--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@@ -2103,55 +2103,58 @@ nsUrlClassifierDBService::SendThreatHitR
     do_GetService(NS_URLCLASSIFIERUTILS_CONTRACTID);
   if (!utilsService) {
     return NS_ERROR_FAILURE;
   }
 
   nsAutoCString reportBody;
   rv = utilsService->MakeThreatHitReport(aChannel, aList, aFullHash, reportBody);
   NS_ENSURE_SUCCESS(rv, rv);
-
-  nsAutoCString reportUriStr = NS_ConvertUTF16toUTF8(urlStr);
-  reportUriStr.Append("&$req=");
-  reportUriStr.Append(reportBody);
+  nsCOMPtr<nsIStringInputStream> sis(do_CreateInstance(NS_STRINGINPUTSTREAM_CONTRACTID));
+  rv = sis->SetData(reportBody.get(), reportBody.Length());
+  NS_ENSURE_SUCCESS(rv, rv);
 
   LOG(("Sending the following ThreatHit report to %s about %s: %s",
        PromiseFlatCString(aProvider).get(), PromiseFlatCString(aList).get(),
        reportBody.get()));
 
   nsCOMPtr<nsIURI> reportURI;
-  rv = NS_NewURI(getter_AddRefs(reportURI), reportUriStr);
+  rv = NS_NewURI(getter_AddRefs(reportURI), urlStr);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  uint32_t loadFlags = nsIChannel::INHIBIT_CACHING |
+  uint32_t loadFlags = nsIRequest::LOAD_ANONYMOUS | // no cookies
+                       nsIChannel::INHIBIT_CACHING |
                        nsIChannel::LOAD_BYPASS_CACHE;
 
   nsCOMPtr<nsIChannel> reportChannel;
   rv = NS_NewChannel(getter_AddRefs(reportChannel),
                      reportURI,
                      nsContentUtils::GetSystemPrincipal(),
                      nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                      nsIContentPolicy::TYPE_OTHER,
                      nullptr,  // aPerformanceStorage
                      nullptr,  // aLoadGroup
                      nullptr,
                      loadFlags);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Safe Browsing has a separate cookie jar
   nsCOMPtr<nsILoadInfo> loadInfo = reportChannel->GetLoadInfo();
   mozilla::OriginAttributes attrs;
   attrs.mFirstPartyDomain.AssignLiteral(NECKO_SAFEBROWSING_FIRST_PARTY_DOMAIN);
   if (loadInfo) {
     loadInfo->SetOriginAttributes(attrs);
   }
 
+  nsCOMPtr<nsIUploadChannel> uploadChannel(do_QueryInterface(reportChannel));
+  NS_ENSURE_TRUE(uploadChannel, NS_ERROR_FAILURE);
+  rv = uploadChannel->SetUploadStream(sis, NS_LITERAL_CSTRING("application/x-protobuf"), -1);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(reportChannel));
-  NS_ENSURE_TRUE(httpChannel, rv);
-
+  NS_ENSURE_TRUE(httpChannel, NS_ERROR_FAILURE);
   rv = httpChannel->SetRequestMethod(NS_LITERAL_CSTRING("POST"));
   NS_ENSURE_SUCCESS(rv, rv);
   // Disable keepalive.
   rv = httpChannel->SetRequestHeader(NS_LITERAL_CSTRING("Connection"), NS_LITERAL_CSTRING("close"), false);
   NS_ENSURE_SUCCESS(rv, rv);
 
   RefPtr<ThreatHitReportListener> listener = new ThreatHitReportListener();
   rv = reportChannel->AsyncOpen2(listener);

--- a/toolkit/components/url-classifier/tests/mochitest/test_threathit_report.html
+++ b/toolkit/components/url-classifier/tests/mochitest/test_threathit_report.html
@@ -196,23 +196,17 @@ function testOnWindow(aTestData) {
     (async function() {
       await new Promise(rs => whenDelayedStartupFinished(win, rs));
 
       let expected;
       let browser = win.gBrowser.selectedBrowser;
       let wp = win.gBrowser.contentDocument.docShell.QueryInterface(Ci.nsIWebProgress);
       let progressListener = {
         onSecurityChange(aWebProgress, aRequest, aState) {
-          let utils = Cc["@mozilla.org/url-classifier/utils;1"].
-            getService(Ci.nsIUrlClassifierUtils);
-          expected = aTestData.reportUrl + "&$req=" +
-            utils.makeThreatHitReport(aRequest,
-                                      aTestData.list,
-                                      btoa(hash(aTestData.url)));
-
+          expected = aTestData.reportUrl;
         },
         QueryInterface: ChromeUtils.generateQI(["nsISupportsWeakReference"])
       };
       wp.addProgressListener(progressListener, wp.NOTIFY_SECURITY);
 
       await BrowserTestUtils.loadURI(browser, aTestData.url);
       await BrowserTestUtils.waitForContentEvent(browser, "DOMContentLoaded");
       checkResults(aTestData, expected);