First excuse my lack of knowledge in anything Android related.

I wanted to ask if there is any possibility that an un-supervised Android phone, older Samsung model, running Android 4.2.2, act as a rogue spam server on the network.

Reason I'm asking this is because I have a fairly secure environment at work, both server side and client side. Recently the IP has been blacklisted by SPAM trap servers, and I had no real explanation as to why it happened.

So I asked myself what changed? The network functioned like this for years and no such thing happened till now. As it happens somebody with an older phone logged in on the wifi network on the same day with the blacklist. So I though hmmm weird coincidence.

Bottom line: Can an Android phone act as a rogue SPAM sending server? And if so how can I track down the issue? Is there a complete AV solution for Android that can detect such malware?


  • No, just using Android 4 or below doesn't mean that it's a spam connection. Even I have such a phone which I use once in a while to see whether apps are working in that environment. Maybe that IP had posted something or done something that matched with spam filters in your server. Dec 12, 2017 at 16:37
  • In theory, it could have been that phone (with some malware being the culprit). You could check that e.g. by routing all its network traffic through a transparent proxy and record it, to see what it does. There are also apps to do that on-device – e.g. Network Log.
    – Izzy
    Dec 12, 2017 at 23:08

1 Answer 1


This is absolutely possible for an Android phone to act as a spam server. There are plenty of security flaws in Android that make this a possibility, and creating a program / script to send spam is trivial. There is no complete solution, but there are any number of AV programs (available on play store) that could check the phone for virii.

That said, it's more likely the IP has been classified as part of a client/home user range, and has been blacklisted for that reason - ie nothing you have done, or that another device was compromised. If the network is highly secured then it should not matter what device is on it - SMTP should be blocked to the outside world - except through an appropriate gateway.

You must log in to answer this question.