iPhones get watched differently
The question we get most from iPhone owners is "can you scan my phone for spyware?" The honest answer is that no app on the App Store can do what an Android scanner does, because iOS does not let one app see which other apps are installed, read their files, or inspect their permissions. That is a good thing for your security. It also means anyone promising a one-tap iPhone spyware scan is either overselling or asking you to jailbreak.
So we built something else. GuestSpy’s iPhone security check is two tools:
- A configuration profile analyzer. You give it a
.mobileconfigfile (or the profile details you can see on the phone), it runs in your browser, and it tells you exactly what the profile grants and whether that is what a stalker would set up. - A guided checklist that walks you through the places iOS itself exposes monitoring: Apple Account devices, Safety Check, sharing settings, unknown logins, jailbreak signs, and when it is worth taking a forensic backup.
Because the realistic ways an iPhone gets monitored are not viruses. They are:
Someone knows your Apple Account password and reads your iCloud backups, messages, photos and location from another device.
Someone installed a configuration profile or enrolled the phone in a mobile device management (MDM) system that routes your traffic, installs a root certificate, or pushes "web clip" shortcuts that look like apps.
Someone turned on sharing you didn’t notice
Find My location sharing, a shared photo album, Family Sharing with screen-time oversight, call forwarding, or message forwarding to another device.
Much more rarely, the phone was jailbroken and an actual monitoring app was installed, or it was hit by a commercial exploit of the kind that needs a forensic tool to find.
The analyzer handles the second one in depth. The checklist handles the rest.
com.example.wifi.profilePayloads 4
What a configuration profile is
A configuration profile is an XML property list (a .mobileconfig file) that tells iOS to apply settings. Companies use them to set up corporate Wi-Fi, email and VPN. Schools use them to lock down student iPads. Carriers use them for cellular settings. Developers use them to install beta apps.
They are installed by opening the file (from Safari, Mail, AirDrop, Messages), then confirming in Settings > General > VPN & Device Management. Profiles can also be installed through Apple Configurator from a Mac with the phone plugged in, which takes a couple of minutes of physical access. Once installed, a profile can change how the phone behaves at a level no normal app can touch.
The file has a top-level PayloadContent array of individual payloads, each with a PayloadType describing what it configures. The analyzer parses that structure, including signed profiles (which wrap the plist in a CMS signature) and profiles that are base64 or binary plist encoded, and lists every payload with what it does.
The payload types, and what each means for someone watching you
Here is the list the analyzer knows well. For each one: what it legitimately does, and what it does in the wrong hands.
com.apple.mdm – Mobile Device Management enrollment
Legitimately:
Enrolls the phone in an MDM server, which can then push apps, settings, restrictions and further profiles over the air, and can query the device for its installed apps, location (with supervision and a managed app), and compliance state.
For a stalker:
MDM is the closest thing iOS has to a stalkerware agent. Once enrolled, the server can silently install a managed VPN, a root certificate and a global proxy, push restrictions that stop you removing anything, and list every app on the phone. Several commercial "iPhone monitoring" products are in reality MDM enrollment with a consumer front end. The analyzer shows the ServerURL, the CheckInURL, the AccessRights bitmask (translated into "can install apps", "can query installed apps", "can erase device" and so on), and whether the payload is combined with PayloadRemovalDisallowed.
The analyzer also checks whether the server is one of the known MDM-based monitoring providers in our indicator set and whether it is a plain IP address or a dynamic DNS host, which no legitimate corporate MDM would use.
com.apple.vpn.managed – VPN configuration
Legitimately: a corporate VPN, or a consumer VPN app’s always-on setup.
For a stalker: a VPN routes all of the phone’s traffic through a server someone else controls. Combined with a root certificate (next item), that server can decrypt and read HTTPS traffic. Even without the certificate, it sees every domain you visit and when. The analyzer shows the VPN server, the protocol, whether it is set to Always On (OnDemandEnabled with OnDemandRules that match everything, or AlwaysOn on supervised devices), and whether the server is known to our database.
com.apple.security.root – root certificate
Legitimately: corporate networks that inspect TLS traffic, developer test setups, some parental-filter products.
For a stalker: this is the payload that turns "they can see where I go online" into "they can read what I send". A trusted root certificate lets whoever holds the matching private key impersonate any website. Your bank, your email, your messages over the web, all readable at the proxy or VPN end. On iOS, a profile-installed root certificate must additionally be enabled under Settings > General > About > Certificate Trust Settings for full trust, but many users are walked through that step as part of a "setup". The analyzer extracts the certificate’s subject, issuer, fingerprint and validity, and tells you whether it is a publicly known CA or an unknown private one.
com.apple.proxy.http.global – global HTTP proxy
Legitimately: corporate web filtering on supervised devices.
For a stalker: every web request goes through a server of their choosing. This payload only applies on supervised devices, so its presence also tells you the phone has been supervised, which requires it to have been erased and set up through Apple Configurator or Automated Device Enrollment. That is a very strong signal that someone with extended physical access prepared this phone. The analyzer shows the proxy host and port and whether it is a PAC (auto-config) URL, which can route traffic selectively.
com.apple.dnsSettings.managed – encrypted DNS settings
Legitimately: forcing DNS over HTTPS or TLS to a chosen resolver, used by privacy tools and corporate filters.
For a stalker: DNS is a list of every site and service your phone looks up, including the names behind app traffic. Pointing it at a server they control gives a complete browsing and app-usage history without touching the content. The analyzer shows the resolver, the protocol, and whether ProhibitDisablement is set, which stops you turning it off in Settings.
com.apple.webClip.managed – Web Clips
Legitimately: a shortcut on the Home Screen to a web page, used by companies for internal portals.
For a stalker: a Web Clip can look exactly like an app: custom icon, custom name, opens full screen with no Safari chrome. "Bank", "Messages", "Settings" – any of these can be a Web Clip pointing at a phishing page that captures what you type. Web Clips are also used to install "apps" that are really the monitoring vendor’s dashboard. The analyzer shows the URL, the Label, whether IsRemovable is false (you cannot delete the icon), and whether FullScreen is on.
com.apple.applicationaccess – restrictions
Legitimately: parental controls and corporate policy: no App Store, no camera, no Safari, no removing apps.
For a stalker: restrictions are how an installer stops you undoing what they did. The relevant keys the analyzer looks for and translates:
allowAppRemoval = false
– you cannot delete apps.
allowUIConfigurationProfileInstallation = false
– you cannot install other profiles (including ones that would help you).
allowAccountModification = false
– you cannot sign out of the Apple Account or change it.
allowPasscodeModification = false
– you cannot change your passcode.
forceAutomaticDateAndTime
allowVPNCreation = false, allowEnablingRestrictions = false.
allowUntrustedTLSPrompt = false
– combined with a root certificate, removes the warning you would otherwise see.
allowSafari = false
Alongside a Web Clip "browser" – you are forced to use their page.
allowFindMyDevice = false
/ allowFindMyFriends = false with forceOnDeviceOnlyDictation, allowCloudBackup tweaks – these shape what evidence you can gather.
Most of these only take effect on supervised devices, and the analyzer says so for each, because a restriction payload on an unsupervised phone is less powerful than it looks.
com.apple.wifi.managed – Wi-Fi
Legitimately: auto-joining the office network.
For a stalker: a managed Wi-Fi payload can set a proxy for a specific network, can be marked so you cannot forget the network, and can auto-join a network name the attacker controls at home or near work. The analyzer shows the SSID, security type, any per-network proxy, and AutoJoin.
Other payloads the analyzer recognises
com.apple.mail.managed
/ com.apple.eas.account (Exchange): an account that silently syncs your mail, contacts and calendar to a server. The analyzer shows the host and whether the account can be removed.
com.apple.cellular
/ APN settings: routing mobile data through a particular carrier gateway or proxy.
com.apple.sso.extension
/ com.apple.extensiblesso: single sign-on extensions that can intercept authentication.
com.apple.system.logging
com.apple.notificationsettings: suppressing notifications from specific apps (for example, hiding the "VPN connected" badge).
com.apple.security.pem
/ com.apple.security.pkcs12: additional certificates and identities.
com.apple.ManagedClient.preferences
And unknown types: listed as-is with a note that they are unusual on a personal phone.
The three profile-level flags
Beyond the individual payloads, three properties of the profile as a whole matter a great deal.
PayloadRemovalDisallowed
If this is true, the Remove Profile button in Settings is gone. The profile can only be removed by the MDM server, by erasing the phone, or (on unsupervised devices) by the RemovalPassword if one was set and you know it. The analyzer shows this at the top of the report in red whenever it is set. A personal-use profile from a VPN app or a carrier never sets this. A stalker almost always does.
Signed vs unsigned
Profiles can be signed with a certificate so iOS shows "Verified" in green with the signer’s name. Unsigned profiles show "Not Signed" in red. The analyzer tells you which, and for signed profiles extracts the signer: a real company’s name on a real certificate from a public CA, or a self-signed certificate with a name typed in by whoever made it. Be aware that "Verified" only means the file was not altered after signing. It does not mean the profile is safe, and a monitoring vendor can perfectly well sign their profile.
Supervision
Some payloads (global proxy, many restrictions, always-on VPN) require the device to be supervised. The analyzer notes which of the payloads it found require supervision. If any are present and you did not set the phone up through a company or school, someone erased your phone and set it up through Apple Configurator, or restored it as supervised. You can check supervision yourself: Settings > General > About will show "This iPhone is supervised and managed by …" near the top if it is.
The guided checklist
The profile analyzer covers one route. The checklist covers the others. Each item below is in the app as a step with the exact path, what "normal" looks like, and what to screenshot.
Needs a look 1
Protection
1. Apple Account devices
Settings > [your name] > scroll down to the device list.
Every device signed into your Apple Account is listed: iPhones, iPads, Macs, Apple Watches, Apple TVs, and Windows PCs with iCloud for Windows. Tap each one. A device you do not own, or one with a name you do not recognise, has access to your iCloud data: photos, messages (if Messages in iCloud is on), backups, Keychain passwords, and Find My location. Remove it from this screen and then change your Apple Account password immediately, from a device you trust.
This is the single most common way iPhones get monitored. No software, no profile. Someone simply knows your password and has signed in on their own phone or a web browser. Many commercial "iPhone monitoring" products work entirely this way: you give them the target’s Apple ID and password, they pull the iCloud backup.
2. Two-factor authentication and trusted phone numbers
Settings > [your name] > Sign-In & Security.
Check that two-factor is on, and check the trusted phone numbers. An extra trusted number that is not yours means someone can receive your verification codes. Check "Account Recovery" contacts and "Legacy Contact" too. Remove anything you did not add.
3. Safety Check
Settings > Privacy & Security > Safety Check (iOS 16 and later).
Apple’s own tool for exactly this situation. Emergency Reset removes everyone’s access to everything in one step and signs out all other devices. Manage Sharing & Access walks through, item by item, who you share location, photos, notes, calendars, health data and passwords with, which apps have which permissions, and which devices are signed in. Use Manage Sharing first if you want to see before you act; it shows each person by name.
Removing someone’s access through Safety Check ends their sharing immediately. If that person is dangerous, they may notice. Apple includes a Quick Exit button on every Safety Check screen for a reason. Plan first, document second, act third. See the safety page.
4. Find My
Settings > [your name] > Find My > Find My iPhone, and Settings > [your name] > Find My > Share My Location.
Check "Share My Location" and the list of people you share with. Then open the Find My app > People tab for the same list. Also check Find My > Devices for AirTags or other trackers paired to your account, and use the Items tab’s "Identify Found Items" if you suspect a tracker that is not yours is travelling with you.
5. Family Sharing and Screen Time
Settings > [your name] > Family Sharing.
If you are in a Family Sharing group, check whether Screen Time is shared and who the organiser is. An organiser can see app usage, set downtime and approve or block apps. Settings > Screen Time will show "Screen Time Passcode" if someone else set one; if you don’t know it, someone else controls these settings.
6. Message and call forwarding
Settings > Messages > Text Message Forwarding – any Mac or iPad listed receives copies of your SMS.
Settings > Phone > Call Forwarding (carrier dependent) and Settings > Phone > Calls on Other Devices.
Settings > FaceTime > Calls from iPhone.
Each of these is a legitimate convenience that becomes monitoring when the other device belongs to someone else.
7. Mail and account rules
Settings > Mail > Accounts for accounts you don’t recognise. Then, in your email provider’s web interface, check for forwarding rules and app passwords. A forwarding rule in Gmail or iCloud Mail sends a copy of every email to another address and is invisible from the phone.
8. VPN & Device Management
Settings > General > VPN & Device Management.
This is where profiles and MDM enrolment show. "No profiles installed" is the answer you want on a personal phone. Anything else: tap it, read More Details, and run it through the analyzer. Also check Settings > General > VPN for a configuration you didn’t add.
9. Shared albums, notes, calendars and passwords
Photos > Albums > Shared Albums. Notes with the shared-person icon. Calendars > Calendars > shared calendars. Settings > Passwords > Family Passwords (iOS 17+) for shared password groups.
10. App permissions and the privacy report
Settings > Privacy & Security > Location Services for apps with "Always" location. Settings > Privacy & Security > App Privacy Report (turn it on if it is off, then check back in a week) for which apps contacted which domains. While iOS won’t let us scan apps, it will tell you what they reached out to.
11. Jailbreak signs
A jailbroken iPhone can run real monitoring apps. Signs: an app called Cydia, Sileo, Zebra or similar; apps you did not install; the phone refusing iOS updates; unusual battery drain and heat; Settings > General > VPN & Device Management showing developer certificates; third-party "tweaks" in Settings. A jailbreak on a current iOS version is rare and typically does not survive a restart on recent devices, so a restart followed by the signs disappearing is itself informative. If you suspect a jailbreak, the safest route is a full erase and restore as a new phone (not from the backup), after documenting.
12. Forensic backups with MVT
For high-risk situations (journalists, activists, people targeted by a well-resourced ex) there is the Mobile Verification Toolkit, an open-source forensic tool from Amnesty International’s Security Lab. It analyses an encrypted iTunes/Finder backup (or a full filesystem image from a jailbroken device) against indicators of compromise for commercial spyware. GuestSpy does not replace MVT. The checklist tells you when it is worth it, how to make the encrypted backup it needs, and where to get help running it (Access Now’s Digital Security Helpline, for civil society). If you are not in that category, steps 1 to 11 cover the realistic threats.
What this check cannot do
It cannot list the apps installed on your iPhone or inspect them. No App Store app can.
It cannot see your iCloud account’s login history
Apple shows devices, not logins, and the device list in step 1 is the closest thing.
It cannot detect a zero-click exploit from a commercial spyware vendor
That is MVT’s job, and even MVT needs a backup to work from.
A web page cannot read your phone’s settings
Every step in the checklist is something you do, with the app or the page telling you where to look.
Frequently asked questions
I found a profile. Should I just delete it?
If the profile is removable and you are not worried about the installer’s reaction, yes: Settings > General > VPN & Device Management > tap it > Remove Profile. Screenshot the details first. If it is not removable, or if you are worried about the reaction, read the safety note and the iPhone removal guide first. A non-removable profile on a personal phone usually means an erase.
My employer’s MDM is on my personal phone. Is that monitoring?
It can be. An MDM with the "query installed apps" access right can see your app list, and a supervised MDM can see more. Ask your IT department what is pushed and what they can see, and consider a work profile or a separate device. The analyzer will tell you what the enrollment allows.
Can someone track my iPhone just with my Apple ID?
Yes. Find My location, iCloud backups, Photos, Messages in iCloud and Keychain are all readable from any device signed in with your Apple Account. Step 1 and step 2 of the checklist are about exactly this. Changing your password and turning on two-factor with only your own trusted numbers closes it.
Why doesn’t GuestSpy have an iPhone "scan" button?
Because we would have to lie about what it does. iOS does not permit one app to see other apps. We would rather give you a checklist that works than a button that doesn’t.
Does the profile analyzer upload my .mobileconfig?
No. The file is parsed in your browser. The signer, server addresses and payload details never leave your device unless you choose to submit a community report, which stores only the server hostname and your vote.
Run a free scan right now
Drop an APK, a file, your installed-apps list or an iPhone configuration profile into the GuestSpy Web Scanner. Everything is analysed inside your browser. Nothing is uploaded.