HelloSpy is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as 1TopSpy, HelloSPy, MaxxSpy, MobiiSpy, SpyHide.
GS-STK-AND-7052Package names (19)
- com.android.innovaspy
- com.example.hellospy
- com.googlesettings.setting
- com.hellospy
- com.hellospy.system
- com.maxxspy
- com.maxxspy.system
- com.mobiispy
- com.mobiispy.system
- com.mrblue.setting
- com.mrbluetooth.setting
- com.mrtred.setred
- com.prophoto.editor
- com.topspy
- com.topspy.system
- com.virsys.tracker
- com.wifiset.service
- com.wifisettings.service
- googlesettings.setting
Signing certificates (SHA-1) (9)
- 1EBFFD9FE9463B2ED24582D2846990A5ABEF79B9
- 656CD7890ED79CE8570D1B7156C31958D5AC1606
- 6B660EAAEBA47793B7A1278D714669A6612BCA5B
- 6EB49E72D6138B4210D1CA60247D419E5660315C
- 7AFD651F96C7C938351396A53895C3C0704F6B96
- 7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09
- A40D8FDC7953AD69D970FF00658EB0F58B3A052A
- CD8F39DAECC7793F33D8D847A598373B8F25A7B7
- F6914F044B9385D6005DC9C50A9AECDC2349F413
Domains (dashboard, download, C2) (38)
- 1topspy.com
- account.mobile-remote-tracker.com
- alospy.com
- getspyapps.com
- hellospy.com
- innovaspy.com
- ispytic.com
- maxxspy.com
- mobeespy.com
- mobellspy.com
- mobiispy.com
- mobile-remote-tracker.com
- mobilespyblog.com
- mspymax.com
- opispy.net
- spyacellphone.com
- spyhide.com
- spyhide.ir
- spyios8x.com
- www.spyhide.com
- www.spyhide.ir
- account.cellphone-remote-tracker.com
- cellphone-remote-tracker.com
- client.spyhide.com
- client.spyhide.ir
- copy9db.com
- flushdata.1topspy.com
- flushdata.copy9db.com
- flushdata.hellospy.com
- flushdata2.hellospy.com
- flushdata3.hellospy.com
- flushdata4.hellospy.com
- flushdata5.hellospy.com
- flushdbd.maxxspy.com
- virsis.net
- webservicesdb.mobiispy.com
- profotoeditor.com
- 178.63.71.15
IP addresses (1)
- 78.47.16.3
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 92 known samples (SHA-256).
- Signing certificate: 9 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 19 known package identifiers.
- Network indicators: 38 domains and 1 IP address used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.