📡 IMSI Catchers and Stingrays: How They Work and How to Detect Them

An IMSI catcher — also called a Stingray, after the best-known Harris Corporation product line, or a cell-site simulator (CSS) in the literature — is a device that impersonates a legitimate cell tower. Phones are designed to connect to the strongest available tower and, in older protocols, to do so without the tower proving who it is. That asymmetry is the whole attack. Once your phone connects, the operator can harvest your IMSI (the unique identifier on your SIM), locate you with far more precision than a normal tower would allow, and depending on the device and protocol, intercept metadata or communications. They exploit fundamental properties of how cellular networks are designed, which is why they are hard to eliminate rather than merely hard to build.

Rayhunter is a free, open-source tool released by the Electronic Frontier Foundation to detect cell-site simulators. It runs on a cheap Orbic RC400L mobile hotspot (EFF quoted $20 or less in March 2025) or one of several other supported hotspots, and monitors the control traffic between that hotspot and nearby towers. Crucially it does not touch user traffic: no web requests, calls or messages are captured, only signalling. It looks for behaviour that legitimate towers do not exhibit, such as a base station trying to downgrade your connection to 2G (which lacks modern encryption and opens the door to further attacks) or requesting your IMSI under suspicious circumstances. The interface is a traffic light: a green line means nothing unusual, red means something is. When it alerts, you connect to the hotspot's Wi-Fi, open its built-in web page, and can inspect what it saw or download a PCAP.

Because of a hard constraint most write-ups skip: Rayhunter needs access to Qualcomm's diagnostic interface at /dev/diag, and that is only exposed on particular hardware. The Orbic RC400L remains the recommended cheap device in the Americas; EFF also recommends the TP-Link M7350 for Europe, Africa and the Middle East, except hardware version 10.0, which does not work. It lists a second tier of 'functional' hotspots and the PinePhone. Ordinary consumer cellular modems — the SIM7600G-H in a ClockworkPi, for example — do not expose the diagnostic interface at all, so they cannot run it no matter how much you want them to. EFF chose the Orbic precisely because it is affordable, widely available and portable, not because it is special. Other Linux/Qualcomm devices may work; the project's own documentation is the place to check before you buy anything.

In most jurisdictions, yes, and the reason is structural: it is passive. Rayhunter only analyses the traffic between your own hotspot and the towers it talks to. It does not transmit, does not impersonate anything, and does not intercept anyone else's communications. EFF's position is that it is lawful in the US when used responsibly. That is not legal advice and frameworks differ by country — some jurisdictions regulate radio monitoring more tightly than the US does. Operating an IMSI catcher, as opposed to detecting one, is a serious offence almost everywhere.

No, and this is the most important caveat on the page. Rayhunter is a detection tool, not proof of absence. Sophisticated cell-site simulators can behave in ways that do not trip its heuristics, and a green line means only that nothing it looks for was observed. Equally, a red line is an anomaly, not a conviction — legitimate network behaviour can occasionally look suspicious. Treat it as an investigative and educational instrument that produces evidence worth examining, not as a forensic verdict. EFF built it partly to gather primary data on how widely these devices are actually deployed, because almost nobody has that data.

AIMSICD (Android IMSI-Catcher Detector, at github.com/CellularPrivacy/Android-IMSI-Catcher-Detector) is the best-known project in this space with about 5,400 GitHub stars, but check its commit history before relying on it. It is not formally archived, and its README promises a revival, but it has been dormant for a long time. SnoopSnitch works on rooted Android phones with Qualcomm basebands. EFF's earlier Crocodile Hunter project is archived on GitHub; Rayhunter is its successor and is where EFF's effort now goes. SeaGlass, from the University of Washington, took a different approach entirely — city-wide sensor networks rather than a single device. The pattern is worth noticing: this is a field where tools go stale fast, and star counts are a poor proxy for whether something still works.

Nothing eliminates it, because IMSI catchers exploit the design of cellular networks rather than a bug in them. But several things help. Disable 2G entirely if your device allows it — Android has this setting, GrapheneOS exposes it prominently, and iPhone's Lockdown Mode turns off 2G and 3G — because forced 2G downgrade is the most common attack path. Use end-to-end encrypted messaging so that intercepted traffic yields metadata rather than content. Airplane mode genuinely works, because a radio that is off cannot be tricked into connecting. And understand that location tracking via a CSS is a targeted, physical-proximity technique: if it is in your threat model, so is everything else about being physically followed.

Because street-level surveillance is exactly the sort of thing open-source research exists to document, and because the deployment picture is genuinely unknown. Agencies rarely disclose CSS use; some have gone to considerable lengths to avoid disclosing it in court. EFF's Street Level Surveillance project catalogues these technologies — facial recognition, ALPR, drones, IMSI catchers — precisely because the public record is so thin. Rayhunter is the point where that documentation work becomes a community-powered dataset instead of an advocacy paper: cheap enough that ordinary people can contribute primary evidence.

Possibly, if it is new enough. Android 16 added an optional "Network notifications" setting under Mobile network security. It warns you when the network asks for your phone's unique identifiers or moves you to an unencrypted connection. It needs a modem that supports version 3.0 of Android's IRadio interface, so in practice it appears on newer devices such as the Pixel 10 rather than older phones. It is off by default. iPhones have no equivalent alert, but Lockdown Mode turns off 2G and 3G support. A warning is a lead, not proof: legitimate networks can trigger it too.

Yes. Federal contracting records show ICE paid $825,000 in May 2025 for vehicles equipped with cell-site simulators, after an $818,000 contract with the same vendor in September 2024. Courts are scrutinising how they are used. In June 2026 a federal magistrate judge in Akron, Ohio, refused a warrant to run one for up to 30 days at five locations, because the government did not explain the device's reach or how many bystanders it would capture.