Rad's HHR Mobile

The flag ET INFO Observed Cloudflare Developer Domain from Proofpoint is an informational alert, not a malware detection.

This alert is triggered because the app uses a Cloudflare Worker to fetch the latest game URL dynamically. This is standard serverless architecture used by millions of legitimate applications.

While malware sometimes abuses free subdomains, this is a legitimate use of serverless infrastructure for dynamic URL resolution, allowing the app to stay functional after updates without re-downloading.

The Flag: Triggered because the scanner found a string of text that looks like an encoded URL.

The Reality: As the signature itself states: "The simple presence of such strings is not inherently an indicator of malicious content."

The Legitimate Use: In this project, Base64 is used to safely pass data between the Android App and the WebView (JavaScript) layer to ensure game controls are delivered accurately without being corrupted by special characters.

Verification: Because the project is open-source, anyone can decode these strings in the MainActivity.kt or core_util.js to see that they point only to internal game functions and the official game URL.

The Flag: Triggered because the app communicates with a server over HTTPS.

The Reality: This is simply the app using a secure connection to fetch the game URL from the Cloudflare Worker. Every modern app (including YouTube, Discord, and Chrome) uses an "Encrypted Channel" to protect data. In this app, it is used for security, not for "Control."

The Flag: Triggered by the presence of the core_util.js asset or the way code is compressed.

The Reality: This is standard practice for WebView apps. The JavaScript file is stored as an asset to be injected into the game to allow your gamepad to work. It is not "obfuscated" to hide from the system; it is a standard resource.

The Flag: The scanner thinks the app is trying to track your location.

The Reality: This is a logic error in the automated scanner. As seen in our public AndroidManifest.xml, we explicitly use the command: tools:node="remove" on the Location permission.

The Proof: The scanner sees the word "Location" in the manifest and flags it, but it fails to realize the code is actually forcefully disabling and removing any location access to protect user privacy.