RFrf_sentinel / guides / imsi-catcher-detector
Stingray / IMSI catcher signs
A cell-site simulator pretends to be a tower so phones attach to it, often forcing them down to 2G where encryption is weak or absent. Without root a phone can't read the signalling, but the cell data Android does expose still shows some of the tell-tale signs.
What Android exposes without root
TelephonyManager.getAllCellInfo() returns the serving and neighbour cells: radio technology (GSM / WCDMA / LTE / NR), MCC-MNC, cell ID, area code (LAC / TAC), and signal. It does not expose ciphering, identity requests or other layer-3 messages; that needs the modem's diagnostic interface (root, or dedicated hardware like Rayhunter).
Signs RF Sentinel checks every 15 s
| Sign | Score |
|---|---|
| Serving cell on a test / reserved MCC (001, 002, 999) | 85 |
| Sudden switch from 4G/5G to 2G while strong LTE (≥ −105 dBm) is still visible | 70 |
| Sudden 4G/5G → 2G without strong LTE; or downgraded to 2G with strong LTE visible | 50 |
| Network country code differs from the SIM's while not roaming | 55 |
| Reserved identity: area code 0, 0xFFFE or 0xFFFF, or cell ID 0 | 45 |
| Known cell number reappearing in a different area (cloned identity) | 50 |
| Location / tracking area changed while GPS shows you still for 2+ minutes | 40 |
| Switched to a cell with no neighbours where several were visible | 35 |
| Several signs at once | max + 15, cap 90 |
Cutting false alarms
- Persistence: a sign must be present on two consecutive checks.
- Calls: drops to 2G during a call (and for 2 minutes after) are ignored: many networks hand voice to 2G/3G.
- Borders: area codes ping-ponging at a coverage border don't count.
- Known areas: which area each cell lives in is remembered on the phone (cleared with "Forget device history"); a genuinely moved cell is adopted after 8 snapshots.
Actual protection
- Settings → Network → SIM → turn off Allow 2G (Android 12+, if your carrier allows it).
- Android 15+: Cellular security → Network notifications warns when a network requests your SIM identity in clear or disables encryption. RF Sentinel's Settings links straight there.
- For signalling-level detection, run EFF's Rayhunter on a supported hotspot.
Questions
Is a rooted phone better for IMSI catcher detection?
Yes, with a Qualcomm or similar modem that exposes diagnostic logs, a rooted phone (or Rayhunter) can see identity requests and cipher mode. RF Sentinel stays root-free and limits itself to what public APIs show.
Does 5G protect against IMSI catchers?
5G standalone encrypts the permanent identity (SUCI), but most networks still run non-standalone 5G anchored on LTE, and downgrade attacks to 2G/3G remain the main vector. Disabling 2G closes the easiest one.