M MurmTools

hubapi.com and the six hostnames that arrive with it

hubapi.com is the endpoint HubSpot's software talks to — the address behind the tracking script, the forms, the chat widget and the CRM calls that a marketing team switches on with one line of code. You will see it in a network log long before you see the word HubSpot anywhere on the page. This index has no vendor catalogue entry for the hostname itself, so nothing here classifies it as tracking or not. It appeared on 68 of the 5,294 sites measured, and on every single one of those it had company.

One suite, six hostnames

hs-banner.com was present on all 68 sites — 100%. hsadspixel.net on 67 (98.5%). The catalogued HubSpot entity on 65 (95.6%). hs-analytics.net on 64 (94.1%). hsforms.com on 55 (80.9%). hscollectedforms.net on 29 (42.6%). Outside that estate, Google was on 64 sites (94.1%), LinkedIn on 33 (48.5%), Amazon CloudFront on 12 (17.6%) and Meta on 10 (14.7%).

The useful thing here is the arithmetic of a marketing suite. Installing one product does not add one company to a page; it adds six or seven hostnames doing different jobs — analytics, forms, collected form data, an ad pixel, a banner script, an API — and only one of them carries the brand name. Anyone auditing a page by looking for recognisable names will undercount this by a factor of five.

Eleven companies inside the window

The median site here contacted 11 companies before a consent banner could have been answered, which ranks 8th of the 88 companies in this index, level with eight others. The same median page reached 15 companies in total, 13th of 88, over 51 requests, with 4 classified as tracking. Early contact was recorded on 65 of the 68 sites — 95.6%, ranking 27th of 88.

Those counts are per site and carry no names, so nothing here says the HubSpot estate was among the twelve on any given page. What the ranks do establish is that this is not a quiet corner of the index: on the measure of how much of a page happens before the question, these sites place ninth out of eighty-eight.

Exactly half of them had a banner

Consent software was detected on 34 of the 68 sites. OneTrust was seen alongside on 16, Osano on 5, CookieYes on 4, Cookiebot on 3, Usercentrics on 3 and Iubenda on 1 — sightings rather than shares, since a site can carry more than one.

The clean half-and-half split is a coincidence of a small sample, but it does frame the number above. On 34 sites there was a question and something arrived before it could be answered. On the other 34 there was no question at all.

The sample is largely adtech's own marketing sites

datadome.co contacted 19 companies with 18 inside the window, behind a OneTrust banner. applovin.com: 18 with 16, also behind OneTrust. connatix.com: 18 with 17. mgid.com: 18 with 17, first contact at 912 ms. eskimi.com: 18 and 18, behind Cookiebot. primis.tech: 16 with 14. deepintent.com: 14 with 12, first contact at 117 ms. seedtag.com: 13 and 13. ipify.org: 13 with 11.

The pattern is worth naming because it is a selection effect, not a finding: companies that sell advertising technology run HubSpot on their own corporate sites, and corporate sites of that kind rank well enough to be in a crawl of this shape. Two examples sit outside it — plos.org, the open-access publisher, at 9 companies all inside the window, and pusher.com at 8 and 8.

abovedomains.com shows where the window ends

abovedomains.com contacted 11 companies and none of them inside the window. First contact came at 9,610 ms — nearly ten seconds after the page began loading.

Set that against the group's median first contact of 642 ms and its fastest of 115 ms, and it makes the point that a clean early-contact record is not always a design decision. A page that reaches nothing in the opening window may be a careful page, or it may simply be a slow one where everything third-party is deferred until well after a visitor has stopped waiting. The measurement records when, not why.

Highest-ranked sites where this was seen
SiteCompaniesBefore consentFirst contact
applovin.com1816661 ms
ipify.org1311673 ms
seedtag.com1313430 ms
abovedomains.com1109610 ms
datadome.co1918297 ms
pusher.com88411 ms
deepintent.com1412117 ms
connatix.com1817382 ms
eskimi.com1818546 ms
primis.tech1614573 ms
plos.org99269 ms
mgid.com1817912 ms
Consent tools seen on these sites
ToolSites
OneTrust16
Osano5
CookieYes4
Cookiebot3
Usercentrics3
Iubenda1

The six most common are listed. The remaining 2 of 34 sites with a banner carry something outside that six. One tool is recorded per site, so these counts never overlap.

Seen on the same pages

Companies most often contacted by the same sites. Co-presence only — the crawl records what arrived, not who called whom.

Questions

What is hubapi.com?

The API hostname HubSpot's own scripts call from the pages they run on. This index has no catalogue entry for it, so it carries no category or tracking classification here, though the catalogued HubSpot entity was present on 65 of the same 68 sites.

Why do so many HubSpot hostnames appear at once?

Because the suite splits its jobs across separate domains — banner script, analytics, forms, collected forms, ad pixel, API. In this sample hs-banner.com was on all 68 sites and hsadspixel.net on 67, so the practical unit of installation is the group rather than any single host.

Did HubSpot's script run before consent?

The corpus counts how many companies arrived in the pre-consent window per site, not which ones, so it cannot say. It does record that 65 of these 68 sites had early contact and that the median page saw 11 companies inside the window.

Are 68 sites enough to draw conclusions from?

Enough to describe this group of 68 out of 5,294 measured; not enough to generalise to every HubSpot installation. The co-presence figures are the sturdiest part, because they repeat on nearly every site in the set.

Check any page yourself MurmStack is the tool that produced these figures. Free, two permissions, no host access.
Add to Chrome — free