This page is served from . It is a different registrable domain from the victim: the shared trailing labels are a public suffix, not a domain anyone owns in common.
DataDome's isFpOrigin() trusts it anyway, because it counts matching trailing labels
without consulting a public suffix list, and the label before the suffix is ddc.
Victim URL: