Scan an app, a file, an app list or an iPhone profile
Drop in an Android APK, a document, an archive, a .mobileconfig profile, or paste the output of adb shell pm list packages. The scanner takes it apart in your browser tab and tells you what it is, who signed it, what it can do, and whether any of it matches the 176 stalkerware and monitoring families in the database.
Nothing is uploaded. The file stays on your device from the first byte to the last. The scanner is free, has no scan limit and needs no account.
How do I get the APK of an app that is on my phone?
With USB debugging enabled and adb installed on a computer:
adb shell pm list packages -3 # list third-party packages
adb shell pm path com.example.app # find the APK path
adb pull /data/app/<…>/base.apk ./app.apkIf you cannot use adb, paste the output of the first command into the Installed apps tab instead, or use a file manager that can export ("share") an installed app as an APK.
How to export the list
adb shell pm list packages -f -3 -i # third-party apps with path and installer
adb shell pm list packages -u # includes uninstalled-but-kept packages
adb shell dumpsys package # full detail: permissions, install dates, flagsThe more you paste, the deeper the report: dumpsys package output lets GuestSpy audit granted permissions, installer, install dates and disabled components for every app.
How it works
The scanner has four modes. Pick the one that matches what you have.
App (APK) scan.
The full teardown: SHA-256 against known samples, the Android manifest decoded for package name, permissions and components, the signing certificate fingerprinted and matched against 470+ known signers, strings extracted and matched against 900+ command-and-control domains, native code and packers noted, and a danger score built from all of it. The app scanner page explains each stage.
File scan.
For documents, archives, scripts and anything else. The scanner reads the real file type from its first bytes and compares it with the extension, hashes it, measures entropy, extracts strings, and then checks the content: Office macros, PDF JavaScript and launch actions, executables and shortcuts inside archives, obfuscated scripts, HTML smuggling. Any APK it finds inside is handed to the app scanner. Details on the file scanner page.
Installed-apps list check. If you can connect the phone to a computer, adb shell pm list packages gives you every package name on it in one command. Paste the output here and each name is matched against 600+ known stalkerware and watchware package names. It is quick and needs no files. It is also less thorough than a full APK scan, because it cannot see certificates or domains, so a clean result here is a good sign but not a guarantee. The GuestSpy Android app does the same check on-device and can export the APKs for a full scan.
iPhone profile check. Give it a .mobileconfig file and it lists every payload: MDM enrollment, VPN, root certificates, global proxy, DNS, web clips, restrictions, Wi-Fi. It flags "removal disallowed", tells you whether the profile is signed and by whom, and explains what each payload means for someone trying to watch you. If you don’t have the file, a manual mode lets you tick what you see under Settings > General > VPN & Device Management. See the iPhone security check.
Whatever the mode, the result is the same shape: a verdict, a severity from 0 to 100, a confidence level, a danger code, and then the evidence. Every finding has a rule ID (GS-R-0xx), a plain-English explanation and, where it applies, the MITRE ATT&CK for Mobile technique. You can expand any line to see the raw data it came from, and export the whole thing as a PDF.
Reading the result
| Verdict | Severity | Meaning |
|---|---|---|
| Clean | 0–9 | No indicators matched and no risky behaviour found in the checks that were run. |
| Low risk | 10–29 | Minor findings worth knowing about, such as a broad permission or an unusual configuration. Usually fine. |
| Suspicious | 30–59 | A combination of behaviours that monitoring software relies on, without a match against a known family. |
| Dangerous | 60–84 | Strong surveillance, stealth or persistence evidence, or a weaker database match. Treat as hostile until proven otherwise. |
| Known stalkerware | 85–100 | Matched a known stalkerware family by hash, certificate, package name or command-and-control domain. |
| Watchware | varies | A visible monitoring or parental-control product. Legitimate when you agreed to it; reported so you can decide. |
Danger code format: GS-<CLASS>-<PLATFORM>-<NNNN>, for example GS-STK-AND-1405. Classes: STK Stalkerware · WCH Watchware (visible monitoring app) · SPY Spyware behaviour (heuristic) · TRJ Trojan / dropper · ADW Adware · PUA Potentially unwanted application · CFG Risky configuration (profiles, MDM) · DOC Malicious document · CLN Clean. Platforms: AND Android, IOS iPhone/iPad, WIN Windows, MAC macOS, DOC document, GEN generic.
If you disagree with a result, or you can confirm one, the community section at the bottom of every report is where to say so.