EasyLogger is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into.
GS-STK-AND-8072Package names (5)
- app.EasyLogger
- app.Easylogger
- app.Elogger
- app.childsafetytracker
- app.seniorsafety
Signing certificates (SHA-1) (7)
- 07906D1FA933730B8EB44F03910C88FDAC2C0135
- 24D3251C7A1184649211B9068820545397B112C9
- 35D7CF057BFA5023CE739A725ADA0DA1FD34D1FF
- 8698564FBEC700167FCC53D1AED00FFADF6BED6C
- 8F23E1457ADC6189F6ED504A60DF8896FEC6D970
- D15A276F181C839E0390672A43065E8D97F140E9
- 53FADDAF873B7BD00E5AD9F5F05E7888A398CE70
Domains (dashboard, download, C2) (25)
- logger.mobi
- childsafetytrackerapp.com
- seniorsafetyapp.com
- www.childsafetytrackerapp.com
- www.seniorsafetyapp.com
- 97.logger.mobi
- account.logger.mobi
- account.childsafetytrackerapp.com
- api.childsafetytrackerapp.com
- api.seniorsafetyapp.com
- beta-api.logger.mobi
- beta.logger.mobi
- easyloggerbeta.azurewebsites.net
- elcore-api.azurewebsites.net
- inv.logger.mobi
- pro.logger.mobi
- ps97mailer.logger.mobi
- pulsesolutions-net-easy-logger.firebaseio.com
- sandbox97.childsafetytrackerapp.com
- sandbox97.logger.mobi
- sandbox97.seniorsafetyapp.com
- senior-safety-189010.firebaseio.com
- servicesloggermobi.azurewebsites.net
- waws-prod-blu-247-e7b3.eastus.cloudapp.azure.com
- waws-prod-blu-247.sip.azurewebsites.windows.net
IP addresses (3)
- 172.67.81.216
- 104.25.28.15
- 104.25.29.15
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 48 known samples (SHA-256).
- Signing certificate: 7 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 5 known package identifiers.
- Network indicators: 25 domains and 3 IP addresses used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.