Community reports

01 · Community

Why there is a community section

A scanner can only know what is in its database. The indicator set GuestSpy uses covers 176 families and roughly 2,950 known samples, which is a lot, but stalkerware vendors rebuild constantly and new ones appear. The person most likely to find a new build is not a researcher. It is someone who pulled an unfamiliar app off their own phone and ran it through the scanner.

So every deep report ends with a community section, and this page is the feed of everything that has been published there. You can see what other people found, add what you know, and help the next person who scans the same package.

A few things this section is not. It is not a review site. There are no star ratings and no "trusted by millions". We do not pre-fill it with anything. If a package has no reports, the section says so. Every report you see here was written by a real person and read by a moderator before it appeared.

How voting works

Every report is attached to one of two things: an Android package name (like com.android.core.monitor) or a file hash (the SHA-256 of a file). Package names let people compare notes about an app across versions; hashes let people compare notes about one exact file.

When you open a report, you can cast one vote:

Safe – you know this app or file and it is what it says it is.
Suspicious – something is off, but you can’t be sure. Say what.
Malicious – you found it monitoring someone, or the evidence in the scan leaves no doubt.

You can add a comment. Useful comments say how the app got onto the phone, what it was called in the app drawer (if it had an icon at all), what it did, and whether anything in the scanner’s report was wrong. Comments that just say "virus!!!" don’t help anyone and tend not to be published.

One vote per person per package or hash. You can change your vote later. Votes are counted and shown as a tally next to the scanner’s own verdict, so you can see at a glance when the community agrees with the scan and when it doesn’t. The two are kept separate on purpose: the scanner’s verdict is evidence-based and reproducible; the community’s is lived experience. Both matter, and they are not the same thing.

How moderation works

Nothing appears on this page or in a report’s community section until a moderator has read it. This is slow compared with instant publishing, and it is deliberate.

Moderators check for:

Doxxing and personal information

Reports that name a person, include a phone number, address, or screenshots with identifying details are edited or rejected. The point is to describe the software, not the person who installed it.

Vendor astroturfing

Monitoring-app vendors have an obvious interest in "Safe" votes. We watch for bursts of votes from similar sources and for comments that read like marketing.

Defamation of legitimate apps

A real messaging app getting "Malicious" votes because it reads SMS is not helpful. Moderators may add a note rather than remove the vote.

Spam, abuse and off-topic content

Moderators do not change votes, and they do not remove a well-explained report just because it disagrees with the scanner. If the community consistently flags something the scanner calls Clean, that is exactly the signal we want, and it feeds back into our heuristic rules and into what we submit upstream to the open-source indicator set.

What we store

A submitted report contains the package name or hash, your vote, your optional comment, a timestamp, and a hashed form of your IP address that we use only to limit abuse (one vote per person, rate limiting). We do not store the file, your name, or your email unless you choose to create an account. The privacy policy has the details.

A note on what to share

If you are reporting an app you found on your own phone, think about what the installer might recognise. Avoid quoting account names, dashboard URLs with identifiers, or dates that only you and they would know. Describe the software. If you are in an abusive situation, the safety page comes before any of this.

05 · Reading the report

Latest published reports

Look up a package name or SHA-256

Loading…

Submitting a new indicator

If the scanner’s verdict was heuristic (no family match) and you are confident the app is monitoring software, the most valuable thing you can do beyond voting is share the file hash and the signing-certificate fingerprint from the Identity section of the report. Those two values let researchers attribute the sample and add it to the indicator set so every scanner using that data catches it next time. You can include them in your comment, and a moderator will pass them on. Do not upload the file anywhere you aren’t comfortable with; the hash is enough to start.