Looking up the IP address websites see when you visit.
Every website you visit sees this IP. A VPN hides it, but a VPN does not remove spyware already on your phone. Only a check like the one below can look for that.
A free guide to checking an Android phone or iPhone for traces of known spyware such as Pegasus and Predator, using Amnesty International's open-source tools. It runs on your own Windows or Mac computer, over a USB cable.
Your phone's data never leaves your computer. This site doesn't scan or upload any files. The connection check above is shown only to you and isn't saved.
Copies the phone's apps, processes, logs and settings onto your computer. Android uses the androidqf tool; iPhone uses a normal encrypted backup from Finder or Apple Devices.
MVT compares the archive against public lists of known-spyware fingerprints and reports any match.
$ ./androidqf [*] collecting: packages, apks, processes, logs, settings [*] saved acquisition → 3f2a9c1e-….zip $ mvt-android check-androidqf -o results 3f2a9c1e-….zip [*] matching against public spyware indicators… [✓] CLEAN — no known spyware found $
Install Python from python.org and tick “Add Python to PATH”. Then open a terminal (cmd) and paste:
You need Homebrew from brew.sh. Open the Terminal app and paste:
pip install mvt mvt-android download-iocs
brew install pipx pipx ensurepath export PATH="$PATH:$HOME/.local/bin" pipx install mvt mvt-android download-iocs
The last command downloads the latest spyware fingerprints. Run it again before each scan.
If you see command not found: mvt later, close Terminal and open it again.
Download androidqf_windows_amd64_….exe from the official androidqf releases.
If Windows blocks it: right-click → Properties → tick “Unblock” → OK. Never turn off your antivirus to run any tool.
Download androidqf_macos_universal_…_signed from the official androidqf releases. This version is signed for macOS.
Double-click the file you downloaded.
cd ~/Downloads chmod +x androidqf_macos_universal_*_signed ./androidqf_macos_universal_*_signed
When the phone shows a “Back up my data” screen, tap it and leave the password blank. When it finishes you'll have a file with a long name like 3f2a….zip.
Replace YOUR-FILE.zip with your file's name:
mvt-android check-androidqf --non-interactive -o results YOUR-FILE.zip
To also check links inside your text messages, add -p followed by your phone's PIN. The PIN stays on your computer.
Look in the results folder for files ending in _detected.json. If any entry matches a known indicator, read the next section.
Install Python from python.org and tick “Add Python to PATH”. Then open a terminal (cmd) and paste:
You need Homebrew from brew.sh. Open the Terminal app and paste:
pip install mvt mvt-ios download-iocs
brew install pipx pipx ensurepath export PATH="$PATH:$HOME/.local/bin" pipx install mvt mvt-ios download-iocs
The last command downloads the latest spyware fingerprints. Run it again before each scan.
If you see command not found: mvt later, close Terminal and open it again.
Install Apple's free Apple Devices app from the Microsoft Store (on older Windows, use iTunes). Plug in the iPhone, unlock it and tap Trust, then select the phone in the app.
Plug in the iPhone, unlock it and tap Trust. Open Finder and click the iPhone in the sidebar.
The backup must be encrypted. Without encryption, the iPhone leaves out much of the data MVT needs to see.
Each backup is a folder named with a long ID such as 00008030-001A…. If there are several, use the newest one.
explorer %USERPROFILE%\Apple\MobileSync\Backup
If that folder doesn't exist (older iTunes), try %APPDATA%\Apple Computer\MobileSync\Backup.
open ~/Library/Application\ Support/MobileSync/Backup
If Terminal says “Operation not permitted”, allow it in System Settings → Privacy & Security → Full Disk Access → Terminal, then reopen Terminal.
Replace the password and the folder path with yours. Tip: drag the backup folder into the terminal window to paste its path.
mvt-ios decrypt-backup -p YOUR-BACKUP-PASSWORD -d decrypted "PATH-TO-BACKUP" mvt-ios check-backup -o results decrypted
Look in the results folder for files ending in _detected.json. If any entry matches a known indicator, read the next section.
The decrypted folder holds your messages, photos and contacts unprotected. Delete it once you've read the results.
rmdir /s /q decrypted
rm -rf decrypted
Nothing matched a known fingerprint. MVT may also list warnings, such as apps installed outside the app store. These are usually harmless; just check that you recognise each one.