatsApp, Apple, and other device traffic. Credential-bearing fields include hundreds of `Authorization` headers, application token headers, access-token query parameters, and embedded request and response bodies. Values are intentionally omitted from this report. Because the HAR was downloadable without authentication, the hosted copy should be removed and potentially exposed credentials revoked or rotated. ## Methodology and limits Network conclusions come from the captured HAR. The client-behavior conclusions come from the exact hashed JavaScript chunk referenced by the captured HTML (`10j6sek2ydx5c.js`), retrieved on August 16, 2026 because the HAR did not include that cached asset request. The Ad Library conclusions come from the official Meta card and a direct inspection of its `l.facebook.com` wrapper on August 16, 2026. No secret values from the HAR are reproduced here.