Indicators of compromise (IOC) for Stalkerware and Watchware applications for Android and iOS
Warning: these indicators are not providing a complete detection of stalkerware applications. They are based on research from a few people on their free time and many apps are likely missing. Use it carefully. No detection based on these indicators should not be understood as having no stalkerware installed.
If you think you may be victim of a stalkerware application, check this page
This repository is maintained by Julien Voisin, and Tek for the Echap non-profit organisation.
We're using the definition of the Coalition Against Stalkerware:
Stalkerware refers to tools – software programs, apps and devices – that enable someone to secretly spy on another person’s private life via their mobile device. The abuser can remotely monitor the whole device including web searches, geolocation, text messages, photos, voice calls and much more. Such programs are easy to buy and install. They run hidden in the background, without the affected person knowing or giving their consent. Regardless of stalkerware’s availability, the abuser is accountable for using it as a tool and hence for committing this crime.
We are classifying as watchware any application that is developed for surveillance and is not trying to hide its activity (like a child monitoring application).
Main files:
ioc.yaml: Indicators of compromise of many Stalkerware apps. Includes- Applications Package names
- Android Application Certificates
- List of websites
- List of domains and IPs of C2
watchware.yaml: Indicators of compromise of watchware appssamples.csv: List of samples with hashes, package name, certificate and version.
Files generated automatically from previous Stalkerware IOC files:
generated/hosts: network indicators (C2 stalkerware domains only) in hosts formatgenerated/hosts_full: network indicators (C2 domains only for both stalkerware and watchware) in hosts formatgenerated/indicators-for-tinycheck.json: indicators in TinyCheck compatible format (Stalkerware only)generated/misp_event.json: indicators in MISP compatible format (Stalkerware only)generated/network.csv: network indicators in a more grepable CSV format (Stalkerware only)generated/quad9_blocklist.txt: blocklist for Quad9 DNS resolvergenerated/stalkerware.stix2: indicators in STIX2 format (stalkerware and watchware)generated/suricata.rules: Suricata rules for network indicators (Stalkerware C2 only)
This repository includes indicators for 164 applications (139 stalkerware and 25 watchware) and 2940 samples
List of stalkerware apps:
- AbsoluTrack (
absolutesoftsystem.inabsolutestoreindia.comass.absolutesoftsystem.ingeniesoftsystem.comonetouchsecurities.comsmartguardapp.comthiefguardbd.comwww.smartguardapp.com) - Ahmyth
- AiSpyer (
aivideoedit.comaispyer.comwww.aispyer.com) - AllTracker (
alltracker.org) - Android007 (
android007.comwww.android007.comportal.android007.comspybunker.comwww.spybunker.com) - AndroidLost (
androidlost.comwww.androidlost.com) - AndroidMonitor (
androidmonitor.comdemo.ultimatephonespy.comultimatephonespy.comwww.androidmonitor.commy.androidmonitor.com) - AndroidPolice (
amon.android-monitor.ruamon1.android-monitor.ruandmon.nameandroid-apk.android-monitor.ruandroid-monitor.ruandroid-monitor1.android-monitor.ruandroid-police.android-monitor.ruandroid-police.ruanmon.android-monitor.ruanmon.nameanmon.ruanmon.suanmon1.android-monitor.rudroimon20.rumonitor-android.android-monitor.ruprog-money.android-monitor.ruprog-money.comwww.android-monitor.ru) - AndroidSpy (
a-spy.comwww.a-spy.com) - AndroidSpyApp
- AntiFurtoDroid (
antifurtodroid.com) - AppMia (
appmia.comappmia.com.esappmia.itappmia.frcp.appmia.com) - AppSpy (
app.appspy.netapp.appspyfree.comapp.freephonespy.netapp.mobilespyfree.netappspy.comappspy.netappspyfree.comapptracker.netcellphonespyappon.comfree-spy.comfree.apptracker.netfreemobilespy.netfreephonespy.netjustseries.netmobilespyfree.netspyren.comtrackerfree.netwww.appspy.comwww.appspy.netwww.apptracker.netwww.cellphonespyappon.comwww.freemobilespy.netwww.freephonespy.netwww.mobilespyfree.netwww.spyren.comwww.trackerfree.netwww.xvids.usxvids.us) - BlurSpy (
www.blurspy.comblurspy.comxoxospy.com) - BosSpy (
bosspy.com) - Bulgok (
c-phone.ru) - CallSMSTracker (
callsmstracker.comhiddensmstracker.comhiddensystemhealth.comregistrations.smstracker.comsmstracker.comsmstrackerweb.comwww.hiddensmstracker.comwww.hiddensystemhealth.comwww.smstrackerweb.com) - CatWatchful (
catwatchful.comcatwatchful.online) - Cerberus (
cellphonetrackers.orgcerberusapp.comcerberusbrasil.comenterprise.cerberusapp.comwww.cerberusapp.comwww.cerberusbrasil.com) - ClevGuard (
clevguard.netwww.clevguard.comclevguard.companel.clevguard.com) - Cocospy (
best-mobile-spy.comcocospy.comcocospy.netfonemonitor.cominspy.comneatspy.comsafespy.comspyic.bizspyic.comspyier.bizspyine.bizspyine.comspyzie.comspyzie.iospyzie.onlineteensafe.netteensoftware.comwww.fonemonitor.cowww.minspy.comwww.spyic.comwww.spyzie.comwww.teensafe.netwww.teensoftware.com) - CouplerTracker (
coupletracker.com) - Curiosus
- Dash
- DroidWatcher
- EasyLogger (
logger.mobichildsafetytrackerapp.comseniorsafetyapp.comwww.childsafetytrackerapp.comwww.seniorsafetyapp.com) - EasyPhoneTrack (
spappmonitoring.comwww.spappmonitoring.commobil-kem.comeasyphonetrack.com) - EspiaoAndroid (
foxspy.com.br) - EvaSpy (
evaspy.comlogin.evaspy.comspyrix.comwww.spyrix.com) - Fenced (
mobilespy.iofenced.aiweb.mobilespy.iodemo.fenced.aiweb.fenced.aiadmin.fenced.ai) - FindMyKids (
findmykids.org) - FindMyPhone (
find-myphone.com) - FlashKeylogger (
flashkeylogger.com) - FlexiSpy (
flexispy.comcommunity.flexispy.comblog.flexispy.comwww.flexispy.commobilefonex.commobileapps.com.myflexispy.mobileapps.com.mysvlogin.asia) - FreeAndroidSpy (
freeandroidspy.com) - GPSTrackerLoki (
asgardtech.ru) - HelloSpy (
1topspy.comaccount.mobile-remote-tracker.comalospy.comgetspyapps.comhellospy.cominnovaspy.comispytic.commaxxspy.commobeespy.commobellspy.commobiispy.commobile-remote-tracker.commobilespyblog.commspymax.comopispy.netspyacellphone.comspyhide.comspyhide.irspyios8x.comwww.spyhide.comwww.spyhide.ir) - HighsterMobile (
auto-forward.comautoforward.appautoforward.cobestcellphonespyapps.combuyeasyspy.comcellphoneservices.infoddiutilities.comdev.safeguarde.comdigitalsecurityworld.comevt17.comhighstermobile.cohighstermobile.comilfmobileapps.comm.surepointspy.comphonespector.comsafeguarde.comsurepointspy.comthepowerlinegroup.comturbophonepsy.comwww.surepointspy.com) - Hoverwatch (
br.refog.comde.refog.comes.refog.comfr.refog.comhover.watchhoverwatch.comhu.refog.comhws.icuit.refog.commy.hws.icunl.refog.comprospybubble.comrefog.comrefog.derefog.netrefog.orgro.refog.comwww.hoverwatch.comwww.refog.com) - ISpy
- Intertel (
mobile-spy.co.za) - KidSecured (
kidsecured.com) - KidsShield (
backupsoft.eufreespyapp.comkidlogger.netkidsshield.netmonitorminor.com.trpc.freespyapp.compc.selfspy.comselfspy.comspytrac.comtechinnovative.nettifamily.nettispy.nettracerspy.netua.tispy.netviptelefonprogrami.comwww.kidlogger.netwww.selfspy.com) - LetMeSpy (
letmespy.comremotecommands.comwww.letmespy.comwww.teleszpieg.plteleszpieg.plbbiindia.comwww.bbiindia.com) - LoveSpy
- Metasploit (
foreverspy.com) - MeuSpy (
meuspy.commonitorecell.com.brespiao.meuspy.comwww.espiaodecelulargratis.com.brespiaodecelulargratis.com.br) - MobiSpy (
mobispy.net) - MobiStealth (
mobistealth.comwww.mobistealth.comwww.mobilestealthreview.com) - MobileSpy (
de.mobilespy.ates.mobilespy.atfr.mobilespy.atit.mobilespy.atmobilespy.atpt.mobilespy.atro.mobilespy.atwww.mobilespy.at) - MobileTool (
mobiletool.ruwww.mobiletool.rumtoolapp.netwww.mtoolapp.netmtoolapp.biz) - MobileTrackerFree (
br.mobile-tracker-free.combr.loverman.netcelltracker.ioloverman.netmobile-tracker-family.commobile-tracker-free.bemobile-tracker-free.bizmobile-tracker-free.comobile-tracker-free.commobile-tracker-free.demobile-tracker-free.esmobile-tracker-free.eumobile-tracker-free.frmobile-tracker-free.infomobile-tracker-free.irmobile-tracker-free.itmobile-tracker-free.memobile-tracker-free.mobimobile-tracker-free.namemobile-tracker-free.netmobile-tracker-free.orgsupport.mobile-tracker-free.comsupport.loverman.netmobile-tracker.mobimobitrackapps.com) - MocoSpy (
mocospy.com) - MonitorUltra (
www.spyequipmentuk.co.uk) - Mrecorder (
mobilerecorder24.commrecorder.com) - MyCellSpy (
mycellspy.comcezz.meuser.mycellspy.com) - MySpyApps (
myspyapps.com) - MzanziSpy (
mzanzispy.co.za) - NemoSpy (
nemospy.comadmin.nemospy.com) - NeoSpy (
neospy.proneospy.netneospy.techru.neospy.net) - NetSpy (
www.netspy.netnetspy.net) - NexSpy (
nexspy.comoxy.nexspy.commobilebackup.bizportal.mobilebackup.bizportal.topzaloha.cz) - Observer (
www.observer.pw) - OneLocator (
locatorprivacy.comonelocator.com) - OneSpy (
onemonitar.comonespy.comcloud.onemonitar.comsend.onemonitar.comtest.send.onemonitar.comsuperuser.onemonitar.comsu.onemonitar.comcp.onemonitar.comapp.onemonitar.comsend.onespy.com) - OwnSpy (
mobileinnova.netownspy.comen.ownspy.comwebdetetive.com.brownspy.essaferspy.companel.webdetetive.com.brera3000.com) - PanSpy (
panspy.comsurveilstar.com) - PatanSpyApp
- PhoneMonitor
- PhoneSheriff (
www.mobile-spy.comwww.emobilespy.comphonesheriff.comwww.phonesheriff.comwww.retinax.comretinax.com) - PhoneSpy (
www.phone-spy.comphone-spy.comaksoft.gq) - RastreadorDeNamorado (
rastreadordenamorado.com.br) - RealtimeSpy (
www.spytech-web.comspytech-web.comrealtime-spy-mobile.comwww.realtime-spy-mobile.com) - RecomSpy (
recomspy.com) - Reptilicus (
reptilicus.netthecybernanny.comapollospy.com) - RioSPY (
www.riospy.netriospy.net) - SMSForward
- SecretCamRecorder
- SentryPC (
www.sentrypc.comsentrypc.com) - ShadowSpy (
shadow-logs.comshadow-spy.comwww.shadow-logs.comwww.shadow-spy.com) - ShadySpy (
shadyspy.comwww.shadyspy.com) - SmartKeylogger (
awamisolution.com) - Snoopza (
snoopza.comget.snoopza.comsnoopza.zendesk.comdemo.snoopza.comnewdemo.snoopza.com) - Spy24 (
spy24.netspy24.app) - SpyAdvice (
spyadvice.comfreespyphone.net) - SpyApp (
accounts.spyapp.roaccounts.pgv4.comapplispy.comarea.spyapp.chbeta.spyapp.robr.pgv4.comclienti.securspy.comcompte.applispy.comcontrollo.spystoreitalia.comtel.forensis-lab.commespiao.com.brpartner.securspy.compgv4.compin.pgv4.compin.spyapp.roro.pgv4.comroaccount.pgv4.comsecurspy.comserver.pgv4.comspyapp.atspyapp.chspyapp.esspyapp.frspyapp.ukspyapp.rospybrother.comsys.spyapp.chwww.spyapp.chwww.spyapp.rox.securspy.comx.spyapp.ro) - SpyApp247
- SpyAppGhazi
- SpyDroid
- SpyEra (
spyera.comlogin.spylogs.comsupport.spyera.comaffiliate.spyera.com) - SpyFly (
spyfly.co.za) - SpyHuman (
spyhuman.comservices.spyhuman.com) - SpyKontrol (
www.spykontrol.comspykontrol.comandroidapk.biz) - SpyLive360 (
spylive360.comwww.spylive360.com) - SpyMasterPro (
spymasterpro.comwww.spymasterpro.com) - SpyMug
- SpyNote (
www.spynote.usspynote.us) - SpyPhoneApp
- SpySMS
- SpyTec (
spytecgps.iospytecgl300.comwww.spytec.comspytec.comactivation.spytec.com) - SpyTek (
spytekonline.co.zaspytek.co.zaportal.spytek.co.za) - SpyToApp (
spytoapp.com) - Spyier (
spyier.com) - Spylix (
spylix.comwww.spylix.com) - Spymie
- SpyphoneMobileTracker (
phonetracker.comwww.phonetracker.comspyfone.comspyphone.comwww.spyphone.comspy-phone-app.com) - Spyzier
- SwiftMobileSpy (
pc.myswiftmobilespy.co.zaswiftmobilespy.co.za) - TalkLog (
talklog.tools) - TheOneSpy (
theonespy.comogymogy.comwww.theonespy.com) - TheTruthSpy (
app.phonespying.comcopy9.comexactspy.comfonetracker.comfree.spycell.netguestspy.comhespyapp.cominnoaspy.comispyoo.commobidad.appmobilespyonline.commxspy.comphonespying.comphonetracking.netsecondclone.comspyapps.netspycell.netthespyapp.comthetruthspy.comweysys.comwww.mxspy.comwww.phonespying.comxpspy.com) - TheWiSpy (
www.thewispy.comchildmonitoringsystem.com) - Traccar (
www.traccar.orgdemo.traccar.orgtraccar.org) - TrackMyPhones (
trackmyphones.comwww.trackmyphones.com) - TrackView (
chome.zstone.colifecircle.apptrackview.nettrackview.recurly.com) - TrackingSmartphone (
trackingsmartphone.comwww.trackingsmartphone.comonlinefundb.com) - Trackji (
trackji.com) - Trackplus (
account.spytomobile.comforum.spytomobile.comspy2mobile.comspytomobile.comtrackerplus.ruwww.spy2mobile.comwww.spytomobile.com) - Tracku (
2mata.netclues4.comcluestr.come-spy.orghike.inizkid.comwww.e-spy.orgwww.izkid.com) - Unisafe (
usafe.ruunisafe.suunisafe.techmas.ru) - VIPTrack (
viptrack.ro) - WebWatcher (
awarenesstechnologies.cominterguardsoftware.comscreentimelabs.comwebwatcher.comwww.webwatcher.com) - WheresMyDroid (
wheresmydroid.comwww.wheresmydroid.comwmdcommander.appspot.com) - WiseMo (
www.wisemo.comwisemo.com) - WtSpy (
wt-spy.com) - XDSpy (
xdspy.appandroidspy.info) - XNSpy (
xnspy.comcp.xnspy.com) - Xnore (
xnore.com) - XploitSPY (
xploitwizer.com) - bark (
bark.uswww.bark.us) - iKeyMonitor (
easemon.com) - iMonitorSpy (
www.imonitorsoft.cnwww.imonitorsoft.comimonitorsoft.cn) - jjspy (
www.jjspy.comwww.ttspy.com) - juju (
www.juju.co.kejuju.co.ke) - mSpy (
cart.mspy.commliteapp.commspy.co.ilmspy.co.ukmspy.commspy.com.armspy.com.brmspy.com.cnmspy.frmspy.inmspy.itmspy.jpmspy.netmspy.nlmspy.supportmspylite.commspyplus.comwww.eyezy.commspyonline.commyfonemate.comtheispyoo.comwww.mspyonline.comwww.mspy.comfreefonespy.com) - mSpyitaly (
dc-407883c18502.mspyitaly.commspyitaly.comwww.mspyitaly.com) - pcTattletale (
www.pctattletale.com) - uMobix (
umobix.comn.umobix.comtt.umobix.comspyfer.infosurveillance-enfants.com) - xHunter
- AdGuard
- Quad9 DNS resolver
- oisd blocklist full
- IPV Spyware Discovery
- The Mobile Verification Toolkit
- StratosphereIPS
- the Hypatia malware scanner
Contributors include:
These indicators are largely based on research and analysis using APKlab, Koodous and VirusTotal.
This repository is not complete, new stalkerware apps appear and disappear all the time. Feel free to contribute to this database by opening an issue or submitting a Pull Request.
If you want to contribute, fork this repository, make your changes into the branch research and submit a Pull Request. Once merged, a GitHub Action will automatically generate the different files available on the master branch.
If you want to do further research on some apps and need access to the samples, feel free to send us an email at contact AT echap.eu.org.
There are other repositories gathering stalkerware indicators:
- Echap - Lutter contre les stalkerware
- Coalition against stalkerware
- Resources from the Clinic to End Tech Abuse
- The Predator in Your Pocket - A Multidisciplinary Assessment of the Stalkerware Application Industry by the Citizen Lab
- What you need to know about stalkerware - TED Talk by Eva Galperin
The content of this repository is licensed under CC-BY. If this license is a problem for you, please reach out (contact AT echap.eu.org), we are happy to figure something out.
Please note that while we're doing our very best, there is no guarantee that it is accurate. If it is useful to you, consider giving money to an organisation supporting violence against women in your country.