Seeking any kind of advice/input from this community.
Background Story:
I came across an cracked Amazon Prime Video Android App on divyanet.com (It claims it's the cracked version of the Original Amazon Prime Video Android App. Same movie selections and everything minus paying for the subscription)
I installed it and realized it was a different app in the way that it wasn't the actual Amazon Prime cracked.
To confirm my suspicion. I set up an Environment to capture the cracked app's network traffic. I ran Genymotion (Android Simulator) and Burp Suite on the same laptop. I proxied the Android instance traffic to that of the laptop's so Burp Suite could capture it.
What I saw was a good learning experience. This cracked app was sending Get requests all over the place. (To many free movies/shows domains and some domains are even being marked as malicious)
Examples:
tovanillitechan.com (Https://malwaretips.com/blogs/remove-tovanillitechan-com/) tzegilo.com (https://hybrid-analysis.com/sample/6d9faaedd7dd72dc8e0da476e0af4b08d6ca24bf60b498d20e070f90f1b45af1/62aa234f35008f214f1869ac) unphionetor.com (https://any.run/report/7974be8113970f143fd17339a5c349d499a05ccf99c940b34979f38d283bb1b3/99008e10-24bd-4cb1-aa59-ab8d5baaf0d0)
My questions are: (See links for HTTP Get and response details)
enter code hereRequest Header
enter code hereResponse Header-1
enter code hereResponse Header-2
A: How is the site owner benefitting from tricking users downloading this supposedly cracked app? (While streaming the movies, there isn't even ads interrupting the movies)
B: I haven't noticed my phone acting weird like slowness or random ads pop up. How can I check to see if anything malicious installed? What are the typical reason for this cracked app calling out to these malicious domains?
Thank you for your help!