4111 lines
91 KiB
YAML
4111 lines
91 KiB
YAML
- name: TheTruthSpy
|
|
names:
|
|
- Copy9
|
|
- InoSPy
|
|
- ExactSpy
|
|
- FoneTracker
|
|
- GuestSpy
|
|
- MxSpy
|
|
- PhoneSpying
|
|
- PhoneTracker
|
|
- SpyZee
|
|
- TheTruthSpy
|
|
- TheSpyApp
|
|
- iSpyoo
|
|
- XySpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.apspy.app
|
|
- com.fone
|
|
- com.guest
|
|
- com.ispyoo
|
|
- com.ispyoo.traceyou
|
|
- com.mxspy
|
|
- com.spyzee
|
|
- com.systemservice
|
|
- com.thetruth
|
|
- com.ttsapp.catchcheating
|
|
certificates:
|
|
- 31A6ECECD97CF39BC4126B8745CD94A7C30BF81C
|
|
- 36E6671BC4397F475A350905D9A649A5ADE97BB2
|
|
- 483716998F0C092FE82B0B12B1A4BA399D941318
|
|
- 4FF0174BEDC1D16BE55AC53B98599398AC461F82
|
|
- 56EF5244378FB6B4EF82D2B9E99BF41F7B97D93A
|
|
- 5D7B59F3AFB74D86CCD56440F99CA2FC83A23F22
|
|
- 917BB5B2D40EC40018541784A06285DE0F50F60F
|
|
- B0F639B67819EDBADC73B9FEFF2582FC58B8F115
|
|
- B1336A5F3A017394186563E84AE0D2649FC1697D
|
|
- CBDA86758FBE8E5A6AB805F493AA151B1F2B95F4
|
|
- D667A33203776F2285EBA3E826CD286356EF05D0
|
|
- FF8CCD9816B0524A58FBDE1809FB227DBCDFD692
|
|
- E6502D8A870C3F3910EA34F5B46D20D923047580
|
|
- DE648A3253C16692AF71141C069D15C87C3E5495
|
|
- F9181C6CF9AACB3AB1092F5338C3198A8D833431
|
|
- 5E3C376B52C672C81439358DE6348F25F96EAAA4
|
|
websites:
|
|
- app.phonespying.com
|
|
- copy9.com
|
|
- exactspy.com
|
|
- fonetracker.com
|
|
- free.spycell.net
|
|
- guestspy.com
|
|
- hespyapp.com
|
|
- innoaspy.com
|
|
- ispyoo.com
|
|
- mobidad.app
|
|
- mobilespyonline.com
|
|
- mxspy.com
|
|
- phoneparental.com
|
|
- phonespying.com
|
|
- phonetracking.net
|
|
- secondclone.com
|
|
- spyapps.net
|
|
- spycell.net
|
|
- thespyapp.com
|
|
- thetruthspy.com
|
|
- thetruthspys.com
|
|
- us.xnspy.pro
|
|
- weysys.com
|
|
- www.mxspy.com
|
|
- www.phonespying.com
|
|
- xpspy.com
|
|
- xnspy.pro
|
|
- inospy.com
|
|
distribution:
|
|
- app.fonetracker.com
|
|
- app.mobiletracking.app
|
|
- app.xpspy.com
|
|
c2:
|
|
ips:
|
|
- 69.64.74.239
|
|
- 69.64.81.166
|
|
- 69.64.81.49
|
|
- 69.64.81.98
|
|
- 69.64.91.29
|
|
domains:
|
|
- 1ca43.appspot.com
|
|
- copy9.com
|
|
- guestspy.com
|
|
- icloudappe.com
|
|
- media-sync-a.copy9.com
|
|
- media-sync-a.exactspy.com
|
|
- media-sync-a.fonetracker.com
|
|
- media-sync-a.ispyoo.com
|
|
- media-sync-a.thetruthspy.com
|
|
- media-sync-a100.fonetracker.com
|
|
- media-sync-a100.thetruthspy.com
|
|
- media-sync-a600.fonetracker.com
|
|
- media-sync-a621.fonetracker.com
|
|
- media-sync-a696.fonetracker.com
|
|
- media-sync-a710.fonetracker.com
|
|
- media-sync-a740.thetruthspy.com
|
|
- media-sync-a743.thetruthspy.com
|
|
- media-sync-a746.thetruthspy.com
|
|
- media-sync-a747.thetruthspy.com
|
|
- media-sync-a748.thetruthspy.com
|
|
- media-sync-a749.thetruthspy.com
|
|
- media-sync-a780.fonetracker.com
|
|
- media-sync-a785.fonetracker.com
|
|
- media-sync-a7xx.thetruthspy.com
|
|
- media-sync-a810.thetruthspy.com
|
|
- media-sync-a820.thetruthspy.com
|
|
- media-sync-a825.thetruthspy.com
|
|
- media-sync-a830.thetruthspy.com
|
|
- media-sync-a835.thetruthspy.com
|
|
- media-sync-a895.thetruthspy.com
|
|
- media-sync-a8xx.thetruthspy.com
|
|
- media-sync-a910.thetruthspy.com
|
|
- media-sync-a915.thetruthspy.com
|
|
- media-sync-a920.thetruthspy.com
|
|
- media-sync-a925.thetruthspy.com
|
|
- media-sync-a930.thetruthspy.com
|
|
- media-sync-a935.thetruthspy.com
|
|
- media-sync-a940.thetruthspy.com
|
|
- media-sync-a941.thetruthspy.com
|
|
- media-sync-a942.thetruthspy.com
|
|
- media-sync-a943.thetruthspy.com
|
|
- media-sync-a944.thetruthspy.com
|
|
- media-sync-a945.thetruthspy.com
|
|
- media-sync-a946.thetruthspy.com
|
|
- media-sync-a947.thetruthspy.com
|
|
- media-sync.systemserviceprovider.com
|
|
- media.thetruthspy.com
|
|
- microtracker-1ca43.firebaseio.com
|
|
- mxspy.com
|
|
- my.copy9.com
|
|
- my.ispyoo.com
|
|
- my.thetruthspy.com
|
|
- my.thespyapp.com
|
|
- phonespying.com
|
|
- phonetracking.net
|
|
- protocol.inospy.com
|
|
- protocol-a.copy9.com
|
|
- protocol-a.exactspy.com
|
|
- protocol-a.fonetracker.com
|
|
- protocol-a.guestspy.com
|
|
- protocol-a.ispyoo.com
|
|
- protocol-a.mxspy.com
|
|
- protocol-a.thetruthspy.com
|
|
- protocol-a100.fonetracker.com
|
|
- protocol-a100.phoneparental.com
|
|
- protocol-a100.thetruthspy.com
|
|
- protocol-a5.guestspy.com
|
|
- protocol-a58.guestspy.com
|
|
- protocol-a59.guestspy.com
|
|
- protocol-a6.thetruthspy.com
|
|
- protocol-a60.guestspy.com
|
|
- protocol-a600.fonetracker.com
|
|
- protocol-a610.copy9.com
|
|
- protocol-a610.thetruthspy.com
|
|
- protocol-a611.copy9.com
|
|
- protocol-a611.thetruthspy.com
|
|
- protocol-a612.copy9.com
|
|
- protocol-a614.copy9.com
|
|
- protocol-a615.copy9.com
|
|
- protocol-a616.copy9.com
|
|
- protocol-a617.copy9.com
|
|
- protocol-a618.copy9.com
|
|
- protocol-a620.copy9.com
|
|
- protocol-a621.copy9.com
|
|
- protocol-a65.guestspy.com
|
|
- protocol-a69.copy9.com
|
|
- protocol-a696.copy9.com
|
|
- protocol-a70.guestspy.com
|
|
- protocol-a710.copy9.com
|
|
- protocol-a712.fonetracker.com
|
|
- protocol-a72.thetruthspy.com
|
|
- protocol-a720.thetruthspy.com
|
|
- protocol-a721.thetruthspy.com
|
|
- protocol-a722.thetruthspy.com
|
|
- protocol-a723.thetruthspy.com
|
|
- protocol-a724.thetruthspy.com
|
|
- protocol-a725.thetruthspy.com
|
|
- protocol-a726.thetruthspy.com
|
|
- protocol-a727.thetruthspy.com
|
|
- protocol-a728.thetruthspy.com
|
|
- protocol-a729.thetruthspy.com
|
|
- protocol-a730.thetruthspy.com
|
|
- protocol-a731.thetruthspy.com
|
|
- protocol-a732.thetruthspy.com
|
|
- protocol-a733.thetruthspy.com
|
|
- protocol-a734.thetruthspy.com
|
|
- protocol-a735.thetruthspy.com
|
|
- protocol-a736.thetruthspy.com
|
|
- protocol-a737.thetruthspy.com
|
|
- protocol-a738.thetruthspy.com
|
|
- protocol-a739.thetruthspy.com
|
|
- protocol-a740.thetruthspy.com
|
|
- protocol-a741.thetruthspy.com
|
|
- protocol-a742.thetruthspy.com
|
|
- protocol-a743.thetruthspy.com
|
|
- protocol-a744.thetruthspy.com
|
|
- protocol-a745.mxspy.com
|
|
- protocol-a745.thetruthspy.com
|
|
- protocol-a746.thetruthspy.com
|
|
- protocol-a747.thetruthspy.com
|
|
- protocol-a748.thetruthspy.com
|
|
- protocol-a749.thetruthspy.com
|
|
- protocol-a780.copy9.com
|
|
- protocol-a780.fonetracker.com
|
|
- protocol-a780.ispyoo.com
|
|
- protocol-a780.mxspy.com
|
|
- protocol-a785.copy9.com
|
|
- protocol-a785.fonetracker.com
|
|
- protocol-a810.ispyoo.com
|
|
- protocol-a810.mxspy.com
|
|
- protocol-a810.thetruthspy.com
|
|
- protocol-a811.ispyoo.com
|
|
- protocol-a811.mxspy.com
|
|
- protocol-a880.ispyoo.com
|
|
- protocol-a89.ispyoo.com
|
|
- protocol-a89.mxspy.com
|
|
- protocol-a910.thetruthspy.com
|
|
- protocol-a915.thetruthspy.com
|
|
- protocol-a920.thetruthspy.com
|
|
- protocol-a925.thetruthspy.com
|
|
- protocol-a930.thetruthspy.com
|
|
- protocol-a935.thetruthspy.com
|
|
- protocol-a940.thetruthspy.com
|
|
- protocol-a941.thetruthspy.com
|
|
- protocol-a942.thetruthspy.com
|
|
- protocol-a943.thetruthspy.com
|
|
- protocol-a944.thetruthspy.com
|
|
- protocol-a945.thetruthspy.com
|
|
- protocol-a946.thetruthspy.com
|
|
- protocol-a947.thetruthspy.com
|
|
- protocol-monitor.thetruthspy.com
|
|
- protocol-viewer-a.copy9.com
|
|
- protocol.copy9.com
|
|
- protocol.guestspy.com
|
|
- protocol.ispyoo.com
|
|
- protocol.mxspy.com
|
|
- protocol.systemserviceprovider.com
|
|
- protocol.thetruthspy.com
|
|
- secondclone-2d312.firebaseio.com
|
|
- setupmail-a.icloudappe.com
|
|
- setupmail-a720.icloudappe.com
|
|
- setupmail-a722.icloudappe.com
|
|
- setupmail-a724.icloudappe.com
|
|
- setupmail-a725.icloudappe.com
|
|
- setupmail-a726.icloudappe.com
|
|
- setupmail-a727.icloudappe.com
|
|
- setupmail-a729.icloudappe.com
|
|
- setupmail-a732.icloudappe.com
|
|
- setupmail-a733.icloudappe.com
|
|
- setupmail-a734.icloudappe.com
|
|
- setupmail-a735.icloudappe.com
|
|
- setupmail-a737.icloudappe.com
|
|
- setupmail-a738.icloudappe.com
|
|
- setupmail-a740.icloudappe.com
|
|
- setupmail-a741.icloudappe.com
|
|
- setupmail-a742.icloudappe.com
|
|
- setupmail-a743.icloudappe.com
|
|
- setupmail-a744.icloudappe.com
|
|
- setupmail-a745.icloudappe.com
|
|
- setupmail-a746.icloudappe.com
|
|
- setupmail-a747.icloudappe.com
|
|
- setupmail-a748.icloudappe.com
|
|
- setupmail-a910.icloudappe.com
|
|
- setupmail-a915.icloudappe.com
|
|
- setupmail-a920.icloudappe.com
|
|
- setupmail.icloudappe.com
|
|
- support.phoneparental.com
|
|
- spyzee.com
|
|
- sync-a.copy9.com
|
|
- sync-a.exactspy.com
|
|
- sync-a.fonetracker.com
|
|
- sync-a.ispyoo.com
|
|
- sync-a.mxspy.com
|
|
- sync-a.thetruthspy.com
|
|
- sync-a100.fonetracker.com
|
|
- sync-a600.fonetracker.com
|
|
- sync-a712.fonetracker.com
|
|
- sync-a780.mxspy.com
|
|
- sync-a7xx.thetruthspy.com
|
|
- sync-a8xx.thetruthspy.com
|
|
- sync-a925.thetruthspy.com
|
|
- sync-a930.thetruthspy.com
|
|
- sync-a935.thetruthspy.com
|
|
- sync-a940.thetruthspy.com
|
|
- sync-a941.thetruthspy.com
|
|
- sync-a942.thetruthspy.com
|
|
- thetruth-db94a.firebaseio.com
|
|
- app.xyspy.com
|
|
|
|
- name: HelloSpy
|
|
names:
|
|
- 1TopSpy
|
|
- HelloSPy
|
|
- MaxxSpy
|
|
- MobiiSpy
|
|
- SpyHide
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.innovaspy
|
|
- com.example.hellospy
|
|
- com.googlesettings.setting
|
|
- com.hellospy
|
|
- com.hellospy.system
|
|
- com.maxxspy
|
|
- com.maxxspy.system
|
|
- com.mobiispy
|
|
- com.mobiispy.system
|
|
- com.mrblue.setting
|
|
- com.mrbluetooth.setting
|
|
- com.mrtred.setred
|
|
- com.prophoto.editor
|
|
- com.topspy
|
|
- com.topspy.system
|
|
- com.virsys.tracker
|
|
- com.wifiset.service
|
|
- com.wifisettings.service
|
|
- googlesettings.setting
|
|
certificates:
|
|
- 1EBFFD9FE9463B2ED24582D2846990A5ABEF79B9
|
|
- 656CD7890ED79CE8570D1B7156C31958D5AC1606
|
|
- 6B660EAAEBA47793B7A1278D714669A6612BCA5B
|
|
- 6EB49E72D6138B4210D1CA60247D419E5660315C
|
|
- 7AFD651F96C7C938351396A53895C3C0704F6B96
|
|
- 7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09
|
|
- A40D8FDC7953AD69D970FF00658EB0F58B3A052A
|
|
- CD8F39DAECC7793F33D8D847A598373B8F25A7B7
|
|
- F6914F044B9385D6005DC9C50A9AECDC2349F413
|
|
websites:
|
|
- 1topspy.com
|
|
- account.mobile-remote-tracker.com
|
|
- alospy.com
|
|
- getspyapps.com
|
|
- hellospy.com
|
|
- innovaspy.com
|
|
- ispytic.com
|
|
- maxxspy.com
|
|
- mobeespy.com
|
|
- mobellspy.com
|
|
- mobiispy.com
|
|
- mobile-remote-tracker.com
|
|
- mobilespyblog.com
|
|
- mspymax.com
|
|
- opispy.net
|
|
- spyacellphone.com
|
|
- spyhide.com
|
|
- spyhide.ir
|
|
- spyios8x.com
|
|
- www.spyhide.com
|
|
- www.spyhide.ir
|
|
distribution:
|
|
- profotoeditor.com
|
|
- 178.63.71.15
|
|
c2:
|
|
domains:
|
|
- 1topspy.com
|
|
- account.cellphone-remote-tracker.com
|
|
- cellphone-remote-tracker.com
|
|
- client.spyhide.com
|
|
- client.spyhide.ir
|
|
- copy9db.com
|
|
- flushdata.1topspy.com
|
|
- flushdata.copy9db.com
|
|
- flushdata.hellospy.com
|
|
- flushdata2.hellospy.com
|
|
- flushdata3.hellospy.com
|
|
- flushdata4.hellospy.com
|
|
- flushdata5.hellospy.com
|
|
- flushdbd.maxxspy.com
|
|
- hellospy.com
|
|
- maxxspy.com
|
|
- mobiispy.com
|
|
- spyhide.com
|
|
- spyhide.ir
|
|
- virsis.net
|
|
- webservicesdb.mobiispy.com
|
|
- www.spyhide.com
|
|
- www.spyhide.ir
|
|
ips:
|
|
- 78.47.16.3
|
|
|
|
- name: SpyAdvice
|
|
names:
|
|
- SpyAdvice
|
|
- FreeSpyPhone
|
|
type: stalkerware
|
|
packages:
|
|
- com.sa.app
|
|
certificates:
|
|
- B374A75F87F992A6F57CF99A24197ABCEB17A1E7
|
|
websites:
|
|
- spyadvice.com
|
|
- freespyphone.net
|
|
distribution:
|
|
- download.freespyphone.net
|
|
c2:
|
|
domains:
|
|
- phonetracking-dd226.firebaseio.com
|
|
- spyadvice.com
|
|
|
|
- name: Reptilicus
|
|
names:
|
|
- Reptilicus
|
|
- CyberNanny
|
|
- Vkur
|
|
type: stalkerware
|
|
packages:
|
|
- com.brot.storage.work
|
|
- com.cycle.start.mess
|
|
- com.thecybernanny.andapp
|
|
- net.androidcoreapp.androidbackup
|
|
- net.delphiboardlayer.androidcoreapp
|
|
- net.reptilicus.clientapp
|
|
- net.system_updater_abs341
|
|
- net.vkurhandler
|
|
- se.vkur.clientapp
|
|
- yc.sysupd.client
|
|
certificates:
|
|
- 230E35A26E471352DF5DBDBCF9834E0711500CB0
|
|
- 2C08279BCC8EB16B2B31ACFBD7E1D4BB28E49A87
|
|
- 2FD8BEF4081F126D4DA655B40E9FC63F116DD857
|
|
- 9256E291823DA741B64CB23F7E371D0940E5272E
|
|
- 9BD494107EFED96F630D29D6E18AE4DCC47149E2
|
|
- 6D0FF787BF4534F1077D1E4BF2E18BA381D97061
|
|
- D3A7E0E542A3E1112741806AC31F341C4200FBA1
|
|
- B61326887306E5A65726AE6BFD1D720D2760CEFF
|
|
websites:
|
|
- reptilicus.net
|
|
- thecybernanny.com
|
|
- apollospy.com
|
|
c2:
|
|
ips:
|
|
- 176.9.42.16
|
|
domains:
|
|
- apollospy.com
|
|
- cabinet.ecohouse-eg.com
|
|
- cabinet.gps-monitor.uz
|
|
- cabinet.kfnm.ru
|
|
- cabinet.vegosm.ru
|
|
- cabinet.vkur.se
|
|
- cabinet.vkur1.se
|
|
- cabinet.thecybernanny.com
|
|
- data.reptilicus.net
|
|
- e2c64.firebaseio.com
|
|
- labrador.ua
|
|
- mob.eurotrans.kz
|
|
- phonecontrolapp-e2c64.firebaseio.com
|
|
- proxy.reptilicus.net
|
|
- reptilicus.net
|
|
- rp.apollospy.com
|
|
- rp.dedrone.com.ua
|
|
- rp.labrador.ua
|
|
- rp.liquidblue.com.ua
|
|
- vkur.se
|
|
- vkur1.se
|
|
- www.reptilicus.net
|
|
|
|
- name: PhoneSheriff
|
|
names:
|
|
- PhoneSheriff
|
|
- MobileNanny
|
|
- PeekTab
|
|
- RetinaX
|
|
- RetinaSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.retina.phonesheriff
|
|
- com.retina21.ms41
|
|
- com.retina22.ms6
|
|
- com.rspl22.retinaspy
|
|
- com.retinasoft.ephonetracker
|
|
- com.rspl15.nanny.android
|
|
- com.rspl16.nanny.android
|
|
- com.rspl17.nanny.android
|
|
- com.rspl18.nanny.android
|
|
- com.rspl19.nanny.android
|
|
- com.rspl20.nanny.android
|
|
- com.rspl21.nanny.android
|
|
certificates:
|
|
- F57CBB4CBB9834A14AF675222CECA6A0D26D838E
|
|
- F28F3A97D25E51AB266E56D3B80F04747D242E50
|
|
websites:
|
|
- www.mobile-spy.com
|
|
- www.emobilespy.com
|
|
- phonesheriff.com
|
|
- www.phonesheriff.com
|
|
- www.retinax.com
|
|
- retinax.com
|
|
c2:
|
|
domains:
|
|
- mobilenannylogs.com
|
|
- phonesheriff.com
|
|
- cellmonitoring.co
|
|
- www.cellmonitoring.co
|
|
|
|
- name: OwnSpy
|
|
names:
|
|
- OwnSpy
|
|
- SaferSpy
|
|
- WebDetetive
|
|
type: stalkerware
|
|
packages:
|
|
- com.ownspy.android
|
|
- org.system.kernel
|
|
certificates:
|
|
- CA5304E94F4BC97DA9D147E76858DBF70AB8B4E6
|
|
- 14A071616D4BC37F08BE865D375101F4C963777A
|
|
websites:
|
|
- mobileinnova.net
|
|
- ownspy.com
|
|
- en.ownspy.com
|
|
- webdetetive.com.br
|
|
- ownspy.es
|
|
- saferspy.com
|
|
- panel.webdetetive.com.br
|
|
- era3000.com
|
|
- admin.webdetetive.com.br
|
|
- webdetetive.era3000.com
|
|
distribution:
|
|
- 6287970dd9.era3000.com
|
|
- c9db9bbc8d.era3000.com
|
|
c2:
|
|
domains:
|
|
- user.ownspy.es
|
|
|
|
- name: Cocospy
|
|
names:
|
|
- Cocospy
|
|
- FoneMonitor
|
|
- MinSpy
|
|
- NeatSpy
|
|
- SafeSpy
|
|
- Spyic
|
|
- Spyine
|
|
- Spyzie
|
|
- TeenSafe
|
|
type: stalkerware
|
|
packages:
|
|
- com.aiyi.admin
|
|
- com.cocospy
|
|
- com.duiyun.cocospy
|
|
- com.duiyun.cocospy.v2
|
|
- com.duiyun.fonemonitor
|
|
- com.duiyun.spyine
|
|
- com.duiyun.spyzie
|
|
- com.duiyun.spyic
|
|
- com.minspy.v2
|
|
- com.minspy.v3
|
|
- com.sc.cocospy.v2
|
|
- com.sc.fonemonitor
|
|
- com.sc.fonemonitor.v2
|
|
- com.sc.minspy.v2
|
|
- com.sc.neatspy.v2
|
|
- com.sc.safespy.v2
|
|
- com.sc.safespy.v3
|
|
- com.sc.spyic.v2
|
|
- com.sc.spyic.v3
|
|
- com.sc.spyier.v2
|
|
- com.sc.spyine.v2
|
|
- com.sc.spyzie.v2
|
|
- com.dy.spyzie.v4
|
|
- com.sc.teensafe.v2
|
|
- com.spyic
|
|
- com.wb.production
|
|
- com.ws.sc
|
|
- com.ws.scli
|
|
certificates:
|
|
- 8418703221A74C73405AD273C28CBC12444D7520
|
|
- B4A1513C2C71F08D2EE763CD3FAE585F71F268A9
|
|
- C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9
|
|
- CC866E79BDAD431A2B1E07229B92E64808221610
|
|
- F25D72FCCB84BAF7F73467FC9571024B7E274CA3
|
|
- 71BE35691A181E1524DDF83F931FBC62DC4E7EC6
|
|
distribution:
|
|
- teensafe.vip
|
|
websites:
|
|
- best-mobile-spy.com
|
|
- cocospy.com
|
|
- cocospy.net
|
|
- fonemonitor.co
|
|
- minspy.com
|
|
- neatspy.com
|
|
- safespy.com
|
|
- spyic.biz
|
|
- spyic.com
|
|
- spyier.biz
|
|
- spyine.biz
|
|
- spyine.com
|
|
- spyzie.com
|
|
- spyzie.io
|
|
- spyzie.online
|
|
- teensafe.net
|
|
- teensoftware.com
|
|
- www.fonemonitor.co
|
|
- www.minspy.com
|
|
- www.spyic.com
|
|
- www.spyzie.com
|
|
- www.teensafe.net
|
|
- www.teensoftware.com
|
|
c2:
|
|
domains:
|
|
- alog.umeng.com
|
|
- app-api.spyzie.com
|
|
- app.api.spyzie.wondershare.cn
|
|
- appjiagu.com
|
|
- b.appjiagu.com
|
|
- c.appjiagu.com
|
|
- d.appjiagu.com
|
|
- e.appjiagu.com
|
|
- f.appjiagu.com
|
|
- fonemonitor.vip
|
|
- g.appjiagu.com
|
|
- data-api.spyzie.com
|
|
- data.api.spyzie.wondershare.cn
|
|
- h.appjiagu.com
|
|
- i.fonemonitor.co
|
|
- i.cocospy.com
|
|
- i.minspy.com
|
|
- i.neatspy.com
|
|
- i.safespy.com
|
|
- i.spyic.com
|
|
- i.spyine.com
|
|
- i.spyzie.io
|
|
- i.teensafe.net
|
|
- mintrack.vip
|
|
- my.spyzie.com
|
|
- neatspy.vip
|
|
- phonedata.me
|
|
- app-api.phonedata.me
|
|
- data-api.phonedata.me
|
|
- spyzie-a.firebaseio.com
|
|
- mg-spyzie.oss-us-west-1.aliyuncs.com
|
|
- s.appjiagu.com
|
|
- safespy.vip
|
|
- sp.kuuvv.com
|
|
- kuuvv.com
|
|
- spyzie.com
|
|
- trackier.vip
|
|
- trackine.vip
|
|
- trackpro.vip
|
|
- viptrack.pro
|
|
- www.spyzie.com
|
|
|
|
- name: VIPTrack
|
|
names:
|
|
- VIPTrack
|
|
type: stalkerware
|
|
packages:
|
|
- com.mit.viptrackpro
|
|
- com.mit.networkadapter
|
|
- com.tag.viptrack
|
|
certificates:
|
|
- 2E104C33C8DA4DB32E59A45701D8E0C4CAD16BD3
|
|
- 5A73C8FE7CBA5C9E70B0DF69B3A111C42A10B215
|
|
- 437940A417B58B1C2CDB85EDE4D37C3DE6EFDC95
|
|
websites:
|
|
- viptrack.ro
|
|
c2:
|
|
domains:
|
|
- android.viptrack.ro
|
|
ips:
|
|
- 89.33.190.8
|
|
|
|
- name: EasyLogger
|
|
names:
|
|
- EasyLogger
|
|
type: stalkerware
|
|
packages:
|
|
- app.EasyLogger
|
|
- app.Easylogger
|
|
- app.Elogger
|
|
- app.childsafetytracker
|
|
- app.seniorsafety
|
|
certificates:
|
|
- 07906D1FA933730B8EB44F03910C88FDAC2C0135
|
|
- 24D3251C7A1184649211B9068820545397B112C9
|
|
- 35D7CF057BFA5023CE739A725ADA0DA1FD34D1FF
|
|
- 8698564FBEC700167FCC53D1AED00FFADF6BED6C
|
|
- 8F23E1457ADC6189F6ED504A60DF8896FEC6D970
|
|
- D15A276F181C839E0390672A43065E8D97F140E9
|
|
- 53FADDAF873B7BD00E5AD9F5F05E7888A398CE70
|
|
websites:
|
|
- logger.mobi
|
|
- childsafetytrackerapp.com
|
|
- seniorsafetyapp.com
|
|
- www.childsafetytrackerapp.com
|
|
- www.seniorsafetyapp.com
|
|
distribution:
|
|
- inv.logger.mobi
|
|
- pro.logger.mobi
|
|
c2:
|
|
ips:
|
|
- 172.67.81.216
|
|
- 104.25.28.15
|
|
- 104.25.29.15
|
|
domains:
|
|
- 97.logger.mobi
|
|
- account.logger.mobi
|
|
- account.childsafetytrackerapp.com
|
|
- api.childsafetytrackerapp.com
|
|
- api.seniorsafetyapp.com
|
|
- beta-api.logger.mobi
|
|
- beta.logger.mobi
|
|
- easyloggerbeta.azurewebsites.net
|
|
- elcore-api.azurewebsites.net
|
|
- inv.logger.mobi
|
|
- pro.logger.mobi
|
|
- ps97mailer.logger.mobi
|
|
- pulsesolutions-net-easy-logger.firebaseio.com
|
|
- sandbox97.childsafetytrackerapp.com
|
|
- sandbox97.logger.mobi
|
|
- sandbox97.seniorsafetyapp.com
|
|
- senior-safety-189010.firebaseio.com
|
|
- servicesloggermobi.azurewebsites.net
|
|
- waws-prod-blu-247-e7b3.eastus.cloudapp.azure.com
|
|
- waws-prod-blu-247.sip.azurewebsites.windows.net
|
|
|
|
- name: Hoverwatch
|
|
names:
|
|
- Hoverwatch
|
|
- SpyBubble
|
|
- Refog
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.core.monitor.debug
|
|
- com.android.core.monitor.null
|
|
- com.android.core.monitornull
|
|
- com.android.core.monitor
|
|
- com.android.core.mnt
|
|
- com.android.core.mnta
|
|
- com.android.core.mntah
|
|
- com.android.core.mntb
|
|
- com.android.core.mntd
|
|
- com.android.core.mnte
|
|
- com.android.core.mntf
|
|
- com.android.core.mntg
|
|
- com.android.core.mnth
|
|
- com.android.core.mnti
|
|
- com.android.core.mntj
|
|
- com.android.core.mntk
|
|
- com.android.core.mntl
|
|
- com.android.core.mntm
|
|
- com.android.core.mntn
|
|
- com.android.core.mnto
|
|
- com.android.core.mntp
|
|
- com.android.core.mntq
|
|
- com.android.core.mntr
|
|
- com.android.core.mnts
|
|
- com.android.core.mntt
|
|
- com.android.core.mntu
|
|
- com.android.core.mntv
|
|
- com.android.core.mntw
|
|
- com.android.core.mntx
|
|
- com.android.core.mnty
|
|
- com.android.core.mntz
|
|
- cmf0.c3b5bm90zq.patch
|
|
certificates:
|
|
- 0E0BE37D31CA21F19095FC38F9F1BEF310CE227C
|
|
- 4F6AD2383DADACCF93EA5BE4300571C315DBDF5B
|
|
- 5284272445CE993DE601BB23CAE6BA9E43E4589C
|
|
- 6144ED2E25B6F3A5FAFCF914965CA071A685674B
|
|
- 64403A61F41848F987D6FD0BE00392E9561A0EF7
|
|
- AFC457A96258490FBC284EE889634B5F3E325B8E
|
|
- B6B58148F1B2198C94BDE546FD2E0734EC7838D6
|
|
- CC4A78DBE96AC1FA5977E03C97052A9A334113B4
|
|
- E8FF1077D207E47AB4B53F275C437C0889579658
|
|
- F21ECAFCFF000686E8EC090F1ECDAECE08798BFF
|
|
websites:
|
|
- br.refog.com
|
|
- de.refog.com
|
|
- es.refog.com
|
|
- fr.refog.com
|
|
- highstermobi.com
|
|
- hover.watch
|
|
- hoverwatch.com
|
|
- hu.refog.com
|
|
- hws.icu
|
|
- it.refog.com
|
|
- my.hws.icu
|
|
- nl.refog.com
|
|
- prospybubble.com
|
|
- refog.com
|
|
- refog.de
|
|
- refog.net
|
|
- refog.org
|
|
- ro.refog.com
|
|
- www.hoverwatch.com
|
|
- www.refog.com
|
|
c2:
|
|
ips:
|
|
- 104.236.73.120
|
|
- 149.56.26.44
|
|
- 158.69.24.236
|
|
- 188.130.241.205
|
|
- 198.100.150.203
|
|
domains:
|
|
- a.hw.cab
|
|
- hw.cab
|
|
- a.hwa.cab
|
|
- account.refog.com
|
|
- dev.hoverwatch.com
|
|
- dev2.refog.com
|
|
- downloads.refog.com
|
|
- hover.watch
|
|
- hoverwatch.com
|
|
- hwa.cab
|
|
- hwm.cab
|
|
- hws.icu
|
|
- hww.cab
|
|
- i.hoverwatch.com
|
|
- i1.hoverwatch.com
|
|
- office.hw.cab
|
|
- rec.hw.cab
|
|
- test.refog.com
|
|
- a.syncvch.com
|
|
|
|
- name: LetMeSpy
|
|
names:
|
|
- LetMeSpy
|
|
- RemoteCommand
|
|
- RemCmd
|
|
type: stalkerware
|
|
packages:
|
|
- pl.lidwin.letmespy
|
|
- pl.lidwin.letmespy2
|
|
- pl.lidwin.letmespy3
|
|
- pl.lidwin.letmespy4
|
|
- pl.lidwin.letmespy5
|
|
- pl.lidwin.lms
|
|
- pl.lidwin.remote
|
|
- pl.lidwin.remote1
|
|
- pl.lidwin.remote2
|
|
- pl.radeal.lms4
|
|
certificates:
|
|
- 340E571CB1A64E6EE384D3F8A544681459CF3F5F
|
|
- 69EE83CB3E0968B49E33849D40F7D91B0592C7DB
|
|
- 8F0EAD4F1DA5DAAF8C0F7A51096CECEEF81D0C76
|
|
- EF6BC4C13FE455CD98192E56D96317069BDF7658
|
|
websites:
|
|
- letmespy.com
|
|
- remotecommands.com
|
|
- www.letmespy.com
|
|
- www.teleszpieg.pl
|
|
- teleszpieg.pl
|
|
- bbiindia.com
|
|
- www.bbiindia.com
|
|
c2:
|
|
ips:
|
|
- 91.196.212.202
|
|
- 91.196.212.201
|
|
domains:
|
|
- letmespy.com
|
|
- remotecommands.com
|
|
- zdalnakontrola.pl
|
|
|
|
- name: Snoopza
|
|
names:
|
|
- Snoopza
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.core.mngi
|
|
- com.android.core.mngj
|
|
- com.android.core.mngk
|
|
- com.android.core.mngl
|
|
- com.android.core.mngn
|
|
- com.android.core.mngo
|
|
- com.android.core.mngp
|
|
- com.android.core.mngq
|
|
- com.android.core.mngr
|
|
- com.android.core.mngs
|
|
- com.android.core.mngt
|
|
- com.android.core.mngu
|
|
- com.android.core.mngv
|
|
- com.android.core.mngw
|
|
- com.android.core.mngx
|
|
- com.android.core.mngy
|
|
- com.android.core.mngz
|
|
certificates:
|
|
- 240E97A0587BF99441787EA3BCB2B2D8827564FE
|
|
- 854F7978408EA58C5B792C1C1EF9733FC2D5E813
|
|
- 1988EDEA389D42983CEC8B5F8A9C27AE49F800F9
|
|
- 5E16BA998632C1C3E4D4AE707D6EE2454ED2AEB5
|
|
- E023517B163AAAE209CBD97E312752960F575D38
|
|
websites:
|
|
- snoopza.com
|
|
- get.snoopza.com
|
|
- snoopza.zendesk.com
|
|
- demo.snoopza.com
|
|
- newdemo.snoopza.com
|
|
c2:
|
|
ips:
|
|
- 178.62.59.165
|
|
- 217.182.250.165
|
|
- 46.105.57.148
|
|
domains:
|
|
- api.snoopza.com
|
|
- app.snoopza.com
|
|
- app2.snoopza.com
|
|
- dev.snoopza.com
|
|
- flower.snoopza.com
|
|
- get.snoopza.com
|
|
- my.snoopza.com
|
|
- my2.snoopza.com
|
|
- snoopza.com
|
|
- viewer.snoopza.com
|
|
|
|
- name: TrackMyPhones
|
|
names:
|
|
- TrackMyPhones
|
|
type: stalkerware
|
|
packages:
|
|
- com.app.audiorec
|
|
- com.app.call_rec_hidden
|
|
- com.app.keylogger
|
|
- com.app.spy_call_recorder
|
|
- com.app.recorder
|
|
- com.app.videorec
|
|
- com.apps.anti_theft
|
|
- com.apps.rct.CellTrackerActivity
|
|
- com.dev4playapps.whatsdeleted
|
|
- com.gcm_call_sms_tracker
|
|
- com.gcm_call_sms_tracker.updated
|
|
- com.gcm_call_tracker
|
|
- com.gcm_celltracker
|
|
- com.local_cell_tracker
|
|
- com.local_cell_tracker_updated
|
|
- com.soh
|
|
- com.trackerapps.whatsaptracker
|
|
- com.trackmyphone_pro
|
|
- com.trackmyphones.livefamilytracker
|
|
- com.trackmyphones.recoverphoneusingchatmessages
|
|
- com.trackmyphones.tmpusingchatmessages
|
|
certificates:
|
|
- 37ACE0321E8833F25BDDB363AB395C81354E88A0
|
|
- 554137DEE63BE07CE9687C5886244954277227F5
|
|
- 68AC78A7CD660ED204B4BC3C73A3F91DA1AE45FC
|
|
- 6DB1F33668AA745163DFB6C5614C3800BCA8D693
|
|
- 849D181E1BEE5084CBE1BACBA8442996A8B1F8C6
|
|
- 87EF370B8D6E3089E7F8CDDD6E830B5E4C8CF60B
|
|
- A93266E83B136CBC220062898D308213263E793A
|
|
- B7285348B05EDAEFF7F032384E4F90182E1C1F27
|
|
- EBD3713DFB02D79ADC90C88DE1E0B547882F5A42
|
|
- F5A5336B28456208EF357B4630A93A91206CF21A
|
|
websites:
|
|
- trackmyphones.com
|
|
- www.trackmyphones.com
|
|
c2:
|
|
domains:
|
|
- cell-tracker-green.firebaseio.com
|
|
- cell-tracker-updated.firebaseio.com
|
|
- key-logger-90fff.firebaseio.com
|
|
- message-tracker-98822.firebaseio.com
|
|
- smsandcalltracker.firebaseio.com
|
|
- spyaudiorecorder.firebaseio.com
|
|
- trackmyphones-pro.firebaseio.com
|
|
- trackmyphones.com
|
|
- video-recorder-c0419.firebaseio.com
|
|
- www.trackmyphones.com
|
|
|
|
- name: FlexiSpy
|
|
names:
|
|
- FlexiSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.vvt.android.syncmanager
|
|
- com.telephony.android
|
|
- com.fp.backup
|
|
- com.android.phone.dialer
|
|
certificates:
|
|
- 69B327860EDB531DDFFB1B5DBF0C24245A75F3E4
|
|
- 93385A087BB5CAB96EAE83A1AF874E0E39B2990F
|
|
- 20C940625B322C487A89B1FEBF6C090845B040C1
|
|
- 984F8786102D9BF26E5244BBC93733D3609948F4
|
|
- 45DECBF059864164A4BC644D3EAB8127FC98238A
|
|
- 0B6C1B010FBEA4316EB01602F71CDD6A8F365023
|
|
- 636F6FE622D3059B569C9989F3CD491607F23A5D
|
|
- 284E4AF2E92E8E49EDC2C8792D7008759813CB68
|
|
- F6422B9D4DD3C7370E3ED2879EA4DC8F463CD2A2
|
|
websites:
|
|
- flexispy.com
|
|
- community.flexispy.com
|
|
- blog.flexispy.com
|
|
- www.flexispy.com
|
|
- mobilefonex.com
|
|
- mobileapps.com.my
|
|
- flexispy.mobileapps.com.my
|
|
- support.flexispy.com
|
|
- svlogin.asia
|
|
- www.spyphonereview.com
|
|
- spyphonereview.com
|
|
c2:
|
|
ips:
|
|
- 119.8.35.235
|
|
domains:
|
|
- admin.flexispy.com
|
|
- api.flexispy.com
|
|
- client.mobilefonex.com
|
|
- djp.bz
|
|
- dmw.bz
|
|
- dmw.cc
|
|
- ecom.flexispy.com
|
|
- mflx.biz
|
|
- portal.flexispy.com
|
|
- push.mobilefonex.com
|
|
- test-client.mobilefonex.com
|
|
- trkps.com
|
|
distribution:
|
|
- store.mycustomdevice.com
|
|
|
|
- name: Cerberus
|
|
names:
|
|
- Cerberus
|
|
type: stalkerware
|
|
packages:
|
|
- com.lsdroid.cerberuss
|
|
- com.lsdroid.cerberus.persona
|
|
- com.lsdroid.cerberus.persona2
|
|
- com.lsdroid.cerberus.kids
|
|
- com.lsdroid.cerberus.client
|
|
- com.lsdroid.cerberus
|
|
- com.surebrec
|
|
- com.ssurebrec
|
|
certificates:
|
|
- BC693B48B7EC988E275CF9E1CDAA1447A31717D9
|
|
- 724C6500F11737C12C0B89185A60427989656697
|
|
- 69C28343A4D0F2156D7B56AE4616E1386173A047
|
|
- F2633353631EE72F7B7A7B946FABE1EF0A339041
|
|
- B4ED5FA9E2A9176DA53324717A9B10F57191859C
|
|
- 409B589FDEAE073A94D609E2B41A6C0EA952B35A
|
|
- C87A87F7F5EDE2D279DDA0CCDE55E6AB85549D70
|
|
- 52B12772C6558D6A44A2DAF9E18FFAE48C577CA7
|
|
websites:
|
|
- cellphonetrackers.org
|
|
- cerberusapp.com
|
|
- cerberusbrasil.com
|
|
- enterprise.cerberusapp.com
|
|
- www.cerberusapp.com
|
|
- www.cerberusbrasil.com
|
|
c2:
|
|
domains:
|
|
- api-project-999803017449.firebaseio.com
|
|
- cerberusapp.com
|
|
- www.cerberusapp.com
|
|
|
|
- name: mSpy
|
|
names:
|
|
- FakeSys
|
|
- KidSecured
|
|
- Phonsee
|
|
- SecureChildren
|
|
- celSpy
|
|
- eyeZy
|
|
- mSpy
|
|
- mSpyOnline
|
|
type: stalkerware
|
|
packages:
|
|
- android.helper.system
|
|
- android.sys.process
|
|
- com.android.keyboardhelper
|
|
- com.mspy.lite
|
|
- core.framework
|
|
- com.eyezy.android
|
|
- core.update.framework
|
|
- med.mspy.mspy
|
|
- system.framework
|
|
- update.service.android
|
|
- update.service.android.installer
|
|
certificates:
|
|
- 021985CEA754D8E58D538D2FEDFF6B1565A6B45B
|
|
- 3930B621F30D13D24692CBBBBC67C59F92F1C9BD
|
|
- 5EEC898F0DBBD70A9B33DD16EE5FF06B6DE26EA6
|
|
- 7FFE6DA96346FEE822E1F791176CD6970A1DC770
|
|
- 3E1A6646C93A7423A25104A88DA5BECE2F35EFF0
|
|
- CB28ADFD818FBFFDF5542F2EFC5140D596EE957E
|
|
- FE821A533BDC31822D9EB5F98243EB16917C8EE7
|
|
- 1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F
|
|
websites:
|
|
- bill-msp.app
|
|
- cart.mspy.com
|
|
- ctrl-msp.app
|
|
- freefonespy.com
|
|
- kidsecured.com
|
|
- m-services.app
|
|
- mbill.app
|
|
- mcontrolapp.com
|
|
- mkid.app
|
|
- mkidctrl.app
|
|
- mkidsecure.com
|
|
- mliteapp.com
|
|
- mpotect.app
|
|
- msafety.app
|
|
- msecureapp.com
|
|
- msp-control.app
|
|
- mspkid.app
|
|
- mspy.co.il
|
|
- mspy.co.uk
|
|
- mspy.com
|
|
- mspy.com.ar
|
|
- mspy.com.br
|
|
- mspy.com.cn
|
|
- mspy.com.es
|
|
- mspy.fr
|
|
- mspy.in
|
|
- mspy.it
|
|
- mspy.jp
|
|
- mspy.net
|
|
- mspy.nl
|
|
- mspy.support
|
|
- mspylite.com
|
|
- mspyonline.com
|
|
- mspyplus.com
|
|
- myfonemate.com
|
|
- onlinecontrol.app
|
|
- onlinesecure.app
|
|
- parent-msp.app
|
|
- phonsee.com
|
|
- safe-root.com
|
|
- secure-msp.app
|
|
- securechildren.online
|
|
- theispyoo.com
|
|
- www.eyezy.com
|
|
- www.mspy.com
|
|
- www.mspyonline.com
|
|
distribution:
|
|
- q12z.net
|
|
- getmspy.net
|
|
c2:
|
|
domains:
|
|
- a-qa3.thd.cc
|
|
- a.thd.cc
|
|
- alter757.info
|
|
- api.thd.cc
|
|
- apiv4.alter757.info
|
|
- b55y.net
|
|
- bbrp.co
|
|
- bi.thd.cc
|
|
- cp.mspyonline.com
|
|
- eyezyapp.thd.cc
|
|
- getmspy.net
|
|
- hz-service.thd.cc
|
|
- hz7.thd.cc
|
|
- idevs.co
|
|
- jailbreak-gateway.thd.cc
|
|
- kypler.com
|
|
- m-media.thd.cc
|
|
- mcloud-api.thd.cc
|
|
- mi.thd.cc
|
|
- mlite-app.livekit.cloud
|
|
- mlite-app.thd.cc
|
|
- mlite-socket.thd.cc
|
|
- mliteapp.alter757.info
|
|
- mobile-gw.thd.cc
|
|
- mspy.alter757.info
|
|
- mspyonline.com
|
|
- mspytrackercom.alter757.info
|
|
- mtechn.zendesk.com
|
|
- my.kidsecured.com
|
|
- my.mspyonline.com
|
|
- my.phonsee.com
|
|
- my.securechildren.online
|
|
- pipe.thd.cc
|
|
- project-323448153542050953.firebaseio.com
|
|
- q12z.net
|
|
- repo.mspyonline.com
|
|
- rockalab.com
|
|
- s3.thd.cc
|
|
- sentry-01.thd.cc
|
|
- sentry-02.thd.cc
|
|
- sentry-03.thd.cc
|
|
- sentry-04.thd.cc
|
|
- sentry-05.thd.cc
|
|
- sentry-06.thd.cc
|
|
- sentry-07.thd.cc
|
|
- sentry-product-new.bbrp.co
|
|
- thd.cc
|
|
- tracking.mliteapp.com
|
|
- tracking.mspyonline.com
|
|
- update-service-7e59f.firebaseio.com
|
|
- webrtc.thd.cc
|
|
- www.mspy.com
|
|
- www.mspyonline.com
|
|
|
|
- name: MeuSpy
|
|
names:
|
|
- MeuSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.app.com.app.com.app.aplintal
|
|
- com.app.insapp2
|
|
- com.meuspy
|
|
- br.com.cloud.aplicativo
|
|
- br.com.cloud.backup
|
|
- br.com.daggers.gameap
|
|
- br.com.daggers.toshtec
|
|
- br.com.phonecell.cloud1
|
|
- br.com.phonecell.go5ge
|
|
- br.com.phonecell.maps
|
|
- br.com.phonecell.radio
|
|
- br.com.phonecell.services
|
|
- br.com.sistema.aplicativo
|
|
- br.com.monsthers.gameap
|
|
- in.servidor.service
|
|
- br.com.galaxys.gameap
|
|
- br.com.gamelevel.playstart
|
|
- br.com.gamelevel.cloudv3
|
|
- com.tutorial.instalao
|
|
- com.aisistem.instalao
|
|
- br.com.appfornecedor.legal
|
|
certificates:
|
|
- 77E86A5C583256B5A52A5AEEB70542CD1BE34A99
|
|
- 3E929DB5941C185EA4FAC2B0D7BA7589D40A379E
|
|
- B8CA103D22C39282D7A1E8028D93333E481CCA83
|
|
- 018D06B4A5679892572CB9DA44BA1A8C1E3B68A5
|
|
- B0A100360B029E0B2105F60E2C8EEB9053998A7E
|
|
- E0E02AD30F042E096A7A5654217B846EA08C02D1
|
|
- 493812991A9A1CC7BEEFD45F2180CD2FC0AF8913
|
|
- 35B05ACC96D02849E20D9ED3BA9CEA41C2B83FFA
|
|
- 6C0B8CF7F47DB7A82A2C06D410690935FDD912DF
|
|
- 18C94FAB82F77F89546600F84D2D2B48A0C0B927
|
|
- 0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78
|
|
- 6B1DC3EAE0E8C59E7769A6E0A1BAA1938620A191
|
|
- 8508603AE680C3BCDE91E6F909BF400F6DC878B4
|
|
- DD34B4E5125F07BA50738192FBE7B745785FC15A
|
|
- AF113D18054A6B8DE74644BCE3F0AE41206B16AC
|
|
- A7E75010B3709D54D52CCE914AF06946744F5F67
|
|
- 53486B8F8790D1848E0842F37B5C6DFA15CD3EBB
|
|
- 114C4DC0F254EFD81F0AC7F41DBE882FFDB2E127
|
|
- 50CADBA5487E7C00D67C8FF0D3A952D7B62BEE9A
|
|
- B9F546776987F0F2FF893325D2CCDF7F62F0D56E
|
|
distribution:
|
|
- servidor.in
|
|
websites:
|
|
- meuspy.com
|
|
- monitorecell.com.br
|
|
- espiao.meuspy.com
|
|
- www.espiaodecelulargratis.com.br
|
|
- espiaodecelulargratis.com.br
|
|
c2:
|
|
domains:
|
|
- servidor.in
|
|
- n.servidor.in
|
|
- l.servidor.in
|
|
- s.servidor.in
|
|
- play-store-3bb64.firebaseio.com
|
|
|
|
- name: AppSpy
|
|
names:
|
|
- AppSpy
|
|
- MobileFindFree
|
|
- FreeSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.atracker.app
|
|
- com.agpstracker.app
|
|
- com.aphonetracker.app
|
|
- com.afreesmstracker.app
|
|
- com.mobilefindfree
|
|
certificates:
|
|
- 07525D7D2E83CE865F98E1B9C0F6095B1C29D48A
|
|
- 0AD33649F0D0532B5EB0A36A81712962AA79BF54
|
|
- 492FF617A79F6C8D80B453815CFE6586E21C5F72
|
|
- 9E09874197988F20DB51EB6A34BFD908AC42C35B
|
|
- D98C69B50C1092FE21F7CF748DC8B2F91BE56B64
|
|
- FB926CF2937331BB8A46E2C5280233C04DA2342E
|
|
websites:
|
|
- app.appspy.net
|
|
- app.appspyfree.com
|
|
- app.freephonespy.net
|
|
- app.mobilespyfree.net
|
|
- appspy.com
|
|
- appspy.net
|
|
- appspyfree.com
|
|
- apptracker.net
|
|
- cellphonespyappon.com
|
|
- free-spy.com
|
|
- free.apptracker.net
|
|
- freemobilespy.net
|
|
- freephonespy.net
|
|
- justseries.net
|
|
- mobilespyfree.net
|
|
- spyren.com
|
|
- trackerfree.net
|
|
- www.appspy.com
|
|
- www.appspy.net
|
|
- www.apptracker.net
|
|
- www.cellphonespyappon.com
|
|
- www.freemobilespy.net
|
|
- www.freephonespy.net
|
|
- www.mobilespyfree.net
|
|
- www.spyren.com
|
|
- www.trackerfree.net
|
|
- www.xvids.us
|
|
- xvids.us
|
|
c2:
|
|
ips:
|
|
- 167.114.114.207
|
|
domains:
|
|
- api.free-spy.com
|
|
- app.appspy.net
|
|
- appspy-net.firebaseio.com
|
|
- appspy.net
|
|
- freemobilespy.net
|
|
|
|
- name: MobileTrackerFree
|
|
names:
|
|
- MobileTrackerFree
|
|
- MonitorLoverman
|
|
- MTrack
|
|
- CellTracker
|
|
- TrackMobil
|
|
type: stalkerware
|
|
packages:
|
|
- a.tck.lvmchi
|
|
- com.androdid.inteernet.aa21111227
|
|
- com.jyotin.ct
|
|
- com.lrvciyti.unrxnfig
|
|
- com.m.service.control
|
|
- com.mob.service.control
|
|
- com.mobile.gps
|
|
- com.mobile.loc
|
|
- com.mobiletracker
|
|
- com.mobiletrackerfree.secondapp
|
|
- com.mobiletrackerfree.www
|
|
- com.mtf.d
|
|
- com.netowrk.service
|
|
- com.services.phone
|
|
- g.google.llc
|
|
- m.mob.control
|
|
- m.mob.service2020
|
|
- m.phone.control2020
|
|
- m.protect.children
|
|
- m.protect.parental
|
|
- m.secu.children
|
|
- m.security.parental
|
|
- mob.protect.children
|
|
- mob.service.parental2020
|
|
- mobile.controlparental2020
|
|
- mobile.monitor.child2021
|
|
- mobile.monitor.child2022
|
|
- mobile.monitor.child2023
|
|
- mobile.monitor.child2034
|
|
- mobile.parental2021
|
|
- mobile.protect.children
|
|
- mobile.protect.children2020
|
|
- security.mobile.parental
|
|
- service.download.app
|
|
- tracker.mob.gps
|
|
- yogaworkouts.dailyyoga.yogafitness
|
|
- com.get.mtf
|
|
- com.mtf.download
|
|
- com.protect.download
|
|
certificates:
|
|
- 021A3F097EDA780798DF5ECB16EF338C08236847
|
|
- 0568E0400308CBFC58E11A324EA233F5B2E923BF
|
|
- 09DCBFDB7C7262F143089C5493435AB07564FD67
|
|
- 0FB6108D34289681BA0181ED9A4350514EB07665
|
|
- 1128939E0D8B8BAEAB14C41AEBFAA100C319AD8F
|
|
- 16254E7CBDFEC82B6CCE599DFCE6A6E84CF25504
|
|
- 29FFFE437675D2B55512953759C40776E547592D
|
|
- 2F033070A8CD93CEAC60F9E203BA33C9A9A3D226
|
|
- 35CD797D1736484786152A231920575FABC5C12A
|
|
- 377223C40330F7925BB238E3A2AC6E1BE1A05749
|
|
- 3935E474CD6EDACB19F24192809B337D376656F6
|
|
- 457D2470CA3E635178D224C14C0D743B7C7F9F80
|
|
- 57178BA7BE0677C3143C24362FD35A9CF0E311A8
|
|
- 575A730BC2411897A318DEB23B3C3CC4F63422F5
|
|
- 5F43A60BFC663FB37F419A40015495431649310B
|
|
- 6000C3F6A35C81C0AE6ACA73DBF7B7D19DCDB7BC
|
|
- 6F1CE95315749AC6F377B310C0B831CF05B04C68
|
|
- 845705FB0FE177970768CE3F5241AEBD99F3BEEE
|
|
- 85F12B25CEB58B8376F83209D8D128841132DC51
|
|
- 8A718113C6EDE9473FE4BF1F29E2E807B7EB7B56
|
|
- 8A92A4F6F9FC52BC8788F17704944614C744716C
|
|
- 8B9540311C46184984B48BF9CB51F1742A8AFB42
|
|
- 8CED75E875A2F11B3327A73A6DBD0B25E26533F2
|
|
- 9225C8FD380154467908AE344FBE75CE7EF996B8
|
|
- 927CA44949D7788AA86F9D7F04D7FDACECD1DFB9
|
|
- 9442F1D40FBAAD7053D130986C4487D0BA5C079F
|
|
- A75B340A58545B28B7E837582259C1CC2CE21512
|
|
- B0B09157DC34E3D20DF6A92EBA0014D36A27C451
|
|
- B7322B2126B2C4F4DED940D719FE1E63FD233D35
|
|
- B8D8C25B1CFE2829D397C8FB166895A6791A43D5
|
|
- C656605BDB536B842319AC008FBB249D8B0A7422
|
|
- CB6E6DEB296275EDF70DC71A62A75AB7B9C8DB89
|
|
- CD5724426B602C1CD0BF3BD65EF75B9021C0EC3A
|
|
- CE3BB9701274C15D26A92C1D7D34110961EB73F1
|
|
- D244AA1DD3D4296CE875EDA2E1B0332459F7DACE
|
|
- D943998AEC15B3D70DA3BF00FF7BF580A41F6E4B
|
|
- DDCF7F1032E7D9DA4E3D245A5145363F69F9C393
|
|
- E8395BE2A32B62C1BA21E37663E3BF1583E00FAA
|
|
- FB2EEA183C183B486B3001EC5FC4E8C906593356
|
|
- 09273A6004A46078991F3FBA2A4868DA26DBB508
|
|
- 2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C
|
|
- A4817668612688754B4905C44AB9F70C58C25CB2
|
|
- 1CE722F401C3FA8FE498FF824669C0007A200AA9
|
|
distribution:
|
|
- download.mobile-tracker-free.me
|
|
websites:
|
|
- br.mobile-tracker-free.com
|
|
- br.loverman.net
|
|
- celltracker.io
|
|
- loverman.net
|
|
- mobile-tracker-family.com
|
|
- mobile-tracker-free.be
|
|
- mobile-tracker-free.biz
|
|
- mobile-tracker-free.co
|
|
- mobile-tracker-free.com
|
|
- mobile-tracker-free.de
|
|
- mobile-tracker-free.es
|
|
- mobile-tracker-free.eu
|
|
- mobile-tracker-free.fr
|
|
- mobile-tracker-free.info
|
|
- mobile-tracker-free.ir
|
|
- mobile-tracker-free.it
|
|
- mobile-tracker-free.me
|
|
- mobile-tracker-free.mobi
|
|
- mobile-tracker-free.name
|
|
- mobile-tracker-free.net
|
|
- mobile-tracker-free.org
|
|
- support.mobile-tracker-free.com
|
|
- support.loverman.net
|
|
- mobile-tracker.mobi
|
|
- mobitrackapps.com
|
|
c2:
|
|
ips:
|
|
- 51.15.183.209
|
|
domains:
|
|
- api1.easydoc.info
|
|
- api3.easydoc.info
|
|
- apk.mtf.re
|
|
- celltrackernew.firebaseio.com
|
|
- d-app-apk.com
|
|
- d.d-app-apk.com
|
|
- easydoc.info
|
|
- loverman.net
|
|
- mobile-tracker-data.com
|
|
- mtf.re
|
|
- myappmobile-537f7.firebaseio.com
|
|
- n6sm2m.celltracker.io
|
|
- olurdaolurdediler.shop
|
|
- sapient-flight-837.firebaseio.com
|
|
- mobile-tracker-free.com
|
|
|
|
- name: iKeyMonitor
|
|
names:
|
|
- iKeyMonitor
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.internet.a20200817
|
|
- com.android.internet.a20210916
|
|
- com.android.internet.a20220729
|
|
- com.android.internet.a20220829
|
|
- com.android.internet.a20220914
|
|
- com.sec.android.internet.im.service.im20190118
|
|
- com.sec.android.internet.im.service.im20190419
|
|
- com.sec.android.internet.im.service.im20210815
|
|
certificates:
|
|
- C1D83F5FFE3EC319FF103EC7346CDDF218B5634D
|
|
- 4DAD108F915E237CA2834FAC70C077AD8105E804
|
|
- B8F5FDFAE5920C4CFB6ACE214D39327F299FA76D
|
|
- 9284CB43B87E9F9C77DA509F1672E884BD6CA876
|
|
- 786325AB3E614F868CA2A7F2F0E75EC76A047311
|
|
- F747F0BBEF33FFEE6AFC4E7CFA03B28215985F24
|
|
- 0C422F0025F866C311DF61A7549FCD519683898D
|
|
- 98ED5841256A44FB1525FE154C0516ACED82FFF3
|
|
- ACB2CA50376456FD81B5C6C19CF6D717CFBB888B
|
|
websites:
|
|
- easemon.com
|
|
c2:
|
|
ips:
|
|
- 172.67.82.183
|
|
- 104.25.170.109
|
|
- 104.25.169.109
|
|
- 104.26.15.56
|
|
- 172.67.73.2
|
|
- 104.26.14.56
|
|
- 172.67.194.85
|
|
- 104.18.54.129
|
|
- 104.18.55.129
|
|
domains:
|
|
- 83dd4.appspot.com
|
|
- awsapi.io
|
|
- em.awsapi.io
|
|
- ikm.awsapi.io
|
|
- emcpanel.com
|
|
- users.easemon.com
|
|
- ikeymonitor.com
|
|
- ikeymonitor.fr
|
|
- users.awosoft.com
|
|
|
|
- name: PanSpy
|
|
names:
|
|
- PanSpy
|
|
- SurveilStar
|
|
type: stalkerware
|
|
packages:
|
|
- com.panspy.android
|
|
certificates:
|
|
- CCD5678FF73D6ECF4E74317166422AFE67D77406
|
|
websites:
|
|
- panspy.com
|
|
- surveilstar.com
|
|
distribution:
|
|
- panspy.me
|
|
c2:
|
|
domains:
|
|
- panspy.me
|
|
- panspy.com
|
|
- ali.panspy.com
|
|
- c1.panspy.com
|
|
- d1.panspy.com
|
|
- s1.panspy.com
|
|
- u1.panspy.com
|
|
- panspy-1.oss-us-west-1.aliyuncs.com
|
|
|
|
- name: AndroidLost
|
|
names:
|
|
- AndroidLost
|
|
type: stalkerware
|
|
packages:
|
|
- com.androidlost
|
|
- com.androidlost.smshandler
|
|
certificates:
|
|
- 9EECE9B4ECF4DC0C5981FEACFB271E1C0A2967FF
|
|
websites:
|
|
- androidlost.com
|
|
- www.androidlost.com
|
|
c2:
|
|
domains:
|
|
- androidlost.appspot.com
|
|
- androidlost.firebaseio.com
|
|
- androidlost.com
|
|
- www.androidlost.com
|
|
- test.androidlost.com
|
|
- new.androidlost.com
|
|
|
|
- name: Metasploit
|
|
names:
|
|
- Metasploit
|
|
- ForeverSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.metasploit.stage
|
|
websites:
|
|
- foreverspy.com
|
|
c2:
|
|
domains:
|
|
- foreverspy.com
|
|
- app.foreverspy.com
|
|
|
|
- name: Spy24
|
|
names:
|
|
- Spy24
|
|
type: stalkerware
|
|
packages:
|
|
- net.spy24.wifi
|
|
- com.example.openanotherapp
|
|
- ir.spy24.updater
|
|
- ir.spy24.wifi
|
|
- app.spy24.systemwifi
|
|
- app.spy24.spy24installer
|
|
certificates:
|
|
- 79C395148C34F0826E04B37A6632A53A7977A1AA
|
|
- F5C25A3B800311E8053295676ADB112753E03F0B
|
|
websites:
|
|
- spy24.net
|
|
- spy24.app
|
|
c2:
|
|
ips:
|
|
- 138.201.32.118
|
|
domains:
|
|
- spy24.net
|
|
- panel.spy24.net
|
|
- panel24.org
|
|
- android.spy24.app
|
|
|
|
- name: CatWatchful
|
|
names:
|
|
- CatWatchful
|
|
type: stalkerware
|
|
packages:
|
|
- wosc.cwf
|
|
- wosc.cwf2
|
|
- com.example.wosc.androidclient
|
|
certificates:
|
|
- 5037E917539B4F31E0B92EBB7A9089C5DC567518
|
|
- 68E4A16FD2B8D41E817CC5A06BA95B9CED9BD9F9
|
|
- 757DB1C635344324B665BAF056DC3E4B1D0CC39B
|
|
- 783B1880ECDC5E75620A4C484E3BDBE08D6D4397
|
|
- 8E352F2EE18054DF97C238915C0375AA13305DEC
|
|
- 92DF71DB15BEEAB77DF36FD879A89E5E0DEF4617
|
|
- 93135ABA6FF4B6CFE9B06153B9BDF769AEBC1D87
|
|
- 9FE876AF76CDCB685102A38528A3A732B0872DC6
|
|
- B927DACA3BB3876523E2E8B1BDB56CE84B0DFFF7
|
|
- F18B3369F152EC3C74EC884BE977B3CA0E0C996D
|
|
- 523C42BF2F6CBAFC78BE41043E8E3E3BB311CBA2
|
|
- 77032E80CC0ECEE49B8F2F58F9999330026E0DB3
|
|
- 7688EA09EE353ED077E0A90D401881B63F115A3F
|
|
websites:
|
|
- catwatchful.com
|
|
- catwatchful.online
|
|
- catwatchful.pink
|
|
- catwatchful-e03b8.appspot.com
|
|
c2:
|
|
ips:
|
|
- 45.114.224.147
|
|
- 162.144.75.253
|
|
domains:
|
|
- catwatchful.com
|
|
- catwatchful-e03b8.firebaseio.com
|
|
- catwatchful-e03b8-2.firebaseio.com
|
|
- us-central1-catwatchful-e03b8.cloudfunctions.net
|
|
|
|
- name: HighsterMobile
|
|
names:
|
|
- AutoForward
|
|
- DDI
|
|
- DDIUtilities
|
|
- EasySpy
|
|
- Highster
|
|
- HighsterMobile
|
|
- HighsterSpy
|
|
- PhoneSpector
|
|
- SafeGuarde
|
|
- SurePoint
|
|
- TurboSpy
|
|
type: stalkerware
|
|
packages:
|
|
- org.secure.smsgps
|
|
- com.autoforward.monitor
|
|
- com.phonespector.app
|
|
- com.ddiutilities.monitor
|
|
certificates:
|
|
- 683722A1C629AD5734B93E08ADFAA61775AD196F
|
|
- 48A2190050B80F31E1E3CCFAF9909FAD238D9849
|
|
websites:
|
|
- auto-forward.com
|
|
- autoforward.app
|
|
- autoforward.co
|
|
- bestcellphonespyapps.com
|
|
- buyeasyspy.com
|
|
- cellphoneservices.info
|
|
- ddiutilities.com
|
|
- dev.safeguarde.com
|
|
- digitalsecurityworld.com
|
|
- evt17.com
|
|
- highstermobile.co
|
|
- highstermobile.com
|
|
- ilfmobileapps.com
|
|
- m.surepointspy.com
|
|
- phonespector.com
|
|
- safeguarde.com
|
|
- surepointspy.com
|
|
- thepowerlinegroup.com
|
|
- turbophonepsy.com
|
|
- www.surepointspy.com
|
|
c2:
|
|
domains:
|
|
- a71f4.firebaseio.com
|
|
- ac480.firebaseio.com
|
|
- auto-forward.com
|
|
- autoforward-8433d.firebaseio.com
|
|
- backup-a71f4.firebaseio.com
|
|
- cellphoneservices.info
|
|
- ddiutilities.com
|
|
- device-ac480.appspot.com
|
|
- device-ac480.firebaseio.com
|
|
- evt17.com
|
|
- ngc77.com
|
|
- phonespector-b2f13.firebaseio.com
|
|
- phonespector.com
|
|
|
|
- name: iMonitorSpy
|
|
names:
|
|
- iMonitorSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.imonitor.ainfo
|
|
- inc.imonitor
|
|
certificates:
|
|
- 3EA68714AE224B0C0EEED64A14B11D3983C3D6F8
|
|
- BFC4C15E35E3506095B42E2B428E4016B1FFA1AB
|
|
- 5C5EF3DFE98B02251A6EC82609F22A092562AFEE
|
|
websites:
|
|
- www.imonitorsoft.cn
|
|
- www.imonitorsoft.com
|
|
- imonitorsoft.cn
|
|
c2:
|
|
domains:
|
|
- imonitor-da8b2.firebaseio.com
|
|
- imonitorke.com
|
|
- www.imonitorsoft.cn
|
|
- www.imonitorsoft.com
|
|
- imonitorsoft.cn
|
|
- imonitorsoft.com
|
|
|
|
- name: MobileTool
|
|
names:
|
|
- MobileTool
|
|
- MobTool
|
|
- Jopsik
|
|
type: stalkerware
|
|
packages:
|
|
- org.poleward.burghs.hydrotherapy.homonymously
|
|
- org.urates.amirates.suffocate.chiliast
|
|
- org.connecting.updived.hygeist.interplays
|
|
certificates:
|
|
- 3E9B3E5190F64BA9A952B7F57942AA21FFDA50BA
|
|
- 7F11358AC560C5E90B735A21B907F1C8143353DF
|
|
websites:
|
|
- mobiletool.ru
|
|
- www.mobiletool.ru
|
|
- mtoolapp.net
|
|
- www.mtoolapp.net
|
|
- mtoolapp.biz
|
|
c2:
|
|
domains:
|
|
- 6kvses.com
|
|
- bincdi.6kvses.com
|
|
- bincdi.birxpk.com
|
|
- birxpk.com
|
|
- dz7.wethnc067.xyz
|
|
- hzdy.birxpk.com
|
|
- ixhtb.s9gxw8.com
|
|
- kvshdi.birxpk.com
|
|
- mobiletool.ru
|
|
- mrswd.wo87sf.com
|
|
- mtoolapp.net
|
|
- mtoolapp.biz
|
|
- my.mobiletool.ru
|
|
- my.mtoolapp.net
|
|
- mzpgfh.uhabq9.com
|
|
- noujx.s9gxw8.com
|
|
- s9gxw8.com
|
|
- support.mtoolapp.biz
|
|
- ug1c5v.birxpk.com
|
|
- wethnc067.xyz
|
|
- www.mtoolapp.net
|
|
- xmyevq.birxpk.com
|
|
|
|
- name: ShadowSpy
|
|
names:
|
|
- ShadowSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.runaki.synclogs
|
|
- com.client.requestlogs
|
|
- com.shadow.client.android
|
|
certificates:
|
|
- FE7626A8D3C38FD78EA2A729B39B943BA814F014
|
|
- 01E49C220A9776D4978C1D28D6C32F86D145B8AE
|
|
- AD231A7CD57E2CEF8162F4D341C3573DE2B8F443
|
|
websites:
|
|
- shadow-logs.com
|
|
- shadow-spy.com
|
|
- www.shadow-logs.com
|
|
- www.shadow-spy.com
|
|
distribution:
|
|
- downloads.shadow-spy.com
|
|
c2:
|
|
domains:
|
|
- runaki-support.appspot.com
|
|
- shadow-logs.com
|
|
- shadow-spy.com
|
|
- shadowappbundle-default-rtdb.firebaseio.com
|
|
- shadowlogspanel.firebaseio.com
|
|
- www.shadow-logs.com
|
|
|
|
- name: SpyHuman
|
|
names:
|
|
- SpyHuman
|
|
type: stalkerware
|
|
packages:
|
|
- com.cldprotect
|
|
- m.mobile.control
|
|
- com.saxfamqvxj
|
|
- com.safesecureservice
|
|
- com.myappspqwddeexo
|
|
- com.yurpdpvxnybmlgh
|
|
- com.spyhumanrev
|
|
certificates:
|
|
- 76F6C302533751BED738D40882AC219BAAD65E7B
|
|
- F9265164219A1C5DEE4A76D66BEA0C35A1FD6032
|
|
- 597C0169D8C27DE7C6B62C2C252F9ECAC0E562C4
|
|
- E2AC495C52B9FBD49B83CFAE0C167878A2F796A5
|
|
- E169250B134E5C46C3064F166E457CDBFCC16524
|
|
- C270531A6D75EB4EA2AA0F4D6DF2980AFB494CB3
|
|
websites:
|
|
- spyhuman.com
|
|
- services.spyhuman.com
|
|
c2:
|
|
ips:
|
|
- 213.239.228.196
|
|
domains:
|
|
- apispyhuman.com
|
|
- aps22.spyhuman.com
|
|
- aps12.spyhuman.com
|
|
- aps13.spyhuman.com
|
|
- aps14.spyhuman.com
|
|
- aps15.spyhuman.com
|
|
- aps16.spyhuman.com
|
|
- aps17.spyhuman.com
|
|
- aps16042016.spyhuman.com
|
|
- aps18data.securebackuponline.net
|
|
- aps18file.securebackuponline.net
|
|
- aps2.spyhuman.com
|
|
- nodejs.spyhuman.com
|
|
- securebackuponline.net
|
|
- sp18022019.firebaseio.com
|
|
- spyhuman-97943.firebaseio.com
|
|
- spyhuman.com
|
|
|
|
- name: uMobix
|
|
names:
|
|
- uMobix
|
|
type: stalkerware
|
|
packages:
|
|
- com.tuner.funnelwebview
|
|
- com.system.user
|
|
- com.play.services
|
|
certificates:
|
|
- 575F8E8A04A5967E78BC5B5A3E31FDACF42F4FB1
|
|
- 6696449AA96EBA57CDF4707F0F84274958BE4523
|
|
- F4E6DA34F0071AEB70010EBB69875E5212D69140
|
|
websites:
|
|
- umobix.com
|
|
- n.umobix.com
|
|
- tt.umobix.com
|
|
- spyfer.info
|
|
- surveillance-enfants.com
|
|
c2:
|
|
domains:
|
|
- android-api.umobix.com
|
|
- us.umobix.com
|
|
|
|
- name: Spymie
|
|
names:
|
|
- Spymie
|
|
type: stalkerware
|
|
packages:
|
|
- com.ant.spymie.keylogger
|
|
certificates:
|
|
- 05B23C7E9156A4C55768DA27936FF2D7AF09BB8F
|
|
|
|
- name: TheOneSpy
|
|
names:
|
|
- TheOneSpy
|
|
- OgyMogy
|
|
type: stalkerware
|
|
certificates:
|
|
- D46492F02F25877E9F5D6CFFA4CE99DAC64D981A
|
|
- 9DE8D6C6757152EC819C1A09F5665B77F72493A2
|
|
- B6D2D36C75931CCA18538B79C5DE3A04EF4AF777
|
|
packages:
|
|
- com.android.services
|
|
- com.android.omg
|
|
distribution:
|
|
- app.ogymogy.com
|
|
- tos-assigned-build.sfo2.digitaloceanspaces.com
|
|
websites:
|
|
- theonespy.com
|
|
- ogymogy.com
|
|
- www.theonespy.com
|
|
c2:
|
|
ips:
|
|
- 85.13.218.229
|
|
- 85.13.206.195
|
|
domains:
|
|
- api.ogymogy.com
|
|
- lb.theonespy.com
|
|
- im.theonespy.com
|
|
- node-api.theonespy.com
|
|
- node1.theonespy.com
|
|
- node2.theonespy.com
|
|
- node3.theonespy.com
|
|
- node4.theonespy.com
|
|
- node5.theonespy.com
|
|
- ogymoggy.firebaseio.com
|
|
|
|
- name: ClevGuard
|
|
names:
|
|
- ClevGuard
|
|
- KidsGuard
|
|
type: stalkerware
|
|
packages:
|
|
- com.kids.pro
|
|
- com.kids.whatsapp
|
|
certificates:
|
|
- CCE55D4C3E844E8A7542036D40BFBB4AA98B89D7
|
|
- E48C6714DBFD2AB6E5CF85C87EFD05BD8E11E6FB
|
|
websites:
|
|
- clevguard.net
|
|
- www.clevguard.com
|
|
- clevguard.com
|
|
- panel.clevguard.com
|
|
c2:
|
|
ips:
|
|
- 47.88.63.70
|
|
domains:
|
|
- api.clevguard.com
|
|
- kidsguard-6c6a9.firebaseio.com
|
|
- clevguard.net
|
|
|
|
- name: EasyPhoneTrack
|
|
names:
|
|
- EasyPhoneTrack
|
|
- Ppapp
|
|
type: stalkerware
|
|
packages:
|
|
- com.spappm_mondow.alarm
|
|
- com.monspap.alarm
|
|
- com.snapchat.trmonap
|
|
- com.snapch.monabcab
|
|
certificates:
|
|
- 4A3742E0C96AFB91954D613AAA637076750E5A0B
|
|
- FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037
|
|
- 892C4F172AD3262EC398B40BBF8130C6421040A1
|
|
websites:
|
|
- spappmonitoring.com
|
|
- www.spappmonitoring.com
|
|
- mobil-kem.com
|
|
- easyphonetrack.com
|
|
c2:
|
|
ips:
|
|
- 50.28.38.175
|
|
domains:
|
|
- cell-phones-tracker.net
|
|
- celltracker.mobi
|
|
- easyphonetrack.com
|
|
- phonetrack.com
|
|
- spy-datacenter.com
|
|
- studio11-7e288.firebaseio.com
|
|
- trackmy.mobi
|
|
- www.spy-datacenter.com
|
|
|
|
- name: bark
|
|
names:
|
|
- bark
|
|
type: stalkerware
|
|
packages:
|
|
- com.pt.bark
|
|
certificates:
|
|
- 473F919A69BBAD3457AF2F0E3AFC34E513F103F1
|
|
websites:
|
|
- bark.us
|
|
- www.bark.us
|
|
c2:
|
|
domains:
|
|
- bark-android-media.s3.amazonaws.com
|
|
- www.bark.us
|
|
|
|
- name: SpyLive360
|
|
names:
|
|
- SpyLive360
|
|
type: stalkerware
|
|
packages:
|
|
- com.sl360
|
|
- com.itqredn8dzrl
|
|
- com.wifi0
|
|
- com.w0f0
|
|
- com.w1f1
|
|
certificates:
|
|
- 73BF44A503427F7682C7136B109631E3BE4114DE
|
|
- 630BB83172B184A6571126229E2B2DCA2EB4123F
|
|
websites:
|
|
- spylive360.com
|
|
- www.spylive360.com
|
|
c2:
|
|
domains:
|
|
- s1.spylive360.com
|
|
- s2.spylive360.com
|
|
- s3.spylive360.com
|
|
- spylive360.com
|
|
- sl360-7ba65.firebaseio.com
|
|
|
|
- name: XNSpy
|
|
names:
|
|
- XNSpy
|
|
- ZTI
|
|
- SpyXiz4
|
|
- SpyXiz4Me
|
|
- TrackMyPhone
|
|
type: stalkerware
|
|
packages:
|
|
- com.system.task
|
|
- com.map.system
|
|
- com.xnspy.dashboard
|
|
certificates:
|
|
- C276C3B087207C9D3CEEDA766C01E0BDEF7EAC71
|
|
websites:
|
|
- xnspy.com
|
|
- cp.xnspy.com
|
|
c2:
|
|
domains:
|
|
- xnspy.com
|
|
- sync.xiz4me.com
|
|
- alert.xiz4me.com
|
|
- www.mydwnd.com
|
|
- mydwnd.com
|
|
- brilliant-flame-585.firebaseio.com
|
|
- true-truck-86810.firebaseio.com
|
|
- sync.bk128.com
|
|
- asset.bk128.com
|
|
- alert.bk128.com
|
|
- bk128.com
|
|
- wppspy.tech
|
|
|
|
- name: MobiSpy
|
|
names:
|
|
- MobiSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.psac.a.processservice
|
|
certificates:
|
|
- B5075AB201EE483C8ECADE1BC4FC711293D6932B
|
|
websites:
|
|
- mobispy.net
|
|
c2:
|
|
domains:
|
|
- my.mobispy.net
|
|
|
|
- name: NeoSpy
|
|
names:
|
|
- NeoSpy
|
|
type: stalkerware
|
|
packages:
|
|
- ns.antapp.module
|
|
- com.nsmon.guard
|
|
certificates:
|
|
- 9ED8DD944D3EB545E1EEEEEC1D8174772CF37C07
|
|
websites:
|
|
- neospy.pro
|
|
- neospy.net
|
|
- neospy.tech
|
|
- ru.neospy.net
|
|
c2:
|
|
domains:
|
|
- i6.clientreport.info
|
|
- i7.clientreport.info
|
|
- i8.clientreport.info
|
|
- i9.clientreport.info
|
|
- i10.clientreport.info
|
|
- i11.clientreport.info
|
|
- i12.clientreport.info
|
|
- i13.clientreport.info
|
|
- clientreport.info
|
|
|
|
- name: AllTracker
|
|
names:
|
|
- AllTracker
|
|
- Russcity
|
|
type: stalkerware
|
|
packages:
|
|
- city.russ.alltrackercorp
|
|
- city.russ.alltrackerfamily
|
|
- city.russ.alltrackerinstaller
|
|
- org.alltracker.security
|
|
certificates:
|
|
- 219D2D7FEC2B2DA6E25693A75FC15D2C6F4F6E67
|
|
- 43D45CE7BEE36E449434C14973B7D285209414C7
|
|
- 6C4E74FD002AEC131F8D05852566055C349E0A54
|
|
- B6A744B0E8AE049AC0C20402EBC137B1192699A9
|
|
- F1912CEE4B5D6C1EA4070B53B440E2F660FFCBBD
|
|
- F7871F09D6E58B9BEA5913FB2FA879E5427725E3
|
|
- 6EF8C27EBCF808FFA377A391DB9892B997AF16C9
|
|
websites:
|
|
- alltracker.org
|
|
c2:
|
|
domains:
|
|
- 4-dot-all-tracker.appspot.com
|
|
- 6-dot-all-tracker.appspot.com
|
|
- all-tracker.appspot.com
|
|
- all-tracker.firebaseio.com
|
|
- alltracker.org
|
|
- staging-all-tracker.appspot.com
|
|
|
|
- name: SpyPhoneApp
|
|
names:
|
|
- SpyPhoneApp
|
|
type: stalkerware
|
|
packages:
|
|
- com.spappm_mondow.alarm
|
|
- com.spapptrakapp.alarm
|
|
- com.spatrakappp.alarm
|
|
certificates:
|
|
- 8C017FDB2A81807EC879A8E30F4AB05D5CA02034
|
|
- 9477420001BC79500623374EC586B054AAC97BF9
|
|
- 26AF8554EE338D6969FAC51BF4DAC3186098056E
|
|
c2:
|
|
domains:
|
|
- www.spy-phone-app.com
|
|
- www.spappmonitoring.com
|
|
- mobil-kem.com
|
|
- www.app-spy.com
|
|
|
|
- name: AndroidMonitor
|
|
names:
|
|
- AndroidMonitor
|
|
- UltimatePhoneSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.ibm.fb
|
|
certificates:
|
|
- 92EBDB7D7C18A34705A6918B5F327DDB0E8C8452
|
|
- 558765849658A3821FE4054ED2C1FF6E28B4B8A0
|
|
websites:
|
|
- androidmonitor.com
|
|
- demo.ultimatephonespy.com
|
|
- ultimatephonespy.com
|
|
- www.androidmonitor.com
|
|
- my.androidmonitor.com
|
|
distribution:
|
|
- installam.com
|
|
c2:
|
|
ips:
|
|
- 178.33.203.110
|
|
domains:
|
|
- server.androidmonitor.com
|
|
|
|
- name: TalkLog
|
|
names:
|
|
- TalkLog
|
|
type: stalkerware
|
|
packages:
|
|
- tech.logsettings
|
|
- t.tools.app
|
|
- technic.settings
|
|
certificates:
|
|
- 08ACB92D02487EBC0CEA42B672A631BA7EA59ADF
|
|
- AF821DD021558AEDF49730D2892063BD502DEA14
|
|
websites:
|
|
- talklog.tools
|
|
c2:
|
|
ips:
|
|
- 78.46.34.14
|
|
domains:
|
|
- talklog.tools
|
|
- tchsrvce.com
|
|
|
|
- name: SpyMasterPro
|
|
names:
|
|
- SpyMasterPro
|
|
type: stalkerware
|
|
packages:
|
|
- iqual.calculadora.pro
|
|
- com.semantic.childcontrol
|
|
certificates:
|
|
- 8AD595A53B76014B7B919ED231DB372096D358E7
|
|
- C8BAE63357CA1DCD9B084BCC99399C96A5B67D49
|
|
- 9B07A93BC509C0AE614AEAFFCD6B56797CD02166
|
|
websites:
|
|
- spymasterpro.com
|
|
- www.spymasterpro.com
|
|
c2:
|
|
ips:
|
|
- 91.121.70.22
|
|
domains:
|
|
- cpcalendars.spymasterpro.com
|
|
- cpcontacts.spymasterpro.com
|
|
- imobispy.com
|
|
- senseye.spymasterpro.com
|
|
- spymaster-e535b.firebaseio.com
|
|
|
|
- name: FreeAndroidSpy
|
|
names:
|
|
- FreeAndroidSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.hp.vd
|
|
- com.hp.vc
|
|
certificates:
|
|
- E0103BF20E95E826920A3F0F7B3BD03A899127D7
|
|
websites:
|
|
- freeandroidspy.com
|
|
c2:
|
|
ips:
|
|
- 46.40.125.240
|
|
- 199.38.181.70
|
|
- 217.182.176.52
|
|
domains:
|
|
- server.freeandroidspy.com
|
|
- spysetup.com
|
|
|
|
- name: NetSpy
|
|
names:
|
|
- NetSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.googleplay.settings
|
|
certificates:
|
|
- A4E169AAF0068A1FC5F7900B7F59A438B833364C
|
|
websites:
|
|
- www.netspy.net
|
|
- netspy.net
|
|
c2:
|
|
domains:
|
|
- netspy-7b8ec.firebaseio.com
|
|
|
|
- name: Spyier
|
|
names:
|
|
- Spyier
|
|
type: stalkerware
|
|
packages:
|
|
- com.sc.spyier.v2
|
|
websites:
|
|
- spyier.com
|
|
c2:
|
|
domains:
|
|
- i.spyier.com
|
|
- v4vw4ytvo4.execute-api.us-east-2.amazonaws.com
|
|
|
|
- name: CouplerTracker
|
|
names:
|
|
- CouplerTracker
|
|
type: stalkerware
|
|
packages:
|
|
- com.bettertomorrowapps.spyyourlovefree
|
|
- com.bytepioneers.coupletracker
|
|
certificates:
|
|
- 18CD402CC43DF0BC03E9951B0F843DC4B1552DC6
|
|
- BC53CC2A9996DE47BF72348F2A592DC0EBDAF06B
|
|
websites:
|
|
- coupletracker.com
|
|
c2:
|
|
domains:
|
|
- api.bytepioner.com
|
|
|
|
- name: GPSTrackerLoki
|
|
names:
|
|
- GPSTrackerLoki
|
|
type: stalkerware
|
|
packages:
|
|
- com.mobile.loki
|
|
- com.mobile.asgard
|
|
certificates:
|
|
- 6156DB551938BB4560D4643B54527E4F169ED44F
|
|
websites:
|
|
- asgardtech.ru
|
|
c2:
|
|
domains:
|
|
- asgard-f8c53.firebaseio.com
|
|
- m.asgardtech.ru
|
|
|
|
- name: SpyApp247
|
|
names:
|
|
- SpyApp247
|
|
type: stalkerware
|
|
packages:
|
|
- com.spyapp247.system
|
|
|
|
- name: SpyMug
|
|
names:
|
|
- SpyMug
|
|
type: stalkerware
|
|
packages:
|
|
- com.service.mug
|
|
certificates:
|
|
- 56C8FA19250EDBA1A91A37F500DA91FBC0657B1F
|
|
|
|
- name: WtSpy
|
|
names:
|
|
- WtSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.wwtspy
|
|
- com.wtspy.apps
|
|
certificates:
|
|
- BB5E2C0E8DFDC54730C1E9B48754977E7DBCCCF9
|
|
websites:
|
|
- wt-spy.com
|
|
|
|
- name: Xnore
|
|
names:
|
|
- Xnore
|
|
type: stalkerware
|
|
packages:
|
|
- com.xno.systemservice
|
|
certificates:
|
|
- 9BCE25527FF174A4AD6CDE233B17038641A5EEF9
|
|
websites:
|
|
- xnore.com
|
|
c2:
|
|
ips:
|
|
- 162.144.212.52
|
|
domains:
|
|
- spyapp.top
|
|
- xnore.com
|
|
|
|
- name: EspiaoAndroid
|
|
names:
|
|
- EspiaoAndroid
|
|
- FoxSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.kfhdha.fkjfgjdi
|
|
certificates:
|
|
- 60DA6A5B04C0100DFCE1213C850EFBDEB0D1E8D7
|
|
websites:
|
|
- foxspy.com.br
|
|
c2:
|
|
domains:
|
|
- aovivo.foxspy.com.br
|
|
- api007.foxspy.com.br
|
|
- pc.foxspy.com.br
|
|
- celular007.s3.amazonaws.com
|
|
- remoto.foxspy.com.br
|
|
|
|
- name: pcTattletale
|
|
names:
|
|
- pcTattletale
|
|
type: stalkerware
|
|
packages:
|
|
- com.avi.scbase
|
|
certificates:
|
|
- 20F092BEC76C406223A7943371A1DBBB5BF66C13
|
|
- 934A3C0DC8912C4F2F8620F666FC7621BD7B97B8
|
|
websites:
|
|
- www.pctattletale.com
|
|
c2:
|
|
ips:
|
|
- 67.227.193.142
|
|
domains:
|
|
- pctattletalev2.s3.amazonaws.com
|
|
- pctattletale.com
|
|
- truewebmedia.com
|
|
|
|
- name: SpyEra
|
|
names:
|
|
- SpyEra
|
|
type: stalkerware
|
|
packages:
|
|
- com.wSpyEra
|
|
certificates:
|
|
- 813A3AD37D87AA36120DFEC64146C311DB5F4CA9
|
|
websites:
|
|
- spyera.com
|
|
- login.spylogs.com
|
|
- support.spyera.com
|
|
- affiliate.spyera.com
|
|
c2:
|
|
domains:
|
|
- spylogs.com
|
|
- spyera.postaffiliatepro.com
|
|
|
|
- name: AntiFurtoDroid
|
|
names:
|
|
- AntiFurtoDroid
|
|
type: stalkerware
|
|
packages:
|
|
- br.com.maceda.android.antifurtow
|
|
certificates:
|
|
- CE94B8512390676F62F3EC61BECEDDDE9AB5519F
|
|
websites:
|
|
- antifurtodroid.com
|
|
c2:
|
|
domains:
|
|
- app.antifurtodroid.com
|
|
|
|
- name: CallSMSTracker
|
|
names:
|
|
- CallSMSTracker
|
|
- Quizmo
|
|
- Multiverze
|
|
- HiddenSMSTracker
|
|
type: stalkerware
|
|
packages:
|
|
- com.gcm_call_sms_tracker.updated
|
|
- com.gizmoquip.smstracker
|
|
certificates:
|
|
- 0C01AEB7346C700D02613EBA513BD40E87A182F8
|
|
- 8F576BEEB71EA74E5F27764917BFF5B508017B68
|
|
websites:
|
|
- callsmstracker.com
|
|
- hiddensmstracker.com
|
|
- hiddensystemhealth.com
|
|
- registrations.smstracker.com
|
|
- smstracker.com
|
|
- smstrackerweb.com
|
|
- www.hiddensmstracker.com
|
|
- www.hiddensystemhealth.com
|
|
- www.smstrackerweb.com
|
|
c2:
|
|
ips:
|
|
- 45.40.135.228
|
|
domains:
|
|
- beta.smstracker.com
|
|
- messages01.smstracker.com
|
|
- messages02.smstracker.com
|
|
- staging.smstracker.com
|
|
|
|
- name: AiSpyer
|
|
names:
|
|
- AiSpyer
|
|
type: stalkerware
|
|
packages:
|
|
- com.aif.tracksp
|
|
certificates:
|
|
- F038CD90AFEA9C037A801FFAE67DF55A870879C4
|
|
- BCA2BCB87F6E28FB403CED643311B135CA0DC0A2
|
|
websites:
|
|
- aivideoedit.com
|
|
- aispyer.com
|
|
- www.aispyer.com
|
|
c2:
|
|
domains:
|
|
- ioi.life
|
|
- api.corn-cob.com
|
|
- corn-cob.com
|
|
- d.corn-cob.com
|
|
- tracksp.in
|
|
- my.aispyer.com
|
|
- tracksp-7743c.firebaseio.com
|
|
- www.ioi.life
|
|
|
|
- name: SpyToApp
|
|
names:
|
|
- SpyToApp
|
|
type: stalkerware
|
|
packages:
|
|
- com.spytoapp.system
|
|
certificates:
|
|
- 6F93929AB60AC760000E873CD7C56BA79A9E6CAD
|
|
websites:
|
|
- spytoapp.com
|
|
c2:
|
|
domains:
|
|
- android.spytoapp.com
|
|
- apk01.spytoapp.com
|
|
- apk02.spytoapp.com
|
|
- apk03.spytoapp.com
|
|
- apk04.spytoapp.com
|
|
- downapk.spytoapp.com
|
|
- services.spytoapp.com
|
|
|
|
- name: BlurSpy
|
|
names:
|
|
- BlurSpy
|
|
- XOXOSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.saloomughal.spyapp
|
|
certificates:
|
|
- 4CACA12EB37B7A7F07AE380C7E1741D2C36531DF
|
|
websites:
|
|
- www.blurspy.com
|
|
- blurspy.com
|
|
- xoxospy.com
|
|
c2:
|
|
domains:
|
|
- spyapp-8916f.firebaseio.com
|
|
- blurspy.com
|
|
- 8916f.appspot.com
|
|
|
|
- name: AppMia
|
|
names:
|
|
- AppMia
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.system.devicelogs
|
|
certificates:
|
|
- C51C36FE4F1DFC0C5B8CD55F74773135C1C1E1E5
|
|
websites:
|
|
- appmia.com
|
|
- appmia.com.es
|
|
- appmia.it
|
|
- appmia.fr
|
|
- cp.appmia.com
|
|
c2:
|
|
domains:
|
|
- tr.appmia.com
|
|
|
|
- name: SecretCamRecorder
|
|
names:
|
|
- SecretCamRecorder
|
|
type: stalkerware
|
|
packages:
|
|
- com.tools.secretcamcorder
|
|
|
|
- name: Unisafe
|
|
names:
|
|
- Unisafe
|
|
type: stalkerware
|
|
packages:
|
|
- ru.usafe.u_safe
|
|
- ru.usafe.usafe
|
|
- ru.usafe.kid.unisafekids
|
|
- su.unisafe.unisafe
|
|
certificates:
|
|
- 20AB40ACC2822A34EC199622CDCA9D7A63BB302B
|
|
- 41862C48D4BBC2A83DB3CE6EBA0D0C53E3D882B6
|
|
- A519EF2B8C4E73A097065B322687C9D38DED610C
|
|
- B5895930053256D408DE74B66BA132B73CB21527
|
|
- FCB6F780EA8F2FE7249F66C6348572BDBD54F576
|
|
websites:
|
|
- usafe.ru
|
|
- unisafe.su
|
|
- unisafe.techmas.ru
|
|
c2:
|
|
domains:
|
|
- a342f.appspot.com
|
|
- unisafe-a342f.firebaseio.com
|
|
- usafe-ca594.firebaseio.com
|
|
- usafe.ru
|
|
|
|
- name: TrackView
|
|
names:
|
|
- TrackView
|
|
- LifeCircle
|
|
type: stalkerware
|
|
packages:
|
|
- app.cybrook.trackvieo
|
|
- app.cybrook.trackviep
|
|
- app.cybrook.trackvieq
|
|
- app.cybrook.trackvier
|
|
- app.cybrook.trackvies
|
|
- app.cybrook.trackviet
|
|
- app.cybrook.trackvieu
|
|
- app.cybrook.trackviev
|
|
- app.cybrook.trackview
|
|
- app.cybrook.trackviex
|
|
- app.cybrook.trackviey
|
|
- app.cybrook.trackviez
|
|
- app.cybrook.trustserv
|
|
- app.lifecircle
|
|
- app.trackview
|
|
- app.trackview.pro
|
|
- cn.trackview.shentan
|
|
- com.trackview
|
|
- cybrook.trackview
|
|
- net.cybrook.trackvieo
|
|
- net.cybrook.trackviep
|
|
- net.cybrook.trackvieq
|
|
- net.cybrook.trackvier
|
|
- net.cybrook.trackvies
|
|
- net.cybrook.trackviet
|
|
- net.cybrook.trackvieu
|
|
- net.cybrook.trackviev
|
|
- net.cybrook.trackview
|
|
- net.cybrook.trackviex
|
|
- net.cybrook.trackviey
|
|
- net.cybrook.trackviez
|
|
- net.cybrook.trustserv
|
|
- net.homesafe
|
|
- net.trackview
|
|
- net.trackview.pro
|
|
- tv.familynk
|
|
- tv.familynl
|
|
- us.trackview
|
|
certificates:
|
|
- CB97E71AFA4665D6D28697B9197046C81E5E5D6C
|
|
- B14E50E56D5D483031137FD247D4A5466D0E61B4
|
|
- 96A1F635F940D8D154FD42D550B6201B60692744
|
|
websites:
|
|
- chome.zstone.co
|
|
- lifecircle.app
|
|
- trackview.net
|
|
- trackview.recurly.com
|
|
c2:
|
|
domains:
|
|
- analytics.trackview.net
|
|
- api-project-285519687053.firebaseio.com
|
|
- api.lifecircle.app
|
|
- api.trackview.lifecircle.app
|
|
- cnapi.trackview.net
|
|
- lifecircle-223805.firebaseio.com
|
|
- m.lifecircle.app
|
|
- rc-api.lifecircle.app
|
|
- trackview.net
|
|
- us-central1-api-project-285519687053.cloudfunctions.net
|
|
- user.trackview.net
|
|
- user2.trackview.net
|
|
- relay1.trackview.net
|
|
|
|
- name: TrackingSmartphone
|
|
names:
|
|
- XZBO
|
|
- TrackSmart
|
|
- TrackingSmart
|
|
type: stalkerware
|
|
packages:
|
|
- com.tracking_smartphone
|
|
- com.app.remote_control
|
|
- com.ts_settings
|
|
certificates:
|
|
- 1DB0D66C1D21DD4B185D03B13D6CF620E4FACBAA
|
|
- 603881E46350999FF7A5CBD68FE6A5897C50CEDE
|
|
- 665D624FD53E4D538DFE9F7A87087C513CB40506
|
|
- 86D94A8CE736F82D834FA588F34106AE7B69D325
|
|
websites:
|
|
- trackingsmartphone.com
|
|
- www.trackingsmartphone.com
|
|
- onlinefundb.com
|
|
c2:
|
|
domains:
|
|
- trackingsmartphone.com
|
|
- onlinefundb.com
|
|
- tracking-smartphone.firebaseio.com
|
|
|
|
- name: SpyphoneMobileTracker
|
|
names:
|
|
- SpyphoneMobileTracker
|
|
type: stalkerware
|
|
packages:
|
|
- com.phonetrackerofficial
|
|
- com.phonetrackerofficial1
|
|
certificates:
|
|
- 5F61BEB9591ADBDF9DA5B141A1EF35CDC0944C8C
|
|
websites:
|
|
- phonetracker.com
|
|
- www.phonetracker.com
|
|
- spyfone.com
|
|
- spyphone.com
|
|
- www.spyphone.com
|
|
- spy-phone-app.com
|
|
c2:
|
|
domains:
|
|
- phonetracker.com
|
|
- phonetracker95gpsonly.firebaseio.com
|
|
|
|
- name: OneLocator
|
|
names:
|
|
- PhoneTrackerByNumber
|
|
- FamilyLocator
|
|
type: stalkerware
|
|
packages:
|
|
- mg.locations.track5
|
|
certificates:
|
|
- E43B5671CBA3F48619BF00D6E380BBC2F02A5DCA
|
|
websites:
|
|
- locatorprivacy.com
|
|
- onelocator.com
|
|
c2:
|
|
domains:
|
|
- locatorprivacy.com
|
|
|
|
- name: EvaSpy
|
|
names:
|
|
- Spyrix
|
|
type: stalkerware
|
|
websites:
|
|
- evaspy.com
|
|
- login.evaspy.com
|
|
- www.spyrix.com
|
|
- spyrix.com
|
|
c2:
|
|
domains:
|
|
- ua.evaspy.com
|
|
- ub.evaspy.com
|
|
- uc.evaspy.com
|
|
- ud.evaspy.com
|
|
- ue.evaspy.com
|
|
- uf.evaspy.com
|
|
- ug.evaspy.com
|
|
- uh.evaspy.com
|
|
- ui.evaspy.com
|
|
- uj.evaspy.com
|
|
- uk.evaspy.com
|
|
- ul.evaspy.com
|
|
- um.evaspy.com
|
|
- un.evaspy.com
|
|
- uo.evaspy.com
|
|
- up.evaspy.com
|
|
- uq.evaspy.com
|
|
- ur.evaspy.com
|
|
distribution:
|
|
- shuch6ba0w.spyrixweb.com
|
|
- sxde-download.spyrix-sfk.com
|
|
- spyrix-sfk.com
|
|
|
|
- name: RealtimeSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.realtime.spyapp
|
|
certificates:
|
|
- 8CD8FB235EA7F9B0FC308C1A59AB561C3869878C
|
|
websites:
|
|
- www.spytech-web.com
|
|
- spytech-web.com
|
|
- realtime-spy-mobile.com
|
|
- www.realtime-spy-mobile.com
|
|
c2:
|
|
ips:
|
|
- 184.154.69.210
|
|
domains:
|
|
- realtime-spy-mobile.com
|
|
|
|
- name : jjspy
|
|
names:
|
|
- ttspy
|
|
type: stalkerware
|
|
packages:
|
|
- com.backup.tt
|
|
websites:
|
|
- www.jjspy.com
|
|
- www.ttspy.com
|
|
certificates:
|
|
- 002DD372C94E80600C7C60192CBD701A3C3B87EE
|
|
- 4AF16661FC885F7CC84358CCB8F272308436D5E3
|
|
- 6DFB725019C7784B400D940DAAEDAED18C5B898B
|
|
- D3E6A092741CBA59BE9308FBA72DF887EAB184FD
|
|
- D8418B279414687729D37B34E53AB75D502B9F73
|
|
- EE35E2740576480486307C991C762A3FBA8DA46D
|
|
- B8FCBCA563B1CD0E79CAC595002422C2E54072B7
|
|
- CF627144481D3F1DCFBB6CF12291C540AE325FBE
|
|
- 34B791B5D35A874D189202EEA1FA99188F58A4C1
|
|
- 933C19015525266982AC6D830CB6B3D25079777B
|
|
c2:
|
|
domains:
|
|
- api.ttspy.com
|
|
- cloud.ttspy.com
|
|
- jjspy.com
|
|
- jjspy.ml
|
|
- my.jjspy.com
|
|
- phone-backup-service.firebaseio.com
|
|
- rrspy.com
|
|
- rtc.ttspy.com
|
|
- service.n.weiguanai.cn
|
|
- service.weiguanai.cn
|
|
- ttjj.ga
|
|
- ttjj.tk
|
|
- ttjj.ml
|
|
- ttspy.com
|
|
- ttspy.net
|
|
- ttspy.top
|
|
- upload.weiguanai.cn
|
|
- ws.ttspy.com
|
|
- www.ttjj.tk
|
|
- wx.weiguanai.cn
|
|
|
|
- name : AndroidSpy
|
|
names:
|
|
- AndroSpy
|
|
- ASpy
|
|
type: stalkerware
|
|
packages:
|
|
- apk.screenshotrecorder
|
|
- apk.keylogger
|
|
- apk.kgl
|
|
- apk.kwoapsnde
|
|
- com.as.clipboardmanager
|
|
- com.as.facecapture
|
|
- com.as.gpstracker
|
|
- com.as.keylogger
|
|
- com.as.keylogger2
|
|
- com.as.klogger
|
|
- com.as.screenrecorder
|
|
- com.as.urllogger
|
|
websites:
|
|
- a-spy.com
|
|
- www.a-spy.com
|
|
certificates:
|
|
- 9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85
|
|
- AA0458B6C035E767E61DB7456CBCA89CC4D42090
|
|
- 56BD8EB8A20904E4766D99F6D38D87466C44B114
|
|
- 839FBBE6F3DF8153BB6582247DBBC2A42864A87D
|
|
- B7BB744C68FD6EB4C49298E7506BED53DC4773FF
|
|
- C863D800B89648724CD483911FBF756F36497CC9
|
|
- F57CACB890BE22907709DDE69ED3887F6943734E
|
|
c2:
|
|
domains:
|
|
- a-spy.com
|
|
- m.a-spy.com
|
|
- klg.a-spy.com
|
|
- my.a-spy.com
|
|
|
|
- name: AndroidPolice
|
|
names:
|
|
- MonitorChecker
|
|
- AndrMonitor
|
|
- AndroidMon
|
|
- Dromon
|
|
type: stalkerware
|
|
packages:
|
|
- afs.hbmoczc
|
|
- bv.vemzye
|
|
- com.amon
|
|
- com.monitorchecker
|
|
- fod.loqpf
|
|
- ifk.ghumlh
|
|
- mhu.bylbcwc
|
|
- oo.ptkqyawh
|
|
- sy.slvzccd
|
|
- vmf.uxytqgrl
|
|
- vn.ehkfqgvn
|
|
- yr.tubjypbl
|
|
- com.dromon
|
|
- kenkbltcf.pwpwkvdwmjk
|
|
- iiw.orqjtwbkx
|
|
- efexmsz.mzuooelftl
|
|
- fka.ugsonrqogw
|
|
certificates:
|
|
- 4591BD0E4CBE86FD7510F1427BA6538BB269AE4D
|
|
- 1CD94B411B5D4D2F5F525D775876FF0993B4B716
|
|
- 5C77395F77E17F293CC8C4E3E1FDD48296EE4B28
|
|
- 6A610D0211E543113EFE1A82CC4D270B6A45C526
|
|
- 6CC6FB667F4D178DF4E9111FE96BE9AEAEE485EF
|
|
- 85A4C4F357A99888725862C351119FBB12C45695
|
|
- 970B463F5103B36326AF8C8349A4106F6932835B
|
|
- B57FAAB701E26B4C92972442D3A428881E18441A
|
|
- E0FCD3E782FB859F7388E4F44A44A5D694114968
|
|
- EAD44242A3C0A73DEF7976C56AC10A4530E8F67A
|
|
- ED5BADBC20B1B027F5858D29DAFBF66535C46DB9
|
|
- 339B5C1746A1CDEA945D51BBE967C1320AE73CC4
|
|
- BEF28CC19ADFBEADC95137A2BD5035B6046666E9
|
|
- 16226330EBB138A5D47913151827A86567AD9CD4
|
|
- 3BA583488F36C708025C078D9EB4BEDC3918B098
|
|
- DDE822BAF53EF55C49096E866A995464CECB8B1C
|
|
- E6F85CAB3903304DC16197B7EDA8F67ED6D65A1A
|
|
websites:
|
|
- amon.android-monitor.ru
|
|
- amon1.android-monitor.ru
|
|
- andmon.name
|
|
- android-apk.android-monitor.ru
|
|
- android-monitor.ru
|
|
- android-monitor1.android-monitor.ru
|
|
- android-police.android-monitor.ru
|
|
- android-police.ru
|
|
- anmon.android-monitor.ru
|
|
- anmon.name
|
|
- anmon.ru
|
|
- anmon.su
|
|
- anmon1.android-monitor.ru
|
|
- droimon20.ru
|
|
- monitor-android.android-monitor.ru
|
|
- prog-money.android-monitor.ru
|
|
- prog-money.com
|
|
- www.android-monitor.ru
|
|
c2:
|
|
domains:
|
|
- amon.android-monitor.ru
|
|
- amon1.android-monitor.ru
|
|
- andmon.name
|
|
- android-apk.android-monitor.ru
|
|
- android-monitor1.android-monitor.ru
|
|
- android-police.android-monitor.ru
|
|
- android-police.ru
|
|
- anmon.android-monitor.ru
|
|
- anmon.name
|
|
- anmon.ru
|
|
- anmon.su
|
|
- anmon1.android-monitor.ru
|
|
- droimon20.ru
|
|
- monitor-android.android-monitor.ru
|
|
- prog-money.android-monitor.ru
|
|
- prog-money.com
|
|
- www.android-monitor.ru
|
|
- android-monitor.ru
|
|
|
|
- name : FindMyPhone
|
|
names:
|
|
- InMobi
|
|
type: stalkerware
|
|
packages:
|
|
- com.mango.findmyphone
|
|
- com.mango.findmyphone2
|
|
- com.mango.findmyphone3
|
|
websites:
|
|
- find-myphone.com
|
|
c2:
|
|
domains:
|
|
- find-my-phone-prod.herokuapp.com
|
|
- findmyphone.mangobird.com
|
|
|
|
- name : Bulgok
|
|
names:
|
|
- ControlPhone
|
|
type: stalkerware
|
|
packages:
|
|
- com.bulgakov.controlphone
|
|
- com.bulgakov.bug
|
|
- com.bul.b
|
|
websites:
|
|
- c-phone.ru
|
|
certificates:
|
|
- 71AD1F579C3DCF32AA1E00E02245D359F80C260B
|
|
- FD5E1BBC94E5609F366DD4816C975C1CF4003F40
|
|
- DBC4B607C3B07C48F40F9D184DE443D651436CA5
|
|
c2:
|
|
domains:
|
|
- c-phone.ru
|
|
- control-phone-a05a3.firebaseio.com
|
|
- q95294fs.beget.tech
|
|
|
|
- name : Tracku
|
|
names:
|
|
- Kurulum
|
|
- Bakuf
|
|
- Clues
|
|
- IZSpy
|
|
- IzKid
|
|
- ESpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.fystem.maps
|
|
- com.android.system.maps
|
|
- com.google.android.bacfup
|
|
- com.google.android.safe
|
|
- com.wzogle.zndroid.yacfup
|
|
- com.qzogle.xndroid.jacfup
|
|
- com.qzogle.xndroid.jacfut
|
|
- com.qzogle.android.jacfut
|
|
websites:
|
|
- 2mata.net
|
|
- clues4.com
|
|
- cluestr.com
|
|
- e-spy.org
|
|
- hike.in
|
|
- izkid.com
|
|
- www.e-spy.org
|
|
- www.izkid.com
|
|
certificates:
|
|
- 01EFA0C8FAE43215125ACA78308EFB1768FB4049
|
|
- 2A1C74FFFE33C7D867C7B284FFDBBA4DDD024450
|
|
- 5407E1CC26F28D6024E0384693045AEA2B24C5DA
|
|
- 7D0F4308B87223AEEFFA65060F0F752E84D363BE
|
|
- 9427212B33E9D3636970EAB73E2845E0DC59B5AA
|
|
- A9A302C9606AF4BE4468A4FC74F7873DDADA2AB0
|
|
- BD3986483D9B962B029D65BF34BF4B7C568FF204
|
|
- 4474D3395029E6C6744A470EE5F2107DBAEF16A0
|
|
- 6F1FDA1889463BFA646A950E49E121B7829A884D
|
|
- 5051413BB7C4931F5CD25260FFF173739CBE0F3A
|
|
- 4140120093B5655CF559B2A786269CF3F82E3AE9
|
|
- 7A55C057800823F710BF32A7D9865B300777E2D5
|
|
- FEEF07EA18BA2EF7B75AD311F45A45AB4C1E8F0E
|
|
distribution:
|
|
- e-spy.org
|
|
c2:
|
|
domains:
|
|
- apk7.biz
|
|
- clues.link
|
|
- clues4.com
|
|
- cluestr.com
|
|
- e-spy.app
|
|
- e-spy.org
|
|
- izapk.xyz
|
|
- izspy-1313.firebaseio.com
|
|
- msafe.xyz
|
|
- www.apk7.biz
|
|
- www.e-spy.org
|
|
- www.msafe.xyz
|
|
|
|
- name : KidsShield
|
|
names:
|
|
- TiSpy
|
|
- KidLogger
|
|
- MonitorMinor
|
|
- SelfSpy
|
|
- SpyTrac
|
|
- TelcadoAndroid
|
|
- TiFamily
|
|
- TracerSpy
|
|
- Triada
|
|
- VipTelefonProgrami
|
|
type: stalkerware
|
|
packages:
|
|
- com.protect
|
|
- com.aixlunro.uqfhkagb
|
|
- com.bzbqbkya.hgozttiu
|
|
- com.gzomoyig.qwgawtaz
|
|
- com.android.inputmethod.latinmy
|
|
- com.ntckdlhc.oifhnjwp
|
|
- com.selgdg.febgdsra
|
|
- com.selgdg.mardsdaf
|
|
- com.sepfsp.jasend
|
|
- com.bnahrrbc.kwexsnhl
|
|
- com.tbntxear.vfmkjxme
|
|
- com.fbhpdsej.gnuebduy
|
|
- com.uxgbipup.pdtvcgzc
|
|
- com.uzoifhzk.qmqnpwaf
|
|
- com.zkftwsel.fqnoquuv
|
|
- com.mnwkvijy.wzyxgrft
|
|
- net.kidlogger.kidlogger
|
|
- net.teslineservice.kidl5
|
|
- net.someapp1.somecorp2
|
|
- com.fhekpqbq.otlzonjx
|
|
websites:
|
|
- backupsoft.eu
|
|
- freespyapp.com
|
|
- kidlogger.net
|
|
- kidsshield.net
|
|
- monitorminor.com.tr
|
|
- pc.freespyapp.com
|
|
- pc.selfspy.com
|
|
- selfspy.com
|
|
- spytrac.com
|
|
- techinnovative.net
|
|
- tifamily.net
|
|
- tispy.net
|
|
- tracerspy.net
|
|
- ua.tispy.net
|
|
- viptelefonprogrami.com
|
|
- www.kidlogger.net
|
|
- www.selfspy.com
|
|
- ua.tispy.me
|
|
certificates:
|
|
- 0D025A887A1546585D9BBA6F023F42B8BE0274E1
|
|
- 1A6D10E15280C6A938EED9BEF53A31DA0CEBA45A
|
|
- 272CD0BC357FA03AF87940644CB8FFDECD2FDDC6
|
|
- 3397C095EAD93B13CC5B9979D1F3B4FAEF1D194C
|
|
- 35D1DB3904A84793394FE5DF7B678E263B1B33A0
|
|
- 5EF38D0143F601FD01AA39BFE9079E9927920208
|
|
- 6CA8C06D7DAC5F5685E014AE5C4D2062F77B42D6
|
|
- 789A24C1605F1BF2B6D64580C697BD38D9446A7E
|
|
- 8AE2267AEEA0DBFF7D7CC1C82E54343B1B0CFA22
|
|
- 8B187B3EBEF7D1BC8E32BEC78D36CBF95505A1C1
|
|
- 95D589A90971992A2038E5961B39C8B6BC77CF19
|
|
- A2EBDD14E2AE17F52363BCB751CCBE15BE5A2F8D
|
|
- AA4F85CD7C24116BB51FA733BE59290B7BB8C204
|
|
- F575CA9980D3075CF728F2081D9EC5F910CC17E8
|
|
- FD84821C80C1499A2446F6F7E13BF8BDA6A66402
|
|
- 77C411957F307F6B971C7C07825CA5EA06F0E36D
|
|
certificate_cname_re:
|
|
- ^Kids\WSafety\W[0-9]{2}-[0-9]{2}-[0-9]{2,4}\W[0-9]{2}:[0-9]{2}:[0-9]{2}$
|
|
certificate_organizations:
|
|
- Tesline-Service SRL
|
|
distribution:
|
|
- spyt.co
|
|
- kidsshield.net
|
|
c2:
|
|
ips:
|
|
- 52.22.130.9
|
|
domains:
|
|
- apprtc.appspot.com
|
|
- d.tispy.net
|
|
- freespyapp.com
|
|
- kidsshield.net
|
|
- login.quanly24h.net
|
|
- pc.backupsoft.eu
|
|
- pc.freespyapp.com
|
|
- pc.selfspy.com
|
|
- pc.viptelefonprogrami.com
|
|
- quanly24h.net
|
|
- spyt.co
|
|
- spytrac-app1.s3.amazonaws.com
|
|
- theodoi24h.com
|
|
- tispy.net
|
|
- ua.tispy.net
|
|
- viptelefonprogrami.com
|
|
|
|
- name : NemoSpy
|
|
names:
|
|
- Spyoo
|
|
type: stalkerware
|
|
websites:
|
|
- nemospy.com
|
|
- admin.nemospy.com
|
|
certificates:
|
|
- E871393054ED858ACB5854C0DB9F674C42160344
|
|
- C7FBC97C3BD3949A6C19FF332E6CF2F2E5CEE561
|
|
c2:
|
|
domains:
|
|
- nemospy.com
|
|
- setup.nemospy.com
|
|
|
|
- name : SpyKontrol
|
|
type: stalkerware
|
|
packages:
|
|
- com.ajygpxjy.bnthtjou
|
|
- com.udxlbuno.plwnnhop
|
|
- com.igyluazm.iytdhsky
|
|
websites:
|
|
- www.spykontrol.com
|
|
- spykontrol.com
|
|
- androidapk.biz
|
|
certificates:
|
|
- FB8F23C57D0AFD255FD255B290B2EF6DBB2EAFD8
|
|
- A36C70833A8A796F94CCD56B810D2A123F4F0485
|
|
- EA35FC50B3B0E0A9E5405BAC2D7E58D7F9559FD0
|
|
c2:
|
|
domains:
|
|
- pc.spykontrol.com
|
|
- androidapk.biz
|
|
|
|
- name : Trackplus
|
|
names:
|
|
- Gpspy
|
|
- S2mob
|
|
- Spy2Mobile
|
|
- SpyToMobile
|
|
- Spymob
|
|
- sap4mobile
|
|
- spy2mobile
|
|
type: stalkerware
|
|
packages:
|
|
- com.callhist.calltr
|
|
- com.catrsy.jaluc
|
|
- com.cellph.montrb
|
|
- com.dbzbpr.skt
|
|
- com.elpatr.woac
|
|
- com.ernell.thht
|
|
- com.gh.ob
|
|
- com.greatdata
|
|
- com.kidsmobmon
|
|
- com.mobitra.todv
|
|
- com.mobphn.monit
|
|
- com.mobtr.danbel
|
|
- com.mophtr.td
|
|
- com.phone.tracker.smsb
|
|
- com.phtranlo.tifach
|
|
- com.rephko.stha
|
|
- com.s2m
|
|
- com.s2m.seas
|
|
- com.sap4mobile
|
|
- com.smart
|
|
- com.smartback
|
|
- com.smstra.xanris
|
|
- com.spy2mobile
|
|
- com.spy2mobile.light
|
|
- com.stmrsa.htxt
|
|
- com.tccplos.spth
|
|
- com.tevi.walpi
|
|
- com.tracker.sms.mobile
|
|
- com.trackzone.kids
|
|
- com.trandmon.tool
|
|
- com.trphwhat.prob
|
|
- com.viewcalls.rem
|
|
- com.viewsms.remb
|
|
- com.whtrack.monit
|
|
websites:
|
|
- account.spytomobile.com
|
|
- forum.spytomobile.com
|
|
- spy2mobile.com
|
|
- spytomobile.com
|
|
- trackerplus.ru
|
|
- www.spy2mobile.com
|
|
- www.spytomobile.com
|
|
certificates:
|
|
- 0387135D057AEAA0F8BCFCE2AFA84D9BD1FA6F30
|
|
- 0C5AB4D05A2C804D3A4D0472CEAC50B89833E6E4
|
|
- 0F64B6EBB49849AC685FE5DF605908594623368E
|
|
- 14EE7779B2E84A0FF1309DEA72881670D78E98AB
|
|
- 1BB7F1E962C35F00BE2EF97A64C753CCA0993637
|
|
- 20948233C3EF1662E79850AE0AB959C4760114C2
|
|
- 26DDA9B261169FB0A63A6CEA5B682B7A190328B6
|
|
- 26FC20C25AF99E4B6C16ABAD8E8D76AFA55973BB
|
|
- 271CA9A77AF56B94F942EDA8F517E4B0FD44206C
|
|
- 2919FF38F04D757BA6FE344F1729275739F43E89
|
|
- 2B02F9708FAD9017D9F709AB2C5C8B5BD0D29394
|
|
- 39DDEFD8261C1946E4F3160F6A9E200F59F06C11
|
|
- 3A041A8B1CF12E01AD4AA14779C1FCCA0701FE5C
|
|
- 3E4E5813CA5B9D9BB50B70FAD3C201FAA54B4FD5
|
|
- 4569A62308FA134A33A5DDCC065D6FDAE5653435
|
|
- 4579E9E02465DAC399B7A47682813F5104E5D914
|
|
- 54E4D1ACDA9E3071D27AA7B6470E23F75BF1380B
|
|
- 5C9031E2340478521630198F3F90E5C8D38D3B64
|
|
- 76A90B5E41FA2AFE14478CDA24A0CA6B4F7FC5F3
|
|
- 7D9EDDE23B4D3D7AC459B06ECEBE8EA1350D4F8F
|
|
- 7DED7756C3DBE351A23BE061E989273888414FE6
|
|
- 8C76B4444DAE08ECF578AF51D295836F0D9BADC6
|
|
- 8D7FEC36654F6B35FA89E079685D637CCEE27755
|
|
- 9329632A70D41158EBAB6EED27B12D8CB0D47579
|
|
- 98140CAE57F4D4CA53EF81F6521E7A0FD601F6E9
|
|
- 986E5892EFB97E807772698BAC701F49CE9CAEA8
|
|
- 98E76043B54DD7CB76E0E6E384A83646F1865BAE
|
|
- A2CD01EE20E3C25575D2D9B9645A52A1FA8C36C6
|
|
- A2CE290D98B66B577880F3D7807DC01EB7FCE01B
|
|
- ADF393A6628366341BA488B85A5AE738793BFD17
|
|
- B8C908630D7D1ED52FA4E5AEC2A2BDA0414F8B3F
|
|
- BB59FC701EAC40C51C9274EA6A8EE623F5002802
|
|
- BC682A41C2AA1EFFFD65CE42BBE3FA967A561EEC
|
|
- CA6F27DDCBE5D7929C82F42F63FF24703A352756
|
|
- E401C172FE10C4893A13B38B1FABAA43473E2900
|
|
- EF8006163D09D176083936CFB068BB07A8918118
|
|
- F5EAEFDECAD39B93134E859BEDC7D3ED42FBE2B3
|
|
- FD4C2144DF6E431378A46EAEACC696AF94DE9D56
|
|
c2:
|
|
ips:
|
|
- 185.87.51.116
|
|
- 139.59.125.208
|
|
domains:
|
|
- 12d60.appspot.com
|
|
- 12d60.firebaseio.com
|
|
- 13-5.org
|
|
- 13-5.ru
|
|
- 89685.firebaseio.com
|
|
- account.trackerplus.ru
|
|
- and.info-taxi.info
|
|
- best-spy-apps.com
|
|
- edlnc255s2q.s3.amazonaws.com # edlnc255s2q.s3.amazonaws.com/databackup.apk
|
|
- ftp.info-taxi.info
|
|
- info-taxi.info
|
|
- kokum.ru
|
|
- pi.info-taxi.info
|
|
- sap4mobile-89685.firebaseio.com
|
|
- sap4mobile.com
|
|
- smartback-12d60.appspot.com
|
|
- smartback-12d60.firebaseio.com
|
|
- spy2mobile-bb441.firebaseio.com
|
|
- spy2mobile.com
|
|
- spytomobile.com
|
|
- tagdps.ru
|
|
- tfk7r22klf8vtd8g90jq8qno1tpqhmpe.apps.googleusercontent.com
|
|
|
|
- name : MobileSpy
|
|
type: stalkerware
|
|
websites:
|
|
- de.mobilespy.at
|
|
- es.mobilespy.at
|
|
- fr.mobilespy.at
|
|
- it.mobilespy.at
|
|
- mobilespy.at
|
|
- pt.mobilespy.at
|
|
- ro.mobilespy.at
|
|
- www.mobilespy.at
|
|
c2:
|
|
ips:
|
|
- 37.120.162.163
|
|
domains:
|
|
- api.mobilespy.at
|
|
|
|
- name : WebWatcher
|
|
names:
|
|
- Atic
|
|
- Interguard
|
|
- Screentime
|
|
- atispy
|
|
type: stalkerware
|
|
packages:
|
|
- com.at.wwka
|
|
- com.ati.client
|
|
- com.ati.monitor
|
|
- com.ati.webwatcherconsole
|
|
- com.atinc.slcompanion
|
|
- com.atiw.wc
|
|
- com.awarenesstech.monitor
|
|
- com.awarenesstech.wwpapp
|
|
- com.awarenesstechnologies.sideloadedws
|
|
- com.awti.slc
|
|
- com.screentime
|
|
- com.ww.companion
|
|
websites:
|
|
- awarenesstechnologies.com
|
|
- interguardsoftware.com
|
|
- screentimelabs.com
|
|
- webwatcher.com
|
|
- www.webwatcher.com
|
|
certificates:
|
|
- 35E90A29262F1E6CC25B6E483DEC67161513DE30
|
|
- 4E6B680EF3B588EF53097BC7CEFB778833B8A475
|
|
- 60277E8CE202D8023F2ECC86F1726A50D9990576
|
|
- AD62CBB4BD298CF69CDA40997C3E5D70112D7161
|
|
- B9D5BAEDCF0C711317E8B6E54D60F0A5EDEE9517
|
|
- E689432F7C2A39379BD64CB0BD2A6028F3A666DD
|
|
- FC786B8F918655D45245C685A471BD57F02FB366
|
|
c2:
|
|
domains:
|
|
- api.awarenesstechnologies.com
|
|
- apitest.awarenesstechnologies.com
|
|
- data-webwatcherdata-alb-1451089636.us-west-2.elb.amazonaws.com
|
|
- data.qa.webwatcherdata.com
|
|
- data.webwatcherdata.com
|
|
- download.webwatcherdata.com
|
|
- login.webwatcher.com
|
|
- rcomlogin.com
|
|
- screentimelabs.appspot.com
|
|
- webwatcher-child-app.firebaseio.com
|
|
- webwatcherdata.com
|
|
- www.webwatchernow.com
|
|
- webwatchernow.com
|
|
|
|
- name : NexSpy
|
|
names:
|
|
- Oxy
|
|
- MobileBackup
|
|
type: stalkerware
|
|
websites:
|
|
- nexspy.com
|
|
- oxy.nexspy.com
|
|
- mobilebackup.biz
|
|
- portal.mobilebackup.biz
|
|
- portal.topzaloha.cz
|
|
c2:
|
|
domains:
|
|
- my.nexspy.com
|
|
- api.mobilebackup.biz
|
|
- topzaloha.cz
|
|
|
|
- name : juju
|
|
type: stalkerware
|
|
websites:
|
|
- www.juju.co.ke
|
|
- juju.co.ke
|
|
|
|
- name : mSpyitaly
|
|
type: stalkerware
|
|
websites:
|
|
- dc-407883c18502.mspyitaly.com
|
|
- mspyitaly.com
|
|
- www.mspyitaly.com
|
|
|
|
- name : MyCellSpy
|
|
names:
|
|
- CellSpy
|
|
- MCSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.cryzp.leplluln
|
|
- com.pser.sysutils
|
|
- com.sev.android.systemdev
|
|
websites:
|
|
- mycellspy.com
|
|
- cezz.me
|
|
- user.mycellspy.com
|
|
certificates:
|
|
- D09EE9D79FF75E737429DDE34FD13EDFDDA34E78
|
|
certificate_organizations:
|
|
- H20201128
|
|
c2:
|
|
ips:
|
|
- 47.252.23.40
|
|
domains:
|
|
- api.mycellspy.com
|
|
|
|
- name : Spylix
|
|
type: stalkerware
|
|
packages:
|
|
- com.chaoqi.spyapp
|
|
websites:
|
|
- spylix.com
|
|
- www.spylix.com
|
|
certificates:
|
|
- 2CF347EA59967F7799AA2C1FDB5D711B2B93D586
|
|
c2:
|
|
ips:
|
|
- 52.90.126.68
|
|
domains:
|
|
- api.spylix.com
|
|
- apidemo.spylix.com
|
|
- d2nipadu1fr4ne.cloudfront.net
|
|
- getspylix.io
|
|
- my.spylix.com
|
|
|
|
- name: MonitorUltra
|
|
type: stalkerware
|
|
packages:
|
|
- com.sec.provider.mobile.android
|
|
websites:
|
|
- www.spyequipmentuk.co.uk
|
|
certificates:
|
|
- 0DCD7C9CC6A76AD28D7D992C4EF3DF2F768EA473
|
|
c2:
|
|
ips:
|
|
- 185.2.103.130
|
|
- 80.241.216.14
|
|
domains:
|
|
- x1panel.com
|
|
- xpcpanel.com
|
|
- monitor-ultra.com
|
|
|
|
- name: SentryPC
|
|
type: stalkerware
|
|
websites:
|
|
- www.sentrypc.com
|
|
- sentrypc.com
|
|
c2:
|
|
ips:
|
|
- 108.178.9.124
|
|
domains:
|
|
- sentrypc.net
|
|
- spc-runtimes.s3.amazonaws.com
|
|
- www.sentrypconline.com
|
|
- www.sentrypc.net
|
|
- www.spclogs.com
|
|
- www.sentrypc.download
|
|
|
|
- name: TheWiSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.thewispy
|
|
certificates:
|
|
- BFF94895A64AEB38B5278BC41B1DB242CD82DA62
|
|
websites:
|
|
- www.thewispy.com
|
|
- childmonitoringsystem.com
|
|
c2:
|
|
ips:
|
|
- 167.71.189.163
|
|
domains:
|
|
- cp.thewispy.com
|
|
|
|
- name: Observer
|
|
type: stalkerware
|
|
packages:
|
|
- YWZiZDFjZTg2NTZlOGI4NDkyYWJjZDJjZDE5ZTM0Mjk.MzkwMmNhZGFiZGZhMjMyZjQzNTJkYmQ1ODg1ZjI1NzA
|
|
- com.system.settings
|
|
certificates:
|
|
- 3D4D65F3584201E74B186A90C3333C468D3C6A09
|
|
- 64AC17A447EB4BCAF556B57C5C66F232C489C7A7
|
|
- 85AF7A95F8A95541F6B6DE88A8EBC24FF1658E98
|
|
- D44524FA0D7866F1798C41C28953DA899B46BE65
|
|
- E906D462FA05007DE06423A10539C7E7EAB041CD
|
|
websites:
|
|
- www.observer.pw
|
|
c2:
|
|
domains:
|
|
- observer.back4app.io
|
|
|
|
- name: Mrecorder
|
|
names:
|
|
- mobrec
|
|
type: stalkerware
|
|
packages:
|
|
- com.mobileservices2.synchronization
|
|
- com.mrecorder.callrecorder
|
|
- com.mobileservice.sync
|
|
- com.connection.manager
|
|
certificates:
|
|
- 718F3191938DA39D3A4EAC0EF0F44C70F32B0989
|
|
- 77142DA3A865C256FCDD24E187FDCEBA1B4EC587
|
|
certificate_organizations:
|
|
- mrecorder2
|
|
- MobileRecorder
|
|
websites:
|
|
- mobilerecorder24.com
|
|
- mrecorder.com
|
|
c2:
|
|
domains:
|
|
- d1gslyvqtipqvi.cloudfront.net
|
|
- d24lo6rmha82nf.cloudfront.net
|
|
- d3g4zswpacwtfb.cloudfront.net
|
|
- data240.mrec24.com
|
|
- data241.mrec24.com
|
|
- disp2.mrec24.com
|
|
- dispatcher.mrecorder.com
|
|
- mobi22.com
|
|
- mobilerecorder-1277.firebaseio.com
|
|
- mrec24.com
|
|
- my.mrec24.com
|
|
- package.mrec24.com
|
|
- package2.mrec24.com
|
|
- project-7991479181228723357.firebaseio.com
|
|
|
|
- name: PhoneSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.popo.analyse
|
|
- com.wlset.info
|
|
certificates:
|
|
- 5EC970BC602D0EBB2F3C7A5135E24C330B71DE59
|
|
- FBC83FD67E3B534B8B03D3B341249DB3186374E2
|
|
websites:
|
|
- www.phone-spy.com
|
|
- phone-spy.com
|
|
- aksoft.gq
|
|
c2:
|
|
ips:
|
|
- 103.147.225.210
|
|
- 175.126.146.147
|
|
|
|
- name: ShadySpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.shadyspy.monitor
|
|
certificates:
|
|
- 91ED4F75A763A63471E1D1D39BA012DF867550D4
|
|
- C44894EE63F2E861A6960834A21EB27169150722
|
|
distribution:
|
|
- shadyspy.com
|
|
websites:
|
|
- shadyspy.com
|
|
- www.shadyspy.com
|
|
c2:
|
|
ips:
|
|
- 45.79.149.154
|
|
domains:
|
|
- www.shadyspy.com
|
|
|
|
- name: AbsoluTrack
|
|
names:
|
|
- RemoteSecurity
|
|
type: stalkerware
|
|
packages:
|
|
- com.ass.antitheft
|
|
- com.ass.remotesecurity
|
|
- com.ass.ladieschildprotection
|
|
- com.ots.ladieschildprotection
|
|
- com.ots.remotesecurity
|
|
- com.ots.antitheft
|
|
- com.softalogy.thiefguard
|
|
- com.ots.womenchildsafety
|
|
- com.gss.whereismyphone
|
|
- com.smart.guardoffline
|
|
certificates:
|
|
- 8851279B5177EF52B0B8540EE1FCED4BABDFB318
|
|
- 5D655F30DE8B8BDABCCDF660582C6369145E7A5A
|
|
- 28393DBA55F5B08294D1E54962BE1648C1EFB4A2
|
|
- 40159690AF08A01670E3FA07A021F7B1C1437042
|
|
- C9BE6C42B975258DEA10EB6946A7986E4FE955E2
|
|
- D1BB66A93F621A66094F28856988C7A2AE9972D0
|
|
- 1C6E171D3A6E51947DF9E83946BB115ED4A41C6A
|
|
websites:
|
|
- absolutesoftsystem.in
|
|
- absolutestoreindia.com
|
|
- ass.absolutesoftsystem.in
|
|
- geniesoftsystem.com
|
|
- onetouchsecurities.com
|
|
- smartguardapp.com
|
|
- thiefguardbd.com
|
|
- www.smartguardapp.com
|
|
c2:
|
|
domains:
|
|
- absolutesoftsystem.in
|
|
- ass.absolutesoftsystem.in
|
|
- thiefguardbd.com
|
|
- antitheft-88554.firebaseio.com
|
|
- remotesecurity-629f2.firebaseio.com
|
|
- test.onetouchsecurities.com
|
|
- remotesecurityots.firebaseio.com
|
|
|
|
- name: SmartKeylogger
|
|
names:
|
|
- Hiddad
|
|
type: stalkerware
|
|
packages:
|
|
- com.AwamiSolution.smartkeylogger
|
|
certificates:
|
|
- 842676B67005E6561808B650152F598035D12800
|
|
certificate_organizations:
|
|
- AwamiSolution
|
|
websites:
|
|
- awamisolution.com
|
|
c2:
|
|
domains:
|
|
- awamisolution.com
|
|
|
|
- name: Traccar
|
|
names:
|
|
- Traca
|
|
type: stalkerware
|
|
packages:
|
|
- org.traccar.client
|
|
- org.traccar.client.hidden
|
|
certificates:
|
|
- AA752803419B66BC6D5CFCD61A7C88935FFE5511
|
|
- F4F16BDEB31AED018276B47CAD9007063029FD22
|
|
- DAE17DA900E269741688CEA3DAF929A8D896536D
|
|
- A759EC34A1144DC3443A9D4C3286F9F3A4F23FB1
|
|
websites:
|
|
- www.traccar.org
|
|
- demo.traccar.org
|
|
- traccar.org
|
|
c2:
|
|
domains:
|
|
- traccar-client-app.firebaseio.com
|
|
- traccar.org
|
|
|
|
- name: SpyNote
|
|
names:
|
|
- Scream
|
|
- Screamon
|
|
type: stalkerware
|
|
packages:
|
|
- dell.scream.application
|
|
- com.spynote.software.stubspynote
|
|
certificates:
|
|
- 219D542F901D8DB85C729B0F7AE32410096077CB
|
|
websites:
|
|
- www.spynote.us
|
|
- spynote.us
|
|
c2:
|
|
domains:
|
|
- spynote.us
|
|
|
|
- name: FlashKeylogger
|
|
names:
|
|
- FlashKeylog
|
|
type: stalkerware
|
|
packages:
|
|
- tej.flashkeylogger
|
|
- tej.flashkeyloggerpro
|
|
- tej.flashkeylogges
|
|
certificates:
|
|
- 340FE1F4AA4A401AD8E326907E35FB9E0C2486BD
|
|
websites:
|
|
- flashkeylogger.com
|
|
|
|
- name: MobiStealth
|
|
names:
|
|
- MobiStealth
|
|
- Stealthcell
|
|
type: stalkerware
|
|
packages:
|
|
- stealthLight.sys
|
|
- phone.Secure
|
|
- and.LocatorTrial
|
|
- and.GuardTrial
|
|
- lookOut.Secure
|
|
certificates:
|
|
- 5AD2ACB089F8BE5112FF5125D94036983DE3E8D5
|
|
- FED69D6F09AE8C98DD4053C1934CCAF57D31824D
|
|
certificate_organizations:
|
|
- mobizim
|
|
websites:
|
|
- mobistealth.com
|
|
- www.mobistealth.com
|
|
- www.mobilestealthreview.com
|
|
c2:
|
|
ip:
|
|
- 72.167.46.196
|
|
- 5.79.71.114
|
|
domains:
|
|
- einformatiks.com
|
|
- www.einformatiks.com
|
|
- dwn.vys.me
|
|
- www.vys.me
|
|
- vys.me
|
|
|
|
- name: SMSForward
|
|
names:
|
|
- SMForw
|
|
type: stalkerware
|
|
packages:
|
|
- one.enix.smsforward
|
|
certificates:
|
|
- 1E15B0D27C0551061885340A3990D52A93F646B8
|
|
|
|
- name: Ahmyth
|
|
type: stalkerware
|
|
packages:
|
|
- net.droid.talk218
|
|
- ahmyth.mine.king.ahmyth
|
|
certificates:
|
|
- 0ECD5FD80682776D804715AB5B8504DAF59A4B54
|
|
c2:
|
|
ip:
|
|
- 85.10.199.40
|
|
|
|
- name: xHunter
|
|
type: stalkerware
|
|
packages:
|
|
- com.xhunter.client
|
|
|
|
- name: SpyTec
|
|
type: stalkerware
|
|
websites:
|
|
- spytecgps.io
|
|
- spytecgl300.com
|
|
- www.spytec.com
|
|
- spytec.com
|
|
- activation.spytec.com
|
|
|
|
- name: SpyTek
|
|
type: stalkerware
|
|
websites:
|
|
- spytekonline.co.za
|
|
- spytek.co.za
|
|
- portal.spytek.co.za
|
|
|
|
- name: BosSpy
|
|
type: stalkerware
|
|
websites:
|
|
- bosspy.com
|
|
packages:
|
|
- com.android.preference.help.mole
|
|
certificates:
|
|
- 32570AD62B2DF951A67251ACB49E39E96B8A43BA
|
|
|
|
- name: Fenced
|
|
names:
|
|
- MobileSpyIo
|
|
type: stalkerware
|
|
websites:
|
|
- mobilespy.io
|
|
- fenced.ai
|
|
- web.mobilespy.io
|
|
- demo.fenced.ai
|
|
- web.fenced.ai
|
|
- admin.fenced.ai
|
|
packages:
|
|
- com.mobilespy.io
|
|
- com.fenced.ai
|
|
certificates:
|
|
- 5F2DCC133AF3E19D3935A85A3E2871856602A21D
|
|
|
|
- name: RastreadorDeNamorado
|
|
type: stalkerware
|
|
websites:
|
|
- rastreadordenamorado.com.br
|
|
packages:
|
|
- br.com.rastreadordenamorado
|
|
|
|
- name: Intertel
|
|
type: stalkerware
|
|
websites:
|
|
- mobile-spy.co.za
|
|
|
|
- name: SpyFly
|
|
type: stalkerware
|
|
websites:
|
|
- spyfly.co.za
|
|
|
|
- name: MocoSpy
|
|
type: stalkerware
|
|
websites:
|
|
- mocospy.com
|
|
|
|
- name: MzanziSpy
|
|
type: stalkerware
|
|
websites:
|
|
- mzanzispy.co.za
|
|
|
|
- name: RecomSpy
|
|
type: stalkerware
|
|
websites:
|
|
- recomspy.com
|
|
|
|
- name: SwiftMobileSpy
|
|
type: stalkerware
|
|
websites:
|
|
- pc.myswiftmobilespy.co.za
|
|
- swiftmobilespy.co.za
|
|
certificates:
|
|
- 795C30FAD432EE48EDF52B0748BA2749F0915CA3
|
|
|
|
- name: Trackji
|
|
type: stalkerware
|
|
websites:
|
|
- trackji.com
|
|
certificates:
|
|
- DBA6211533A354E4BBF685A2EA458AC372C4ECE4
|
|
packages:
|
|
- com.android.wifi.tracker
|
|
c2:
|
|
domains:
|
|
- trackji.com
|
|
|
|
- name: XDSpy
|
|
type: stalkerware
|
|
websites:
|
|
- xdspy.app
|
|
- androidspy.info
|
|
packages:
|
|
- xd.spy.app
|
|
certificates:
|
|
- 06A49FE1347C7D2E596DF2F08B8C235C00975AF8
|
|
- 7A22EB86FD8D817ED7BFAA03E7A280A03AF20779
|
|
c2:
|
|
domains:
|
|
- app.xdspy.app
|
|
|
|
- name: XploitSPY
|
|
type: stalkerware
|
|
websites:
|
|
- xploitwizer.com
|
|
packages:
|
|
- com.remote.app
|
|
|
|
- name: SpySMS
|
|
type: stalkerware
|
|
packages:
|
|
- com.devspark.securityotp
|
|
|
|
- name: DroidWatcher
|
|
type: stalkerware
|
|
packages:
|
|
- com.droidwatcher
|
|
|
|
- name: Spyzier
|
|
type: stalkerware
|
|
packages:
|
|
- com.rana_aditya.child
|
|
|
|
- name: AndroidSpyApp
|
|
type: stalkerware
|
|
packages:
|
|
- me.hawkshaw
|
|
|
|
- name: SpyDroid
|
|
type: stalkerware
|
|
packages:
|
|
- net.majorkernelpanic.spydroid
|
|
|
|
- name: SpyAppGhazi
|
|
type: stalkerware
|
|
packages:
|
|
- com.example.ghazi.sms
|
|
|
|
- name: Curiosus
|
|
type: stalkerware
|
|
packages:
|
|
- com.hyadesinc.curiosus
|
|
|
|
- name: LoveSpy
|
|
type: stalkerware
|
|
packages:
|
|
- com.example.lovespy.app
|
|
|
|
- name: ISpy
|
|
type: stalkerware
|
|
packages:
|
|
- edu.virginia.cs.cs4720.ispy
|
|
|
|
- name: PatanSpyApp
|
|
type: stalkerware
|
|
packages:
|
|
- in.spyapp.patanjali.android
|
|
|
|
- name: Dash
|
|
type: stalkerware
|
|
packages:
|
|
- com.github.muneebwanee.dash
|
|
|
|
- name: SpyApp
|
|
type: stalkerware
|
|
packages:
|
|
- com.femimesusu.libapasopi
|
|
certificates:
|
|
- 38819265668EEAE6AC3C6C80D1A6530EAE99AD0E
|
|
- E3620714FB24A45614A456DF1176D482BCD1B032
|
|
- F3E17DFDB98B1F7774A16967FD1D84D3D9D59389
|
|
distribution:
|
|
- m.pgv4.com
|
|
websites:
|
|
- accounts.spyapp.ro
|
|
- accounts.pgv4.com
|
|
- applispy.com
|
|
- area.spyapp.ch
|
|
- beta.spyapp.ro
|
|
- br.pgv4.com
|
|
- clienti.securspy.com
|
|
- compte.applispy.com
|
|
- controllo.spystoreitalia.com
|
|
- tel.forensis-lab.com
|
|
- mespiao.com.br
|
|
- partner.securspy.com
|
|
- pgv4.com
|
|
- pin.pgv4.com
|
|
- pin.spyapp.ro
|
|
- ro.pgv4.com
|
|
- roaccount.pgv4.com
|
|
- securspy.com
|
|
- server.pgv4.com
|
|
- spyapp.at
|
|
- spyapp.ch
|
|
- spyapp.es
|
|
- spyapp.fr
|
|
- spyapp.uk
|
|
- spyapp.ro
|
|
- spybrother.com
|
|
- sys.spyapp.ch
|
|
- www.spyapp.ch
|
|
- www.spyapp.ro
|
|
- x.securspy.com
|
|
- x.spyapp.ro
|
|
c2:
|
|
domains:
|
|
- x.pgv4.com
|
|
- pgv4.com
|
|
- www.pgv4.com
|
|
|
|
- name: MySpyApps
|
|
type: stalkerware
|
|
websites:
|
|
- myspyapps.com
|
|
certificates:
|
|
- CCCD74B31E53685BFA5A23AD0AE020AF74689085
|
|
packages:
|
|
- com.my.spy.app
|
|
c2:
|
|
domains:
|
|
- my-spy-a9c92.firebaseio.com
|
|
|
|
- name: OneSpy
|
|
names:
|
|
- OneMonitar
|
|
- OneSpy
|
|
- ChyldMonitor
|
|
type: stalkerware
|
|
packages:
|
|
- com.android.system.app
|
|
- com.android.settings.app
|
|
- seC.fqjx.sqBB
|
|
- com.qwertyuiop.asdfghjkl
|
|
certificates:
|
|
- E458DC7CD8928A41865F502A884F0D51309E0BEF
|
|
- E7D395DF3B8077C733D9BE67D841FDF271F49406
|
|
- 0FB6643902E891C230F6E6662083442EEA1F16CE
|
|
websites:
|
|
- app.onemonitar.com
|
|
- ap.chyldmonitor.com
|
|
- cockpit.chyldmonitor.com
|
|
- chyldmonitor.com
|
|
- cloud.onemonitar.com
|
|
- cp.onemonitar.com
|
|
- onemonitar.com
|
|
- onespy.com
|
|
- pma-234fsfsddfsdfds09.onemonitar.com
|
|
- send.onemonitar.com
|
|
- send.onespy.com
|
|
- su.onemonitar.com
|
|
- superuser.onemonitar.com
|
|
- test.send.onemonitar.com
|
|
- billing.chyldmonitor.com
|
|
distribution:
|
|
- onespy-in-d.s3.eu-central-1.amazonaws.com
|
|
- android-apps.s3.amazonaws.com
|
|
c2:
|
|
domains:
|
|
- api.cp.onemonitar.com
|
|
- onespy-in-196211.firebaseio.com
|
|
- android.chyldmonitor.com
|
|
- web.chyldmonitor.com
|
|
- sse.chyldmonitor.com
|
|
|
|
- name: Android007
|
|
names:
|
|
- SpyBunker
|
|
type: stalkerware
|
|
websites:
|
|
- android007.com
|
|
- www.android007.com
|
|
- portal.android007.com
|
|
- spybunker.com
|
|
- www.spybunker.com
|
|
|
|
- name: RioSPY
|
|
type: stalkerware
|
|
websites:
|
|
- www.riospy.net
|
|
- riospy.net
|
|
|
|
- name: WheresMyDroid
|
|
type: stalkerware
|
|
websites:
|
|
- wheresmydroid.com
|
|
- www.wheresmydroid.com
|
|
- wmdcommander.appspot.com
|
|
packages:
|
|
- com.alienmanfc6.wheresmyandroid
|
|
certificates:
|
|
- F8FC21D0709C3C0A3E4FBA81D24AB50979F25C19
|
|
c2:
|
|
domains:
|
|
- wmdcommander.appspot.com
|
|
|
|
- name: WiseMo
|
|
type: stalkerware
|
|
websites:
|
|
- www.wisemo.com
|
|
- wisemo.com
|
|
packages:
|
|
- com.wisemo.wsmguest.v18
|
|
- com.wisemo.host.v10
|
|
certificates:
|
|
- 9B48840CBF93379410172B4B85989624D2B33D59
|
|
c2:
|
|
domains:
|
|
- mycloud.wisemo.com
|
|
- mycloud1.wisemo.com
|
|
- mtracker.fortess.net
|
|
|
|
- name: FindMyKids
|
|
type: stalkerware
|
|
websites:
|
|
- findmykids.org
|
|
packages:
|
|
- org.findmykids.app
|
|
- org.findmykids.child
|
|
certificates:
|
|
- 9B48840CBF93379410172B4B85989624D2B33D59
|
|
c2:
|
|
domains:
|
|
- api.findmykids.org
|
|
- r.findmykids.org
|
|
- wss.findmykids.org
|
|
- where-is-my-children.firebase.io
|
|
distribution:
|
|
- fmk.god-xc.com
|
|
|
|
- name: MagMonitor
|
|
type: stalkerware
|
|
names:
|
|
- maglook
|
|
websites:
|
|
- maglook.eu
|
|
c2:
|
|
domains:
|
|
- www.maglook.eu
|
|
- maglook.eu
|
|
- ue.maglook.eu
|
|
- uf.maglook.eu
|
|
|
|
- name: BrunoEspiao
|
|
type: stalkerware
|
|
websites:
|
|
- brunoespiao.com.br
|
|
packages:
|
|
- com.moxlndmp.uhzhgzjh
|
|
- com.fzvsdrtb.qamlhxri
|
|
- com.thaxygpc.xjsjobpn
|
|
- com.nhevvtmt.thinkquo
|
|
certificates:
|
|
- 159B64B29BC8842ACDF8022B70730B13E288044B
|
|
- 8E38D577187544D4E0F747CAEF32B47FD15B07E5
|
|
- 6041F01561EC43309CCC8452719C4F515C32F3C2
|
|
- A1AA4CD5B6CDBD906E3B27A7D1FA42EA2416ADC3
|
|
c2:
|
|
domains:
|
|
- back.brunoespiao.com.br
|
|
- brunoespiao.com
|
|
- brunoespiao.com.br
|
|
- im.brunoespiao.com.br
|
|
- pc.brunoespiao.com.br
|
|
- pc1.brunoespiao.com.br
|
|
- ua.brunoespiao.com.br
|
|
- ue.brunoespiao.com.br
|
|
- uf.brunoespiao.com.br
|
|
- uf1.brunoespiao.com.br
|
|
- ur.brunoespiao.com.br
|
|
- www.brunoespiao.com.br
|
|
- brunoespiao2.s3.amazonaws.com
|
|
distribution:
|
|
- sbt.tv
|
|
|
|
- name: Spyone
|
|
type: stalkerware
|
|
websites:
|
|
- spyone.pl
|
|
packages:
|
|
- com.jgeuhcex.ejcxndak
|
|
- com.eytewqrm.wvdkgmrl
|
|
- com.epbzrqcg.syzzkuqx
|
|
- com.laucass.phonecontrolenabler
|
|
- com.laucass.phonecontroltarget
|
|
- com.laucass.androsmscontrol
|
|
- com.juzyuwqt.thxxnjvf
|
|
- com.epasufob.kybavfgt
|
|
- pl.spyone.agent2
|
|
- Aktualizacja.apps
|
|
certificates:
|
|
- C4B56E3768543190FDBE0AA01DD628E579F5514C
|
|
- 28AFF3C41C0D42ACBB6B73C6C08868C442088640
|
|
- 2441F6D331D6CFD8624346ED4B1987EAE6534FA3
|
|
- 123C09B261DFA0F67D817E9BA079942830C31D54
|
|
- 32F6E28DD3E2E61ED94446591E31F89AEE3A9BD2
|
|
- 317A9577A5B2D0930D06E0D8D7427E2F8FCAD29D
|
|
- D2A84922F8F747FD7582EFEF4189E06897FA8839
|
|
c2:
|
|
domains:
|
|
- pc.spyone.pl
|
|
- ur.spyone.pl
|
|
- laucass.forumactif.org
|
|
distribution:
|
|
- 11111.pl
|
|
- www.11111.pl
|
|
- 4jslg.11111.pl
|
|
|
|
- name: eagleSPY
|
|
type: stalkerware
|
|
websites:
|
|
- prontodigital.com.br
|
|
- eaglespy.com.br
|
|
packages:
|
|
- br.com.eaglespy
|
|
certificates:
|
|
- B7B561250288C8BB44932B591B5451D852A95109
|
|
c2:
|
|
domains:
|
|
- eaglespy.com.br
|
|
ips:
|
|
- 201.33.21.62
|
|
|
|
- name: PhoneMonitor
|
|
type: stalkerware
|
|
websites:
|
|
- phonemonitor.com
|
|
- users.thephonem.com
|
|
distribution:
|
|
- tphmr.com
|
|
- gurley.s3.ap-southeast-1.wasabisys.com
|
|
packages:
|
|
- com.pvojpamt.tzzyqjyb
|
|
- com.monitor.phone.s0ft.phonemonitor
|
|
c2:
|
|
domains:
|
|
- users.thephonem.com
|
|
|
|
- name: Buhsam
|
|
type: stalkerware
|
|
distribution:
|
|
- https://github.com/earthshakira/android_hack
|
|
packages:
|
|
- com.google.android.network
|
|
certificates:
|
|
- 00F618C4C43C28B107DAB8F5641AD00D3A774AFD
|
|
|
|
- name: AndroRat
|
|
type: stalkerware
|
|
distribution:
|
|
- https://github.com/karma9874/AndroRAT
|
|
packages:
|
|
- com.example.reverseshell2
|
|
|
|
- name: Spynger
|
|
names:
|
|
- discovenger
|
|
type: stalkerware
|
|
websites:
|
|
- spynger.net
|
|
- cart.spynger.net
|
|
distribution:
|
|
- win.spynger.net
|
|
c2:
|
|
domains:
|
|
- my.spynger.net
|
|
- ios-gw.spynger.net
|