KidsShield is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as TiSpy, KidLogger, MonitorMinor, SelfSpy, SpyTrac, TelcadoAndroid, TiFamily, TracerSpy, Triada, VipTelefonProgrami.
GS-STK-AND-0884Package names (20)
- com.protect
- com.aixlunro.uqfhkagb
- com.bzbqbkya.hgozttiu
- com.gzomoyig.qwgawtaz
- com.android.inputmethod.latinmy
- com.ntckdlhc.oifhnjwp
- com.selgdg.febgdsra
- com.selgdg.mardsdaf
- com.sepfsp.jasend
- com.bnahrrbc.kwexsnhl
- com.tbntxear.vfmkjxme
- com.fbhpdsej.gnuebduy
- com.uxgbipup.pdtvcgzc
- com.uzoifhzk.qmqnpwaf
- com.zkftwsel.fqnoquuv
- com.mnwkvijy.wzyxgrft
- net.kidlogger.kidlogger
- net.teslineservice.kidl5
- net.someapp1.somecorp2
- com.fhekpqbq.otlzonjx
Signing certificates (SHA-1) (16)
- 0D025A887A1546585D9BBA6F023F42B8BE0274E1
- 1A6D10E15280C6A938EED9BEF53A31DA0CEBA45A
- 272CD0BC357FA03AF87940644CB8FFDECD2FDDC6
- 3397C095EAD93B13CC5B9979D1F3B4FAEF1D194C
- 35D1DB3904A84793394FE5DF7B678E263B1B33A0
- 5EF38D0143F601FD01AA39BFE9079E9927920208
- 6CA8C06D7DAC5F5685E014AE5C4D2062F77B42D6
- 789A24C1605F1BF2B6D64580C697BD38D9446A7E
- 8AE2267AEEA0DBFF7D7CC1C82E54343B1B0CFA22
- 8B187B3EBEF7D1BC8E32BEC78D36CBF95505A1C1
- 95D589A90971992A2038E5961B39C8B6BC77CF19
- A2EBDD14E2AE17F52363BCB751CCBE15BE5A2F8D
- AA4F85CD7C24116BB51FA733BE59290B7BB8C204
- F575CA9980D3075CF728F2081D9EC5F910CC17E8
- FD84821C80C1499A2446F6F7E13BF8BDA6A66402
- 77C411957F307F6B971C7C07825CA5EA06F0E36D
Domains (dashboard, download, C2) (27)
- backupsoft.eu
- freespyapp.com
- kidlogger.net
- kidsshield.net
- monitorminor.com.tr
- pc.freespyapp.com
- pc.selfspy.com
- selfspy.com
- spytrac.com
- techinnovative.net
- tifamily.net
- tispy.net
- tracerspy.net
- ua.tispy.net
- viptelefonprogrami.com
- www.kidlogger.net
- www.selfspy.com
- ua.tispy.me
- apprtc.appspot.com
- d.tispy.net
- login.quanly24h.net
- pc.backupsoft.eu
- pc.viptelefonprogrami.com
- quanly24h.net
- spyt.co
- spytrac-app1.s3.amazonaws.com
- theodoi24h.com
IP addresses (1)
- 52.22.130.9
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 11 known samples (SHA-256).
- Signing certificate: 16 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 20 known package identifiers.
- Network indicators: 27 domains and 1 IP address used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.