Same script, two hosts. Open this with your adblocker (uBlock Origin / EasyPrivacy) on and watch which one loads. The vendor host is on the blocklists; the first-party proxy alias is not.
Each host runs in its own <iframe>, so the two Signifyd SDKs don't
collide (the tag is a page singleton). One real <script> inject per host,
carrying a unique data-order-session-id, so the Signifyd SDK actually initialises
and fires a device-fingerprint pageView. onload = reachable, executed,
and fingerprinted; an adblocker fails it.