Threat encyclopedia

What this is

Every family GuestSpy can name has an entry here, under its danger code. The code is the one you see in a scan report, so if a result says GS-STK-AND-7685, this is where you find out that it is the mSpy family, what package names and certificates it has used, which servers it talks to, what it can do on a phone, and what removing it involves.

The entries are built from the open-source stalkerware indicators maintained by Echap (CC-BY 4.0) and from our own analysis. There are 176 families at the moment: 149 classed as stalkerware (STK, hidden monitoring) and 27 classed as watchware (WCH, visible monitoring and parental apps). Between them they account for 600+ package names, 470+ signing certificates, roughly 2,950 known sample hashes and 900+ command-and-control domains. The counts update as the database does.

A family is a group of products that share code, infrastructure or signing keys, even when they are sold under different brand names. TheTruthSpy, for example, is one family (GS-STK-AND-1405) sold under more than a dozen names, including the old GuestSpy monitoring app. Grouping by family rather than brand is what lets a certificate match on one brand catch a rebranded build of another.

02 · Step by step

How to read an entry

Each entry has:

Danger code and class

STK or WCH, and the platform.

Names

The brand names the family has been sold under.

Identifiers

Package names, signing certificate fingerprints (SHA-1), known distribution and C2 domains. These are the values the scanner matches against. They are published so you can verify a match yourself.

Capabilities

What the software can do once installed, expressed as the permissions and components typically found in its builds and the ATT&CK for Mobile techniques they map to.

How it is installed

Sideloaded from the vendor’s site after someone has physical access; occasionally through the Play Store under an innocuous name before removal; on iPhone, typically through Apple Account access or an MDM profile rather than an app.

Signs on the device

Hidden icons, system-looking names, accessibility and device admin grants, battery and data use.

Removal notes

Anything specific to the family, such as a device admin that must be revoked first, or a second component that reinstalls the first.

Entries do not include links to vendor sites.

Before you act on an entry

If a scan matched one of these families on your phone, removal can alert the person who installed it. Read the safety page first if that person is someone you live with or are afraid of. The Coalition Against Stalkerware (stopstalkerware.org) lists support organisations by country; in the US, the National Domestic Violence Hotline is 1-800-799-7233.

The classes

STK, stalkerware

Hides from the user, reports to a dashboard. The core of the database.

WCH, watchware

Visible monitoring: family locators, parental controls, employee agents with a visible icon. Shown in purple. Consent is the question, not the code.

SPY, spyware behaviour

Heuristic verdicts for apps that act like monitoring software but match no family. These do not have encyclopedia entries, because they are not named; they are described in the report that produced them.

TRJ, ADW, PUA, DOC, CFG

Trojans and droppers, adware, potentially unwanted apps, malicious documents and risky configurations. Where a specific family or profile is named, it is here; most are described generically on the file scanner and iPhone security check pages.

All families

Filter by class, platform or name. Click a code for the full entry.

StalkerwareGS-STK-AND-0053

AbsoluTrack

also RemoteSecurity

10 pkg
7 cert
12 dom
10

WatchwareGS-WCH-AND-4073

Accountable2you

1 pkg
1 cert
4 dom

StalkerwareGS-STK-AND-5711

Ahmyth

2 pkg
1 cert
0 dom

StalkerwareGS-STK-AND-5051

AiSpyer

1 pkg
2 cert
11 dom

StalkerwareGS-STK-AND-8049

AllTracker

also Russcity

4 pkg
7 cert
6 dom
82

StalkerwareGS-STK-AND-6710

Android007

also SpyBunker

0 pkg
0 cert
5 dom

StalkerwareGS-STK-AND-7438

AndroidLost

2 pkg
1 cert
6 dom

StalkerwareGS-STK-AND-7007

AndroidMonitor

also UltimatePhoneSpy

1 pkg
2 cert
7 dom
71

StalkerwareGS-STK-AND-1130

AndroidPolice

also MonitorChecker, AndrMonitor, AndroidMon +1

17 pkg
17 cert
18 dom
20

StalkerwareGS-STK-AND-6093

AndroidSpy

also AndroSpy, ASpy

12 pkg
7 cert
5 dom
254

StalkerwareGS-STK-AND-1307

AndroidSpyApp

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-1929

AndroRat

1 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-9699

AntiFurtoDroid

1 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-2234

AppMia

1 pkg
1 cert
6 dom

StalkerwareGS-STK-AND-2702

AppSpy

also MobileFindFree, FreeSpy

5 pkg
6 cert
30 dom
5

StalkerwareGS-STK-AND-2615

bark

1 pkg
1 cert
3 dom
8

StalkerwareGS-STK-AND-5488

BlurSpy

also XOXOSpy

1 pkg
1 cert
5 dom

WatchwareGS-WCH-AND-5636

Boomrang

1 pkg
1 cert
1 dom

StalkerwareGS-STK-AND-6365

BosSpy

1 pkg
1 cert
1 dom

StalkerwareGS-STK-AND-2548

BrunoEspiao

4 pkg
4 cert
14 dom
2

StalkerwareGS-STK-AND-3917

Buhsam

1 pkg
1 cert
1 dom

StalkerwareGS-STK-AND-7085

Bulgok

also ControlPhone

3 pkg
3 cert
3 dom
1

StalkerwareGS-STK-AND-0867

CallSMSTracker

also Quizmo, Multiverze, HiddenSMSTracker

2 pkg
2 cert
13 dom

StalkerwareGS-STK-AND-3327

CatWatchful

3 pkg
13 cert
7 dom
32

StalkerwareGS-STK-AND-3096

Cerberus

also Cerberus Enterprise, Cerberus Kids, Cerberus Personal Safety +2

10 pkg
8 cert
7 dom
101

StalkerwareGS-STK-AND-4675

ClevGuard

also KidsGuard

2 pkg
2 cert
6 dom
2

StalkerwareGS-STK-AND-8298

Cocospy

also FoneMonitor, MinSpy, NeatSpy +5

28 pkg
6 cert
63 dom
47

StalkerwareGS-STK-AND-4772

CouplerTracker

2 pkg
2 cert
2 dom

StalkerwareGS-STK-AND-5348

Curiosus

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-4302

Dash

1 pkg
0 cert
0 dom

WatchwareGS-WCH-AND-1641

Discovenger

1 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-1519

DroidWatcher

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-3301

eagleSPY

1 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-8072

EasyLogger

5 pkg
7 cert
25 dom
48

StalkerwareGS-STK-AND-8127

EasyPhoneTrack

also Ppapp

5 pkg
4 cert
12 dom
531

StalkerwareGS-STK-AND-1944

EspiaoAndroid

also FoxSpy

1 pkg
1 cert
6 dom
12

StalkerwareGS-STK-AND-1698

EvaSpy

also Spyrix

0 pkg
0 cert
25 dom

StalkerwareGS-STK-AND-5361

Everspy

1 pkg
0 cert
2 dom

WatchwareGS-WCH-AND-5807

FamilyOrbit

1 pkg
1 cert
3 dom

WatchwareGS-WCH-AND-0487

FamiSafe

2 pkg
2 cert
11 dom

WatchwareGS-WCH-AND-6135

FamiShield

also Mitbe

1 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-0101

Fenced

also MobileSpyIo

2 pkg
1 cert
6 dom

StalkerwareGS-STK-AND-7483

FindMyKids

2 pkg
1 cert
6 dom

WatchwareGS-WCH-AND-7484

FindMyKids

1 pkg
1 cert
5 dom

StalkerwareGS-STK-AND-4329

FindMyPhone

also InMobi

3 pkg
0 cert
3 dom

WatchwareGS-WCH-AND-6538

FlareFamilyLocator

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-4729

FlashKeylogger

also FlashKeylog

3 pkg
1 cert
1 dom

StalkerwareGS-STK-AND-8459

FlexiSpy

4 pkg
9 cert
24 dom
102

StalkerwareGS-STK-AND-1382

FreeAndroidSpy

2 pkg
1 cert
3 dom
42

WatchwareGS-WCH-AND-5346

GeoZilla

1 pkg
1 cert
8 dom

StalkerwareGS-STK-AND-6006

GPSTrackerLoki

2 pkg
1 cert
3 dom
1

StalkerwareGS-STK-AND-7052

HelloSpy

also 1TopSpy, HelloSPy, MaxxSpy +2

19 pkg
9 cert
38 dom
92

StalkerwareGS-STK-AND-6774

HighsterMobile

also AutoForward, DDI, DDIUtilities +7

4 pkg
2 cert
28 dom
52

StalkerwareGS-STK-AND-7843

Hoverwatch

also SpyBubble, Refog

32 pkg
10 cert
36 dom
41

StalkerwareGS-STK-AND-3041

iKeyMonitor

8 pkg
9 cert
10 dom
7

StalkerwareGS-STK-AND-7008

iMonitorSpy

2 pkg
3 cert
6 dom
4

StalkerwareGS-STK-AND-1511

Intertel

0 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-8684

ISpy

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-9377

jjspy

also ttspy

1 pkg
10 cert
22 dom
4

StalkerwareGS-STK-AND-3998

juju

0 pkg
0 cert
2 dom

WatchwareGS-WCH-AND-8096

KasperskySafeKids

1 pkg
0 cert
1 dom

WatchwareGS-WCH-AND-4355

Kiddoware

1 pkg
0 cert
1 dom

WatchwareGS-WCH-AND-6488

Kidgy

1 pkg
0 cert
1 dom

WatchwareGS-WCH-AND-2655

KidsControl

1 pkg
0 cert
16 dom

WatchwareGS-WCH-AND-5122

KidsLox

1 pkg
1 cert
7 dom

StalkerwareGS-STK-AND-0884

KidsShield

also TiSpy, KidLogger, MonitorMinor +7

20 pkg
16 cert
27 dom
11

StalkerwareGS-STK-AND-4240

LetMeSpy

also RemoteCommand, RemCmd

10 pkg
4 cert
8 dom
10

WatchwareGS-WCH-AND-7021

Life360

1 pkg
1 cert
14 dom

WatchwareGS-WCH-AND-3302

LockItTight

1 pkg
0 cert
2 dom

StalkerwareGS-STK-AND-3365

LoveSpy

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-1700

MagMonitor

also maglook

0 pkg
0 cert
4 dom

StalkerwareGS-STK-AND-3787

Metasploit

also ForeverSpy

1 pkg
0 cert
2 dom

StalkerwareGS-STK-AND-3589

MeuSpy

21 pkg
20 cert
10 dom
62

WatchwareGS-WCH-AND-2457

MicrosoftFamilySafe

1 pkg
0 cert
4 dom

WatchwareGS-WCH-AND-5228

MMGuardian

3 pkg
1 cert
3 dom

WatchwareGS-WCH-AND-5714

MobileFence

1 pkg
0 cert
2 dom

StalkerwareGS-STK-AND-0397

MobileSpy

0 pkg
0 cert
9 dom

StalkerwareGS-STK-AND-4604

MobileTool

also MobTool, Jopsik

3 pkg
2 cert
23 dom
16

StalkerwareGS-STK-AND-1007

MobileTrackerFree

also MonitorLoverman, MTrack, CellTracker +1

39 pkg
43 cert
39 dom
27

StalkerwareGS-STK-AND-4619

MobiSpy

1 pkg
1 cert
2 dom
4

StalkerwareGS-STK-AND-6321

MobiStealth

also Stealthcell

5 pkg
2 cert
8 dom
167

StalkerwareGS-STK-AND-7415

MocoSpy

0 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-1945

MonitorUltra

1 pkg
1 cert
4 dom
21

StalkerwareGS-STK-AND-7120

Mrecorder

also mobrec

4 pkg
2 cert
16 dom

StalkerwareGS-STK-AND-0066

Msafely

also SpyX, SpyPhone

1 pkg
4 cert
15 dom

StalkerwareGS-STK-AND-7685

mSpy

also FakeSys, KidSecured, Phonsee +4

11 pkg
8 cert
96 dom
145

StalkerwareGS-STK-AND-1129

mSpyitaly

0 pkg
0 cert
3 dom

StalkerwareGS-STK-AND-9688

MyCellSpy

also CellSpy, MCSpy

3 pkg
1 cert
4 dom
3

StalkerwareGS-STK-AND-1912

MySpyApps

1 pkg
1 cert
2 dom
3

StalkerwareGS-STK-AND-3037

MzanziSpy

0 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-7197

NemoSpy

also Spyoo

0 pkg
2 cert
3 dom

StalkerwareGS-STK-AND-4224

NeoSpy

2 pkg
1 cert
13 dom
35

WatchwareGS-WCH-AND-9634

Netnanny

1 pkg
0 cert
4 dom

StalkerwareGS-STK-AND-8510

NetSpy

1 pkg
1 cert
3 dom
1

StalkerwareGS-STK-AND-5814

NexSpy

also Oxy, MobileBackup

0 pkg
0 cert
8 dom

StalkerwareGS-STK-AND-5473

Observer

2 pkg
5 cert
2 dom

StalkerwareGS-STK-AND-8095

OneLocator

also PhoneTrackerByNumber, FamilyLocator

1 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-9680

OneSpy

also OneMonitar, ChyldMonitor

4 pkg
3 cert
22 dom
5

StalkerwareGS-STK-AND-7074

OwnSpy

also SaferSpy, WebDetetive

2 pkg
2 cert
13 dom
2

StalkerwareGS-STK-AND-8558

PanSpy

also SurveilStar

1 pkg
1 cert
9 dom
2

StalkerwareGS-STK-AND-0783

PatanSpyApp

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-3081

pcTattletale

1 pkg
2 cert
4 dom
35

StalkerwareGS-STK-AND-3661

PhoneMonitor

2 pkg
0 cert
4 dom

StalkerwareGS-STK-AND-3294

PhoneSheriff

also MobileNanny, PeekTab, RetinaX +1

12 pkg
2 cert
9 dom

StalkerwareGS-STK-AND-8472

PhoneSpy

2 pkg
2 cert
3 dom

WatchwareGS-WCH-AND-7635

Qustodio

1 pkg
0 cert
2 dom

StalkerwareGS-STK-AND-0755

RastreadorDeNamorado

1 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-4158

RealtimeSpy

1 pkg
1 cert
4 dom

StalkerwareGS-STK-AND-3921

RecomSpy

0 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-0891

Reptilicus

also CyberNanny, Vkur

10 pkg
8 cert
23 dom
58

StalkerwareGS-STK-AND-5995

RioSPY

0 pkg
0 cert
2 dom

WatchwareGS-WCH-AND-4650

SafeNet

1 pkg
1 cert
1 dom

WatchwareGS-WCH-AND-0529

ScreenTime

1 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-9342

SecretCamRecorder

1 pkg
0 cert
0 dom

WatchwareGS-WCH-AND-0693

SeekDroid

1 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-5213

SentryPC

0 pkg
0 cert
8 dom

StalkerwareGS-STK-AND-3424

ShadowSpy

3 pkg
3 cert
8 dom
14

StalkerwareGS-STK-AND-8317

ShadySpy

1 pkg
2 cert
2 dom
5

StalkerwareGS-STK-AND-3915

SmartKeylogger

also Hiddad

1 pkg
1 cert
1 dom

StalkerwareGS-STK-AND-6876

SMSForward

also SMForw

1 pkg
1 cert
0 dom

StalkerwareGS-STK-AND-4981

Snoopza

17 pkg
5 cert
13 dom
11

StalkerwareGS-STK-AND-2049

Spy24

6 pkg
2 cert
5 dom
7

StalkerwareGS-STK-AND-0317

SpyAdvice

also FreeSpyPhone

1 pkg
1 cert
4 dom

StalkerwareGS-STK-AND-4142

SpyApp

1 pkg
3 cert
34 dom
4

StalkerwareGS-STK-AND-8841

SpyApp247

1 pkg
0 cert
0 dom
2

StalkerwareGS-STK-AND-0180

SpyAppGhazi

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-4130

SpyDroid

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-4898

SpyEra

1 pkg
1 cert
6 dom

StalkerwareGS-STK-AND-8354

SpyFly

0 pkg
0 cert
1 dom

StalkerwareGS-STK-AND-8514

SpyHuman

7 pkg
6 cert
18 dom
18

StalkerwareGS-STK-AND-6046

Spyier

1 pkg
0 cert
3 dom

StalkerwareGS-STK-AND-6925

SpyKontrol

3 pkg
3 cert
4 dom

StalkerwareGS-STK-AND-6498

SpyLive360

5 pkg
2 cert
6 dom
3

StalkerwareGS-STK-AND-3671

Spylix

1 pkg
1 cert
7 dom
1

StalkerwareGS-STK-AND-6769

SpyMasterPro

2 pkg
3 cert
7 dom
7

StalkerwareGS-STK-AND-9993

Spymie

1 pkg
1 cert
0 dom
5

StalkerwareGS-STK-AND-6392

SpyMug

1 pkg
1 cert
0 dom

StalkerwareGS-STK-AND-9244

Spynger

also discovenger

1 pkg
1 cert
7 dom

StalkerwareGS-STK-AND-3309

SpyNote

also Scream, Screamon

2 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-8848

Spyone

10 pkg
7 cert
7 dom
6

StalkerwareGS-STK-AND-4404

SpyPhoneApp

3 pkg
3 cert
4 dom
221

StalkerwareGS-STK-AND-4252

SpyphoneMobileTracker

2 pkg
1 cert
7 dom

StalkerwareGS-STK-AND-5068

SpySMS

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-9897

SpyStealth

0 pkg
0 cert
4 dom

StalkerwareGS-STK-AND-8847

SpyTec

0 pkg
0 cert
5 dom

StalkerwareGS-STK-AND-4605

SpyTek

0 pkg
0 cert
3 dom

StalkerwareGS-STK-AND-8045

SpyToApp

1 pkg
1 cert
8 dom

StalkerwareGS-STK-AND-1742

Spyzier

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-7184

Stalkerware

1 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-9518

SwiftMobileSpy

0 pkg
1 cert
2 dom

StalkerwareGS-STK-AND-2412

TalkLog

3 pkg
2 cert
2 dom
7

StalkerwareGS-STK-AND-2843

TheOneSpy

also OgyMogy

2 pkg
3 cert
15 dom
8

StalkerwareGS-STK-AND-1405

TheTruthSpy

also Copy9, InoSPy, ExactSpy +9

10 pkg
16 cert
234 dom
368

StalkerwareGS-STK-AND-5835

TheWiSpy

1 pkg
1 cert
3 dom
1

StalkerwareGS-STK-AND-0943

Traccar

also Traca

2 pkg
4 cert
4 dom
24

StalkerwareGS-STK-AND-3244

TrackingSmartphone

also XZBO, TrackSmart, TrackingSmart

3 pkg
4 cert
4 dom

StalkerwareGS-STK-AND-8224

Trackji

1 pkg
1 cert
1 dom
1

StalkerwareGS-STK-AND-9928

TrackMyPhones

21 pkg
10 cert
10 dom

StalkerwareGS-STK-AND-8333

Trackplus

also Gpspy, S2mob, Spy2Mobile +4

34 pkg
38 cert
27 dom
1

StalkerwareGS-STK-AND-9837

Tracku

also Kurulum, Bakuf, Clues +3

8 pkg
13 cert
16 dom
13

StalkerwareGS-STK-AND-0572

TrackView

also LifeCircle

38 pkg
3 cert
16 dom
15

WatchwareGS-WCH-AND-3686

Trulpe

1 pkg
0 cert
2 dom

StalkerwareGS-STK-AND-4418

uMobix

3 pkg
3 cert
7 dom
5

StalkerwareGS-STK-AND-1739

Unisafe

4 pkg
5 cert
6 dom

StalkerwareGS-STK-AND-3066

VIPTrack

3 pkg
3 cert
2 dom
3

StalkerwareGS-STK-AND-6324

WebWatcher

also Atic, Interguard, Screentime +1

12 pkg
7 cert
18 dom

StalkerwareGS-STK-AND-8358

WheresMyDroid

1 pkg
1 cert
3 dom
3

StalkerwareGS-STK-AND-5560

WiseMo

2 pkg
1 cert
5 dom

WatchwareGS-WCH-AND-5561

WiseMo

1 pkg
1 cert
10 dom

StalkerwareGS-STK-AND-0698

WtSpy

2 pkg
1 cert
1 dom
6

StalkerwareGS-STK-AND-2682

XDSpy

1 pkg
2 cert
3 dom

StalkerwareGS-STK-AND-2066

xHunter

1 pkg
0 cert
0 dom

StalkerwareGS-STK-AND-4473

Xnore

1 pkg
1 cert
2 dom
5

StalkerwareGS-STK-AND-7038

XNSpy

also ZTI, SpyXiz4, SpyXiz4Me +1

3 pkg
1 cert
13 dom
11

StalkerwareGS-STK-AND-5556

XploitSPY

1 pkg
0 cert
1 dom

WatchwareGS-WCH-AND-6544

ZoeMob

1 pkg
1 cert
5 dom

No family matches that search. Try a package name such as com.guest, a domain, or a danger code. If you have the app itself, the Web Scanner checks it against every indicator, not just the name.

Missing something?

If the scanner gave a heuristic verdict on software you are sure is monitoring someone, the hash and signing-certificate fingerprint from the report’s Identity section are what researchers need to attribute it. Share them through a community report and we will review it and pass confirmed indicators upstream.