{
  "docId": "019dd923-622c-750b-8b96-2fbe642fbf78",
  "docSlug": "69cc18cfe079",
  "documentTitle": "NQ Mobile (NQ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2013-10-24 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 71,
  "pageCount": 81,
  "prevPage": 70,
  "nextPage": 72,
  "slideType": "appendix_disclosure",
  "function": "expose_contradiction",
  "density": "dense",
  "nDataPoints": 0,
  "notes": "Includes a Wireshark packet capture screenshot and WHOIS registration details for nqsrv.com.",
  "elementsJson": [
    "headline_text",
    "paragraph",
    "screenshot"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/71",
  "deckHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-71",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "We were able to show that the sites are located and hosted in China, and are owned by NQ.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0936-7173-ab10-e82c82813cbf",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.125,
        "w": 0.765,
        "x": 0.118,
        "y": 0.258
      },
      "kind": "image",
      "text": "Wireshark packet capture showing traffic to us.nqsrv.com",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "c9afda2e-1034-416b-9270-802afed08d8c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.065,
        "w": 0.333,
        "x": 0.118,
        "y": 0.391
      },
      "kind": "paragraph",
      "text": "Domain Name: nqsrv.com\nRegistrar: Name.com LLC\nExpiration Date: 2014-01-09 05:11:41\nCreation Date: 2012-01-09 05:11:41",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "137a42e4-46cb-4755-aece-e62855ae7251",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.055,
        "w": 0.765,
        "x": 0.118,
        "y": 0.168
      },
      "kind": "paragraph",
      "text": "During our investigation we discovered that that app is communicates with remote servers. We extracted the domains and IP that the app reaches and researched the IP using open source tools and services such as \"WhoIS\". We were able to show that the sites are located and hosted in China, and are owned by NQ.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "15e21565-4a2e-4c62-aa32-27df8b35b31e",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.016,
        "w": 0.455,
        "x": 0.118,
        "y": 0.137
      },
      "kind": "paragraph",
      "text": "Data is sent from the App to NQ servers located in China",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "4d18d968-2f44-44f1-9433-dd496eff59e9",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.155,
        "w": 0.333,
        "x": 0.118,
        "y": 0.483
      },
      "kind": "paragraph",
      "text": "REGISTRANT CONTACT INFO\nNetQin Mobile Inc.\nzhang guobao\nNo.4 Building, Heping Li East Street 11\nDongcheng District, Beijing, China\nbeijing\nbeijing\n100013\nCN\nPhone: +86.1085655555\nFax: +86.1085655518\nEmail Address: zhangguobao@netqin.com",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "8db95a72-828d-4828-a258-8edd4332d5fc",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.155,
        "w": 0.333,
        "x": 0.118,
        "y": 0.6
      },
      "kind": "paragraph",
      "text": "ADMINISTRATIVE CONTACT INFO\nNetQin Mobile Inc.\nzhang guobao\nNo.4 Building, Heping Li East Street 11\nDongcheng District, Beijing, China\nbeijing\nbeijing\n100013\nCN\nPhone: +86.1085655555\nFax: +86.1085655518\nEmail Address: zhangguobao@netqin.com",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "e28e70e1-5da2-420f-bd82-51075ae9e7fc",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.022,
        "w": 0.365,
        "x": 0.118,
        "y": 0.098
      },
      "kind": "title",
      "text": "Appendix C: Software Engineer Report",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "82fc1fc2-9612-40d4-b037-451f2b019484",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 80,
      "from": 61,
      "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Appendix Data",
      "beatSlug": null,
      "evidence": "The document provides extensive data and evidence to support its claims.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}