I've discovered that my home network IP address has ended up on several blacklists after spam traps received emails from this IP address. I've tested the one PC that uses this network, and it seems to be fine. That leaves the most likely culprit looking like one of the two Android devices on this network.

On a PC, common ways to check for botnet-type activity include checking traffic on specific ports, and monitoring outgoing traffic. Is there any equivalent for Android?

I've searched on this but found nothing beyond generic anti-malware articles talking about antivirus software. I've not found anything specific to spam or unsolicited outgoing mail, and common anti-malware apps like AVG and Avast seem to only mention spam in the context of preventing incoming spam (not a problem for me), not outgoing.

If possible, I'd prefer a solution based on checking for the actual malicious activity (i.e. detecting actual outgoing mail), rather than relying that an anti-malware app has its listings up to date.

If possible, I'd also prefer to not need to root the devices, or change the operating system from the manufacturers' (Samsung and Sony in my case).

  • Without rooting it would most likely be easiest to intercept the traffic at the router/gateway. Commented Apr 6, 2016 at 15:50
  • I was actually just researching whether this is possible on my router. Not found anything yet. Any suggestions on how to start finding out how to monitor my Android device from the router would be welcome! Commented Apr 6, 2016 at 15:54
  • Looks like it's impossible from my router. I had the idea of turning my PC into a wireless hotspot then monitoring the Android device traffic from it, and asked a SuperUser question to see if that's possible, but direct monitoring or botnet-specific checks from the Android device itself would be better, if possible Commented Apr 6, 2016 at 16:38

1 Answer 1


I suggest using the Android VPN feature to route all of your network traffic to an OpenVPN server. This will send all traffic, Wifi and cellular, through one chokepoint where you can log and analyze it, and it will do so regardless of what network the phone is using. Then you can log and analyze traffic from the OpenVPN server using any of the standard tools.

For an example of a project that uses this approach for a different sort of network security analysis, namely to find apps that send data over unencrypted or insecurely-encrypted connections, see nogotofail.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .