Yadongparty | Requests before playback | 2026-10-25

Purpose
Test whether page composition can trigger requests to another origin before any playback action.
This is a controlled mechanism demonstration, not a survey of adult websites or a tracker audit.

Environment
Windows desktop; Chrome regular browsing window, not Incognito.
Two Python standard-library ThreadingHTTPServer instances on the same machine.
The page origin used HTTP loopback address 127.0.0.1 port 8048.
The receiver origin used HTTP hostname localhost port 8049, bound to loopback only.
The different hostnames and ports create different origins. Both servers were controlled by us;
no third-party company received data. HTTPS, network interception and identity correlation were not tested.

Shared materials
A neutral, self-created SVG poster, 640 x 360.
A six-second synthetic H.264 test clip, 1280 x 720, 30 fps, without audio.
The clip is the existing local 720p-300k.mp4 sample in the site's quality-study dataset.
No images or videos from adult services were used.

Four cases (SOURCE_ORIGIN and RECEIVER_ORIGIN identify the two servers, not literal hostnames)
link: An anchor href pointing to RECEIVER_ORIGIN/embed, with no embedded content or prefetch.
poster: One visible image src pointing to RECEIVER_ORIGIN/poster.svg.
none: One iframe src pointing to RECEIVER_ORIGIN/embed; the frame has a video element with
      controls, preload="none", poster="/poster.svg", src="/sample.mp4"; no autoplay.
metadata: The same iframe and video, but preload="metadata".
Every endpoint receives the case and unique run label as query parameters.

Procedure
1. Return Cache-Control: no-store from every fixture endpoint. Set no cookies.
2. For each case navigate to a fresh run URL in a separate browser tab.
3. Do not click the link, video controls or player. Observe for eight seconds from the source-page script.
4. At eight seconds, the source page asks its own server for the matching receiver request log.
   That report request goes to the source server and is excluded from receiver counts.
5. Repeat with three different run labels per case. Each case reused its own tab for subsequent runs.
6. Count only /embed, /poster.svg and /sample.mp4 requests arriving at the receiver.
   The document and poster use normal HTTP responses; media supports Range and HTTP 206.
   Both documents use a data-URL favicon; no favicon request is included in the receiver dataset.

Recorded fields
run: unique fixture execution label, not an identifier for a human user.
mode: link, poster, none or metadata.
path: receiver resource requested, without host or query string.
range_present: whether the request had a Range header.
cookie_present: whether the request had a Cookie header; no cookie values were retained.
The public records contain no IP addresses, account identifiers or complete request headers.

Results
link: 0 / 0 / 0 requests.
poster: 1 / 1 / 1 requests, poster only.
none: 2 / 2 / 2 requests, iframe document and poster; no media request.
metadata: 3 / 3 / 3 requests, iframe document, poster and one media Range request.
No playback control was clicked, and all observed receiver Cookie headers were absent.
The screenshot shows metadata-3 at playback position 0:00, with the eight-second receiver report.

Interpretation limits
HTTP requests are not counts of companies, unique people, connections or watched videos.
Request arrival establishes contact with that server, not identity tracking, profiling or data sale.
No cookie-blocking setting was toggled. This is not a comparison of privacy settings.
Incognito, other browsers, mobile devices and behavior after the eight-second observation were not tested.
Browser preload values are hints; different browsers, caches and resource layouts can behave differently.
Source-page request counts and byte transfer were not measured in this dataset.

Background sources (not experimental results)
https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/video#preload
https://support.google.com/chrome/answer/95464?hl=ko
https://arxiv.org/html/1907.06520v1 (published 2019; original site measurement in March 2018)

Shared sample SHA-256: 0eecae9a6200c22065327354f61e8177e127c87b633d411f3c81a3fc78322f64
measurements.csv SHA-256: ef9174fc914a669150faa3e5c6f9fdf623838447a7206c60035e91ff74e48b91
requests.csv SHA-256: ef331e43835dbfc354b501e1d72f2bce94b50f2ccfead611278c23865c8a6b12
metadata-test.png SHA-256: 860d68dfb475040e9a465d6073af126fb3481857e425a2908e0432adf4cc420d