[dvdhnt]

> take a look at MITMproxy

This was my first thought. I haven't taken a look yet, but I suspect that if an organization this large was doing something so nefarious, they'd encrypt/encode or otherwise mask what it is their doing. Perhaps, by misdirection, odd naming of params, or outright encryption - take this all with a grain of salt, my domain is server-web, not mobile.