mSpy is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into. It is also sold or distributed as FakeSys, KidSecured, Phonsee, SecureChildren, celSpy, eyeZy, mSpyOnline.
Danger code
GS-STK-AND-7685ClassStalkerware
PlatformAndroid
Known samples145
Package names (11)
- android.helper.system
- android.sys.process
- com.android.keyboardhelper
- com.mspy.lite
- core.framework
- com.eyezy.android
- core.update.framework
- med.mspy.mspy
- system.framework
- update.service.android
- update.service.android.installer
Signing certificates (SHA-1) (8)
- 021985CEA754D8E58D538D2FEDFF6B1565A6B45B
- 3930B621F30D13D24692CBBBBC67C59F92F1C9BD
- 5EEC898F0DBBD70A9B33DD16EE5FF06B6DE26EA6
- 7FFE6DA96346FEE822E1F791176CD6970A1DC770
- 3E1A6646C93A7423A25104A88DA5BECE2F35EFF0
- CB28ADFD818FBFFDF5542F2EFC5140D596EE957E
- FE821A533BDC31822D9EB5F98243EB16917C8EE7
- 1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F
Domains (dashboard, download, C2) (96)
- bill-msp.app
- cart.mspy.com
- ctrl-msp.app
- freefonespy.com
- kidsecured.com
- m-services.app
- mbill.app
- mcontrolapp.com
- mkid.app
- mkidctrl.app
- mkidsecure.com
- mliteapp.com
- mpotect.app
- msafety.app
- msecureapp.com
- msp-control.app
- mspkid.app
- mspy.co.il
- mspy.co.uk
- mspy.com
- mspy.com.ar
- mspy.com.br
- mspy.com.cn
- mspy.com.es
- mspy.fr
- mspy.in
- mspy.it
- mspy.jp
- mspy.net
- mspy.nl
- mspy.support
- mspylite.com
- mspyonline.com
- mspyplus.com
- myfonemate.com
- onlinecontrol.app
- onlinesecure.app
- parent-msp.app
- phonsee.com
- safe-root.com
- secure-msp.app
- securechildren.online
- theispyoo.com
- www.eyezy.com
- www.mspy.com
- www.mspyonline.com
- a-qa3.thd.cc
- a.thd.cc
- alter757.info
- api.thd.cc
- apiv4.alter757.info
- b55y.net
- bbrp.co
- bi.thd.cc
- cp.mspyonline.com
- eyezyapp.thd.cc
- getmspy.net
- hz-service.thd.cc
- hz7.thd.cc
- idevs.co
- jailbreak-gateway.thd.cc
- kypler.com
- m-media.thd.cc
- mcloud-api.thd.cc
- mi.thd.cc
- mlite-app.livekit.cloud
- mlite-app.thd.cc
- mlite-socket.thd.cc
- mliteapp.alter757.info
- mobile-gw.thd.cc
- mspy.alter757.info
- mspytrackercom.alter757.info
- mtechn.zendesk.com
- my.kidsecured.com
- my.mspyonline.com
- my.phonsee.com
- my.securechildren.online
- pipe.thd.cc
- project-323448153542050953.firebaseio.com
- q12z.net
- repo.mspyonline.com
- rockalab.com
- s3.thd.cc
- sentry-01.thd.cc
- sentry-02.thd.cc
- sentry-03.thd.cc
- sentry-04.thd.cc
- sentry-05.thd.cc
- sentry-06.thd.cc
- sentry-07.thd.cc
- sentry-product-new.bbrp.co
- thd.cc
- tracking.mliteapp.com
- tracking.mspyonline.com
- update-service-7e59f.firebaseio.com
- webrtc.thd.cc
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Exact file hash: 145 known samples (SHA-256).
- Signing certificate: 8 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 11 known package identifiers.
- Network indicators: 96 domains used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
Safety first. Removing monitoring software can alert the person who installed it. If that person could hurt you, make a plan before you remove anything: talk to someone you trust, a local domestic-violence service or the resources at stopstalkerware.org. In the US the National Domestic Violence Hotline is 1-800-799-7233.
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.