GuestSpy has five tools. Each one checks a different place spyware can hide. Every result shows its evidence, so you can see why an app or file was flagged.
| Verdict | Severity | Meaning |
|---|---|---|
| Clean | 0–9 | No indicators matched and no risky behaviour found in the checks that were run. |
| Low risk | 10–29 | Minor findings worth knowing about, such as a broad permission or an unusual configuration. Usually fine. |
| Suspicious | 30–59 | A combination of behaviours that monitoring software relies on, without a match against a known family. |
| Dangerous | 60–84 | Strong surveillance, stealth or persistence evidence, or a weaker database match. Treat as hostile until proven otherwise. |
| Known stalkerware | 85–100 | Matched a known stalkerware family by hash, certificate, package name or command-and-control domain. |
| Watchware | varies | A visible monitoring or parental-control product. Legitimate when you agreed to it; reported so you can decide. |
Danger code format: GS-<CLASS>-<PLATFORM>-<NNNN>, for example GS-STK-AND-1405. Classes: STK Stalkerware · WCH Watchware (visible monitoring app) · SPY Spyware behaviour (heuristic) · TRJ Trojan / dropper · ADW Adware · PUA Potentially unwanted application · CFG Risky configuration (profiles, MDM) · DOC Malicious document · CLN Clean. Platforms: AND Android, IOS iPhone/iPad, WIN Windows, MAC macOS, DOC document, GEN generic.
Stalkerware detection
This is the main scan for Android phones. It checks every installed app, including apps with no icon. Each app gets one of five verdicts, from Clean to Known stalkerware.
GuestSpy looks for the tricks stalkerware uses. That means hidden icons, fake system names, device admin abuse and accessibility services that read your screen. See the stalkerware detection page for details.
App scanner
The app scanner gives you a full report on one Android app. Pick an installed app, or drop an APK into the Web Scanner. You get the same deep report either way.
Identity
Package name, version and the certificate that signed the app.
Permissions
Every permission, sorted from Critical to Low risk.
Components
Accessibility services, device admin, notification listeners and boot start.
Network
Domains and IPs in the code, checked against 900+ known C2 servers.
Removal plan
Steps written for that specific app.
Use it to check an APK someone sent you before you install it.
Permission audit
The permission audit lists every app on your Android phone by risk. It highlights risky combinations, like a flashlight app that reads your contacts. It also shows special access that normal settings screens hide.
Device admins
Apps that can block their own removal.
Accessibility services
Apps that can read your screen and keystrokes.
Notification listeners
Apps that can read every incoming message preview.
Usage access
Apps that can see which apps you use and when.
Display over other apps
Apps that can draw on top of your screen.
Battery exemptions
Apps allowed to run nonstop in the background.
iPhone security check
iOS doesn’t let apps see each other. So the iPhone security check looks at settings and accounts instead. It has two parts.
The profile analyser reads a .mobileconfig file and decodes 38 payload types. It tells you if the profile adds MDM, a VPN, a root certificate, a proxy or new DNS. It also shows who signed it and whether it can be removed.
The guided checks take you through steps only you can do on the phone.
- 1Open Settings > General > VPN & Device Management and review each profile.
- 2Open Settings > [your name] and remove devices you don’t own.
- 3Run Settings > Privacy & Security > Safety Check.
- 4Look for unknown iCloud sign-ins and signs of a jailbreak.
- 5For a forensic answer, analyse a backup with the free Mobile Verification Toolkit (MVT).
File scanner
The file scanner checks documents, archives, scripts and executables. It recognises 45+ file types by their real content. So photo.jpg.exe gets caught as the program it is.
Real file type
Flags files whose extension doesn’t match their content.
Hashes
SHA-1, SHA-256 and SHA-512, ready to share with an analyst.
Entropy
Spots packed or encrypted content that hides what a file does.
Strings
Pulls out URLs, IPs, emails and crypto wallet addresses.
Office macros
Finds auto-run macros and calls to PowerShell or downloads.
PDF actions
Finds JavaScript, OpenAction and Launch entries.
Everything runs in your browser. The file is never uploaded.
How GuestSpy reaches a verdict
Each scan follows the same steps. The confidence level on a finding tells you which step produced it.
- 1
List the apps
GuestSpy finds every package, including ones with no icon. - 2
Read the identity
It reads the manifest, certificate and file hash. - 3
Match the database
It checks hash, then certificate, then package name, then C2 domains. - 4
Run the rules
93 behaviour rules run on every app, matched or not. - 5
Score it
Rules add up to a severity score from 0 to 100. - 6
Give the verdict
Confidence and severity together set the verdict and danger code. - 7
Map and plan
Rules map to MITRE ATT&CK, and a removal plan is built.
One rule alone rarely makes an app Suspicious. A screen reader needs accessibility access, for example. The pattern matters. A hidden icon plus device admin plus screen reading plus SMS access looks like stalkerware.
Reports you can keep
Tap any finding to open the deep report. It starts with a short summary of what was found. The sections below it hold the evidence.
Overview
Verdict, danger code, confidence, severity and a short summary.
Identity
Package, version, SDK levels and certificate fingerprints.
Permissions
Grouped into Critical, High, Medium and Low.
Components
The parts that run in the background without you.
ATT&CK mapping
What the app can do: track, listen, read or hide.
Community verdicts
Moderated votes and comments from other users.
Export any report as a PDF or JSON file for free. Share it with an advocate, lawyer or IT team.
Subject
Sync Services (com.guest) v2.4.1
APK · 4.2 MBSHA-256 7f3a9c0e…4e21b
Verdict
Severity 96 / 100
Confidence: signing-certificate match
Danger code GS-STK-AND-1405
Family
TheTruthSpy
also: Copy9, iSpyoo, FoneTracker, GuestSpy (legacy)
Evidence (12)
| CERT | Signer matches TheTruthSpy family | Certificate |
| GS-R-014 | Hides launcher icon | T1628.001 |
| GS-R-021 | Accessibility service declared | T1417.001 |
| GS-R-030 | SMS + call log + location combination | T1636.004 |
| GS-R-018 | Device administrator receiver | T1626.001 |
| GS-IOC-C2 | media-sync-a.thetruthspy.com | T1437.001 |
Checks performed
37 rules evaluated · 12 fired · 25 passed · 5 evidence levels · database 176 families / 2,953 hashes
The database
GuestSpy’s indicators come from the open Echap stalkerware-indicators project, licensed CC-BY 4.0. GuestSpy adds its own behaviour rules on top. Those rules catch new builds that no list has yet.
176 families
Stalkerware and visible watchware apps.
640+ package names
App IDs used by known families.
470+ signing certificates
Vendor keys reused across rebrands.
About 2,950 sample hashes
Fingerprints of confirmed files.
900+ C2 domains
Servers that collect stolen data.
93 detection rules
Behaviour checks mapped to MITRE ATT&CK.
The app downloads updates as they’re published. The Web Scanner loads the latest set when the page opens. Browse the same data in the threat encyclopedia.
Privacy by design
A tool that hunts spyware shouldn’t collect your data. GuestSpy is built to keep your scans on your device.
Browser scans stay local
Files are read in memory and never sent anywhere.
Phone scans stay local
Your app list never leaves the phone.
Reports stay with you
You decide who gets a copy.
Sharing is optional
Verdict sharing is anonymous and only happens if you choose it.
No account needed
Every feature is free and works without signing up.
Read the privacy page for the full details.
Removing stalkerware can alert the person who installed it. If you’re in an abusive situation, plan first. In the US, call the National Domestic Violence Hotline at 1-800-799-7233. The Coalition Against Stalkerware at stopstalkerware.org lists local help. Scanning and saving a report changes nothing on the phone.
Limits
No phone scan from the web
The Web Scanner checks files and lists you give it.
No iPhone app list
IOS blocks it, so GuestSpy checks profiles and accounts.
Clean isn’t a guarantee
It means nothing matched. New families still appear.
Heuristics can be wrong
That’s why confidence and every rule are shown.
Frequently asked questions
Which feature should I start with?
On Android, install the app and run stalkerware detection. On iPhone, start with Settings > General > VPN & Device Management. For a file or APK, use the Web Scanner.
Do I need the app to use the Web Scanner?
No. The Web Scanner runs in any modern browser. You only need the app to scan the apps installed on an Android phone.
Why does a report show severity and confidence?
They answer different questions. Severity shows how harmful the app could be. Confidence shows how sure GuestSpy is about what it is.
Can I check an app before installing it?
You can. Drop the APK into the Web Scanner’s App scan mode. You’ll see who signed it and what it can do before it touches your phone.
Is anything held back for paying users?
Nothing. GuestSpy is free, with no paid tier. Every feature, scan and export on this page costs nothing.
Check your phone now. It's free.
Scan in your browser in about two minutes, or get the app for Android and iPhone.