TrackMyPhones is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into.
GS-STK-AND-9928Package names (21)
- com.app.audiorec
- com.app.call_rec_hidden
- com.app.keylogger
- com.app.spy_call_recorder
- com.app.recorder
- com.app.videorec
- com.apps.anti_theft
- com.apps.rct.CellTrackerActivity
- com.dev4playapps.whatsdeleted
- com.gcm_call_sms_tracker
- com.gcm_call_sms_tracker.updated
- com.gcm_call_tracker
- com.gcm_celltracker
- com.local_cell_tracker
- com.local_cell_tracker_updated
- com.soh
- com.trackerapps.whatsaptracker
- com.trackmyphone_pro
- com.trackmyphones.livefamilytracker
- com.trackmyphones.recoverphoneusingchatmessages
- com.trackmyphones.tmpusingchatmessages
Signing certificates (SHA-1) (10)
- 37ACE0321E8833F25BDDB363AB395C81354E88A0
- 554137DEE63BE07CE9687C5886244954277227F5
- 68AC78A7CD660ED204B4BC3C73A3F91DA1AE45FC
- 6DB1F33668AA745163DFB6C5614C3800BCA8D693
- 849D181E1BEE5084CBE1BACBA8442996A8B1F8C6
- 87EF370B8D6E3089E7F8CDDD6E830B5E4C8CF60B
- A93266E83B136CBC220062898D308213263E793A
- B7285348B05EDAEFF7F032384E4F90182E1C1F27
- EBD3713DFB02D79ADC90C88DE1E0B547882F5A42
- F5A5336B28456208EF357B4630A93A91206CF21A
Domains (dashboard, download, C2) (10)
- trackmyphones.com
- www.trackmyphones.com
- cell-tracker-green.firebaseio.com
- cell-tracker-updated.firebaseio.com
- key-logger-90fff.firebaseio.com
- message-tracker-98822.firebaseio.com
- smsandcalltracker.firebaseio.com
- spyaudiorecorder.firebaseio.com
- trackmyphones-pro.firebaseio.com
- video-recorder-c0419.firebaseio.com
How GuestSpy detects it
The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.
- Signing certificate: 10 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
- Package name: 21 known package identifiers.
- Network indicators: 10 domains used for its dashboard, downloads or command-and-control traffic.
- Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.
If GuestSpy reports this on your phone
- Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
- Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
- Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
- Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or
adb shell pm uninstall -k --user 0 <package>. - Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
- Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.
The full walkthrough is in the Android removal guide and the iPhone guide.
Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.