Cocospy is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as FoneMonitor, MinSpy, NeatSpy, SafeSpy, Spyic, Spyine, Spyzie, TeenSafe.
GS-STK-AND-8298Package names (28)
- com.aiyi.admin
- com.cocospy
- com.duiyun.cocospy
- com.duiyun.cocospy.v2
- com.duiyun.fonemonitor
- com.duiyun.spyine
- com.duiyun.spyzie
- com.duiyun.spyic
- com.minspy.v2
- com.minspy.v3
- com.sc.cocospy.v2
- com.sc.fonemonitor
- com.sc.fonemonitor.v2
- com.sc.minspy.v2
- com.sc.neatspy.v2
- com.sc.safespy.v2
- com.sc.safespy.v3
- com.sc.spyic.v2
- com.sc.spyic.v3
- com.sc.spyier.v2
- com.sc.spyine.v2
- com.sc.spyzie.v2
- com.dy.spyzie.v4
- com.sc.teensafe.v2
- com.spyic
- com.wb.production
- com.ws.sc
- com.ws.scli
Signing certificates (SHA-1) (6)
- 8418703221A74C73405AD273C28CBC12444D7520
- B4A1513C2C71F08D2EE763CD3FAE585F71F268A9
- C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9
- CC866E79BDAD431A2B1E07229B92E64808221610
- F25D72FCCB84BAF7F73467FC9571024B7E274CA3
- 71BE35691A181E1524DDF83F931FBC62DC4E7EC6
Domains (dashboard, download, C2) (63)
- best-mobile-spy.com
- cocospy.com
- cocospy.net
- fonemonitor.co
- minspy.com
- neatspy.com
- safespy.com
- spyic.biz
- spyic.com
- spyier.biz
- spyine.biz
- spyine.com
- spyzie.com
- spyzie.io
- spyzie.online
- teensafe.net
- teensoftware.com
- www.fonemonitor.co
- www.minspy.com
- www.spyic.com
- www.spyzie.com
- www.teensafe.net
- www.teensoftware.com
- alog.umeng.com
- app-api.spyzie.com
- app.api.spyzie.wondershare.cn
- appjiagu.com
- b.appjiagu.com
- c.appjiagu.com
- d.appjiagu.com
- e.appjiagu.com
- f.appjiagu.com
- fonemonitor.vip
- g.appjiagu.com
- data-api.spyzie.com
- data.api.spyzie.wondershare.cn
- h.appjiagu.com
- i.fonemonitor.co
- i.cocospy.com
- i.minspy.com
- i.neatspy.com
- i.safespy.com
- i.spyic.com
- i.spyine.com
- i.spyzie.io
- i.teensafe.net
- mintrack.vip
- my.spyzie.com
- neatspy.vip
- phonedata.me
- app-api.phonedata.me
- data-api.phonedata.me
- spyzie-a.firebaseio.com
- mg-spyzie.oss-us-west-1.aliyuncs.com
- s.appjiagu.com
- safespy.vip
- sp.kuuvv.com
- kuuvv.com
- trackier.vip
- trackine.vip
- trackpro.vip
- viptrack.pro
- teensafe.vip
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 47 known samples (SHA-256).
- Signing certificate: 6 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 28 known package identifiers.
- Network indicators: 63 domains used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.