AppSpy is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as MobileFindFree, FreeSpy.
GS-STK-AND-2702Package names (5)
- com.atracker.app
- com.agpstracker.app
- com.aphonetracker.app
- com.afreesmstracker.app
- com.mobilefindfree
Signing certificates (SHA-1) (6)
- 07525D7D2E83CE865F98E1B9C0F6095B1C29D48A
- 0AD33649F0D0532B5EB0A36A81712962AA79BF54
- 492FF617A79F6C8D80B453815CFE6586E21C5F72
- 9E09874197988F20DB51EB6A34BFD908AC42C35B
- D98C69B50C1092FE21F7CF748DC8B2F91BE56B64
- FB926CF2937331BB8A46E2C5280233C04DA2342E
Domains (dashboard, download, C2) (30)
- app.appspy.net
- app.appspyfree.com
- app.freephonespy.net
- app.mobilespyfree.net
- appspy.com
- appspy.net
- appspyfree.com
- apptracker.net
- cellphonespyappon.com
- free-spy.com
- free.apptracker.net
- freemobilespy.net
- freephonespy.net
- justseries.net
- mobilespyfree.net
- spyren.com
- trackerfree.net
- www.appspy.com
- www.appspy.net
- www.apptracker.net
- www.cellphonespyappon.com
- www.freemobilespy.net
- www.freephonespy.net
- www.mobilespyfree.net
- www.spyren.com
- www.trackerfree.net
- www.xvids.us
- xvids.us
- api.free-spy.com
- appspy-net.firebaseio.com
IP addresses (1)
- 167.114.114.207
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 5 known samples (SHA-256).
- Signing certificate: 6 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 5 known package identifiers.
- Network indicators: 30 domains and 1 IP address used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.