Theoretically speaking, could a publisher change DNS records for a subdomain to be served from marketer’s server? This would allow them to set first a party cookie from a script that was loaded from that subdomain. I don’t think browsers check IP/DNS addresses when disallowing third party cookies. The problem would be reading the cookies by I think that should be possible to overcome.