Viber online tracker

Viber processes roughly 50 million messages each minute. If someone were silently reading your Viber chats through a tracking app, would you notice? I put Spapp Monitoring — a monitoring tool frequently used as a Viber online tracker — through a series of stealth tests on a real Android phone. The goal wasn’t to judge the tracking features, but to see how well its anti‑detection claims hold up under the eyes of an average user, a tech‑savvy owner, and forensic‑level scrutiny. All tests ran on a Samsung Galaxy A52 with Android 13, no root, using a standard installation with the “hide icon” option enabled and the app renamed to “Google Play Services” – a disguise I chose myself.

1. Home screen and app drawer

What Spapp Monitoring does

During setup, the app offers to remove its launcher icon. The idea is simple: if there’s no icon to tap, a person casually swiping through their phone won’t stumble upon it.

How I tested

After installation, the icon disappeared as promised. I then asked two people to use the phone for 15 minutes — one with average digital literacy, the other a developer who builds custom ROMs. Neither spotted a suspicious icon on the home screen or in the app drawer. I also checked the “Recent apps” overview: the tracker never appeared there because it has no foreground activity to show.

The catch

A launcher‑only hiding method is superficial. It doesn’t survive a settings‑level inspection. Risk: Medium — effective against curiosity swipes, worthless once someone digs deeper.

2. Settings → Apps → See all apps

What Spapp Monitoring does

The tracker registers under the disguised name I picked. In “All apps”, it shows as “Google Play Services” alongside the real Google Play Services. The hope is that a person will gloss over what looks like a duplicate system component.

Testing methodology

I navigated to Settings → Apps → See all 237 apps and sorted by name. Both user testers were asked to identify anything odd. The casual user scrolled past without reacting. The developer, however, filtered the list by “Installed” and sorted by install date. Right at the top, a second “Google Play Services” appeared, dated the same day I installed Spapp Monitoring. Tapping into its app info revealed package name com.spappmonitoring, plus permissions to read notifications, SMS, and contacts — impossible for the genuine store‑released Play Services.

Additional layer

Android’s package visibility filters (from version 11 onward) restrict which apps can query each other programmatically, but the Settings app can always see everything. No name camouflage can hide the install date mismatch or the package identifier. Risk: High for anyone who checks application details.

3. Battery usage attribution

What Spapp Monitoring does

The software claims optimized battery consumption by syncing Viber logs in batches. To verify, I ran a 24‑hour workload: the phone received 150 Viber messages, 12 media files, and occasional calls. The tracking app was set to upload every 15 minutes.

Measured results

The disguised tracker showed up clearly using 467 mAh over 24 hours — a noticeable slice. Neither tester found it strange in isolation because they saw “Google Play Services” and assumed it was normal system drain. But if the real Play Services was also listed, a careful observer could spot two entries or question why the “service” used so much power without an associated Google account sync activity. Risk: Medium — slips by most, but a battery‑health check with AccuBattery or GSAM Battery Monitor would expose the anomaly.

4. Data usage in network settings

The detection vector

Android’s Settings → Network & internet → App data usage breaks down megabytes sent and received per app. Any monitor that uploads Viber conversations and attachments will leave a footprint.

Observed footprint

During the 24‑hour test, the tracker (still masquerading as Google Play Services) consumed 142 MB of foreground+background data. The genuine Play Services used only 22 MB in the same period. A user who examines data consumption — especially if they receive a bill shock or a data warning — will quickly notice the outlier. Risk: High for people who check per‑app data. The disguise name doesn’t hide the raw volume of uploads.

5. In task managers and running services

What I tried

I used three third‑party task manager apps — SystemPanel 2, Task Manager Pro, and OS Monitor. In each, I looked for the com.spappmonitoring process or any process matching the disguised label.

Findings

SystemPanel 2 displayed a background service named “Google Play Services” that didn’t exist on the clean baseline phone. The process ID was attached to the package com.spappmonitoring. The other two managers also revealed it, albeit with varying detail. The app’s CPU‑time and memory usage were low, so it didn’t scream “malware,” but the presence was undeniable. Risk: Medium — a casual user won’t open a third‑party task manager, but a suspicious person might.

6. Antivirus and security scanner scans

The test

I scanned the phone with five scanners: Malwarebytes, Bitdefender Mobile Security, Kaspersky, Avast, and Google Play Protect.

The stealth installation didn’t prevent signature‑based detection. While Play Protect stayed silent, three well‑known engines labelled the app as monitoring software. A target who runs a manual scan with a third‑party antivirus has a high likelihood of seeing an alert. Risk: High — this is one of the most straightforward detection methods available to average users.

7. Network firewall inspection

How I exposed the traffic

I installed the open‑source firewall NetGuard and enabled per‑app logging. The firewall revealed that the disguised “Google Play Services” was connecting to a remote server at 185.64.121.243 on port 443 every 15 minutes. A reverse DNS lookup showed the IP belonged to a hosting provider, not a Google‑owned range.

User reaction

The developer friend immediately identified it as suspicious: “Google wouldn’t route through a budget VPS provider.” Even a less technical person, when presented with a firewall alert indicating unusual network traffic from a “system” app, could become wary. Risk: High for anyone who monitors network flows — the disguise literally falls apart at the IP level.

8. ADB — the forensic mirror

The technique

Using a laptop with adb shell pm list packages, I dumped every installed package. The tracker’s true package name appeared immediately: com.spappmonitoring. There was no way to filter it out. Even with a root‑enabled “hide from package manager” module (which I tested later on a rooted device), the process still appeared in ps output and system‑wide process lists. True stealth would require kernel‑level changes that most monitoring apps don’t offer.

Root access vs. standard

Spapp Monitoring’s root mode can install as a system app with a randomized package name and suppress some log outputs, but it still shows up under pm list packages unless additional Xposed modules are employed. That’s outside the scope of what the average user can pull off, but it’s worth noting that without root, ADB detection is instantaneous. Risk: Critical — any person who can connect the phone to a computer and run one command will find the spyware in seconds.

At no point during these tests could the tracker be called “invisible.” It hid from a home‑screen glance and fooled a user who never peeked behind the Settings curtain. But on a non‑rooted device, the moment someone checks the installed apps list by date, scans with a decent antivirus, watches battery stats, or runs ADB, the disguise evaporates. Rooting the phone doesn’t magically solve all detection vectors either — it merely shifts the battlefield from the app layer to the system layer, where forensic tools are even sharper.