How to Detect a Cell-Site Simulator on Your Phone

TL;DR

A cell-site simulator (a Stingray or one of its siblings) is a portable fake cell tower that your phone treats as the real tower. Real consumer detection is possible, but only on Android, only with a small handful of apps, and only if you understand what each tool can and cannot see. iOS will not help you. EFF's open-source RayHunter runs on a $20 hotspot and is the easiest starting point for most people. AIMSICD and SnoopSnitch go deeper on rooted Android phones with Qualcomm basebands. None of these tools produces a courtroom-grade "that was a stingray" verdict on its own.

What a Cell-Site Simulator Does, in One Sentence

A cell-site simulator broadcasts a signal stronger than the legitimate tower next to it, so every phone in range disconnects from the real network and connects to the simulator instead. Once a phone is connected, the simulator can capture its IMSI (the unique subscriber identifier), log its location, and, if it downgrades the phone to 2G/GSM, intercept unencrypted calls and texts, call metadata, and some data usage.^[1] The EFF's Street Level Surveillance catalog documents that these devices "masquerade as legitimate cell-phone towers" and can be configured to "divert calls and text messages, edit messages, and even spoof the identity of a caller."^[1]

Two facts matter for the rest of this page. First, the simulator has to be the strongest signal available to trick your phone. Second, simulators can capture everything in a roughly 500-meter radius, with some models claiming the ability to grab data from up to 10,000 phones at once, so the device affects you even when you are not the target.^[1]

The Honest Problem with Detecting One

Consumer detection is genuinely hard, and pretending otherwise wastes your time.

The EFF's 2025 writeup on its own detector explained the gap bluntly: "Much of these gaps in our knowledge are due to a lack of solid, empirical evidence" about which agencies deploy these devices in which neighborhoods, and the prior detection apps had a built-in obsolescence because they "focused on attacks on the legacy 2G cellular network, which is almost entirely shut down in the U.S."^[2] A detector that watches only 2G rarely fires on modern US networks, where most carriers have already retired GSM.

The signal that a modern cell-site simulator leaves is statistical, not a clean fingerprint. A slightly higher tower transmit power, an unexpected downgrade request from LTE to 2G or to LTE-M, an LTE Identifier that does not match what your carrier advertises, or a base station that asks for your IMSI over and over when an authentic LTE network usually never does. Real detectors look for clusters of these tells, not any single one. A single odd value is far more likely to be a legitimate roaming or maintenance event than a stingray.

Hardware Tool: RayHunter on an Orbic Hotspot

The path with the lowest barrier to entry is the EFF's RayHunter, which is purpose-built for exactly this problem. RayHunter is an open-source detector released by EFF in March 2025 that runs on a cheap mobile hotspot called the Orbic RC400L.^[3] The project's README describes the device as designed "to run on a cheap mobile hotspot called the Orbic RC400L" and lists the Orbic, available "for $20 or less," as the supported hardware.^[3]^[2]

What it does: RayHunter intercepts, stores, and analyzes the control traffic between the hotspot and the cell tower (not user traffic, never web requests), then watches for suspicious events in real time. A green line sits at the top of the screen; if that line turns red, RayHunter has logged something worth reviewing.^[2] The specific events it flags include "the base station… trying to downgrade your connection to 2G" or "the base station requesting your IMSI," which are exactly the two interactions a cell-site simulator forces when it pretends to be a real tower.^[2]

Hardware setup is a one-time job: install RayHunter on the Orbic, power the hotspot near where you want to monitor (a car, a protest, a sensitive meeting, your apartment window), and leave it running. The EFF writeup notes the project targets the "modern 4G network" specifically because earlier detectors were stuck on 2G.^[2]

The legal posture from EFF is explicit: "Use Rayhunter at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program."^[2]^[3] EFF designed it to minimize false positives and to require no technical skill to operate.^[3]

Android Apps: AIMSICD and SnoopSnitch

If you want to detect a cell-site simulator from the phone in your pocket rather than from a separate hotspot, you have two real options on Android. Both run in the background and log low-level radio metadata that the operating system normally hides from you.

AIMSICD (Android IMSI-Catcher Detector)

AIMSICD is a community-maintained open-source Android app whose own README states it is "an Android app to detect IMSI-Catchers" defined as "false mobile towers (base stations) acting between the target mobile phone(s) and the real towers of service."^[4] The same surveillance tech is also documented as being "known as 'StingRay', 'Cellular Interception' and alike."^[4] The README puts it as the project's goal that the app "aims to make it possible to detect the IMSI-Catchers so that using them becomes a risky proposition," with an explicit warning that it is "not" a hardened privacy phone; it does not provide encrypted calls, secure SMS, firewalls, full device encryption, or root, and it does "not" prevent already-installed rogue apps from spying.^[4]

What AIMSICD actually checks, per the same README:

Check Tower Information Consistency
Check LAC/Cell ID Consistency
Check Neighboring Cell Info
Prevent silent app installations
Monitor Signal Strength
Detect silent SMS
Detect FemtoCells

That list maps directly onto the leaves a cell-site simulator leaves. LAC/Cell ID jumps while your tower signal stays strong usually means something other than your real carrier is handing your phone off. A "femtocell" detection catches the small home or office cell-boosting devices that are sometimes used as low-budget catchers. Silent SMS detection catches the ping messages Stingray-style devices often send before attaching a phone. Signal-strength monitoring catches the over-the-top "I am louder than the real tower" tell.^[4]

SnoopSnitch (SRLabs)

SnoopSnitch is the more capable and more restrictive option. Its F-Droid listing states it "collects and analyzes mobile radio data to make you aware of your mobile network security and to warn you about threats like fake base stations (IMSI catchers), user tracking and over-the-air updates."^[5] The data SnoopSnitch collects also feeds the public GSM Security Map (gsmmap.org), a crowdsourced database of operator configuration weaknesses.^[5]

The hardware requirements are strict: "Qualcomm-based Android phone," "stock Android ROM, version 4.1 or later," and "root privileges on phone."^[5] Custom ROMs may or may not work depending on whether the Qualcomm DIAG kernel driver is available, and the F-Droid page calls out the Samsung Galaxy S2 and S3, the Nexus 5 on stock Android, and the Huawei Ascend Y300 as incompatible.^[5] The latest listed F-Droid release is version 2.0.12-nbc, dated May 20, 2022, which constrains the realistic ceiling for what the app can detect against newer radio protocols.^[5]

One thing to weigh before you install: F-Droid flags SnoopSnitch with two anti-features. "Tracking: This app tracks and reports your activity" is partly an artifact of the crowdsourced GSMmap contribution, and "Non-Free Network Services" refers to the dependency on cellular networks that are not free software. Both are honest disclosures, but they are worth knowing before you hand the app root on your daily driver.^[5]

What the Tools Look At, in Plain Terms

You can map the detectors above onto three detection strategies without writing anything down. Knowing which one you are running explains why it fires or stays silent.

Network-side anomalies

The most common signal. Your phone quietly records which tower it is connected to, which location area code (LAC) and cell ID (CID) that tower advertises, and how that information compares to the neighbor list your phone is told about. A base station that identifies itself with one set of LAC/CID values and shows up as something else on the official network map is suspicious. RayHunter, AIMSICD, and SnoopSnitch all watch this lane.^[4]^[5]^[2]

Downgrade attacks

If a fake tower can force your phone from 4G LTE down to 2G or 3G, the older protocols give the attacker much easier access to call and SMS content. Any unsolicited downgrade request is therefore a red flag. EFF built RayHunter in 2025 specifically because earlier tools "focused on attacks on the legacy 2G cellular network, which is almost entirely shut down in the U.S.," making downgrade detection the modern signal of choice.^[2]

Silent pages and silent SMS

Cell-site simulators often "ping" target phones before attaching them, using a class of system messages that never ring or vibrate. AIMSICD's "Detect silent SMS" module and SnoopSnitch's silent-SMS detection both look for these. Silent pages are also a generic law-enforcement technique unrelated to stingrays, so a flagged silent SMS is suggestive, not conclusive.^[4]^[5]

iOS: Why You Cannot Detect

If your daily phone is an iPhone, none of the above applies. Apple's iOS does not give third-party apps access to the low-level radio diagnostic data that RayHunter, AIMSICD, and SnoopSnitch rely on, and apps cannot request root on iOS at all. The App Store does not carry a working IMSI-catcher detector for iOS, and EFF's own tool runs only on the Orbic hotspot and certain Android devices, never on iOS.^[3]^[2]

The practical workaround for iPhone users is the same one for any privacy-conscious iPhone reader: run RayHunter on a cheap dedicated Orbic hotspot in your bag or your car, leave it logging during the times you care about (a protest, an event, a sensitive workplace), and review the captures later. You are monitoring the radio environment rather than your phone, which is the right frame on iOS.

What You Can Look For Without a Special App

Three patterns show up often enough that an attentive user can spot them with no tools at all.

Your phone drops to 2G or 3G when you are well within LTE coverage. Real carriers do not hand you down from a healthy LTE connection on a moving phone; an attacker forcing a downgrade will.
Your phone shows full bars but calls and SMS fail to complete. A high-signal bogus tower with no backhaul is a classic stingray failure mode.
Your phone shows unusual mobile network codes or location area codes that do not match what your carrier or a mapping tool says it should use where you are.

None of these is proof. A downgrade can be operator-maintenance; failed calls can be congestion; unfamiliar codes can be a roaming partner in a border town. Treat them as prompts to look harder, not as verdicts.

What Federal and Local Rules Actually Say

Detection is not the same as setting rules. The Department of Homeland Security published a formal policy on cell-site simulator use in 2015 and last updated the policy materials in 2022, and the DHS document frames the devices as "invaluable law enforcement tools that locate or identify mobile devices during active criminal investigations."^[6] Federal rules around warrant requirements and minimization changed under a 2015 Department of Justice policy that restricted cell-site simulators to specific categories of investigations and required deletion of non-target data; the Supreme Court has revisited some of these areas through Carpenter v. United States and later Fourth Amendment cases. State and local use is uneven. California's Electronic Communications Privacy Act (CalECPA) requires a warrant for cell-site simulator use by state and local agencies, and other states have their own rules.

The practical upshot for an everyday reader: if you suspect a device is being used near you, the records to ask your local agency for are the cell-site simulator use policy and any logs of past deployments. Public-records requests are how the EFF, the ACLU, and newsrooms keep building the catalog of who uses what, and you can use the same lever.^[1]

The Bottom Line

If you want a detector right now, RayHunter on a $20 Orbic hotspot is the easiest install and the only one designed for current 4G networks. If you carry a rooted Qualcomm-based Android phone, SnoopSnitch adds deeper radio-layer analysis at the cost of an F-Droid app with root and a tracking anti-feature. If you want community-maintained heuristics and a less invasive install, AIMSICD runs on a wider range of Android hardware. If you are on iOS, none of the phone-only options apply; you monitor the air with a separate device. Treat any alert as a prompt to look closer, log what you saw, and file a public-records request if you want a yes-or-no answer about your local agency.

How to Detect a Cell-Site Simulator (Stingray) on Your Phone