RF Sentinel

BLE & WiFi police scanner for Android

Passively detects body cameras, license-plate cameras, patrol vehicles, drones, trackers following you, camera glasses and fake cell tower signs from the signals they already broadcast. No root, no Termux, no account.

Website · Q&A · How it works · Discord

   

_{Live list (DedSec theme), why a device is flagged, the fsociety theme, and the Android Auto live map. Demo data. All 13 themes · Android Auto}

---

Contents

• At a glance
• What it detects
• Features
• Quick start
• How it works
• Using the app
• Android Auto
• ESP32 boards
• Themes
• Privacy
• Limitations
• Q&A
• Building from source
• Signatures and sources
• Contributing
• Acknowledgements
• License · Disclaimer

At a glance

What	A non-rooted Android app that lists every Bluetooth LE and WiFi device around you with its vendor, type and signal, and flags law-enforcement and surveillance equipment
How	Receive-only: reads advertisements, beacons and cell info that devices broadcast publicly. Never transmits to, connects to or jams anything
Runs on	Android 8.0+ phones, Android Auto, plus optional ESP32 boards (OUI-Spy, GhostESP)
Costs	Nothing. GPL-3.0, no ads, no account, no subscription, no analytics
Alternative to	SØPHIA / s0phia ops: same kind of passive BLE and WiFi recon as a normal APK, no Termux. Independent project, not affiliated with SØPHIA or DetecX

What it detects

Category	Examples	Identified by
Body cameras	Axon, Motorola / WatchGuard, Digital Ally, Zepcam, Vievu, Utility, Getac, in-car video	BWCDEVICE payload tag, TASER company ID 0x034D, Axon UUIDs 0xFC81 / 0xFE6B / 0xFE6C, IEEE prefixes such as 00:25:DF
License-plate readers	Flock Safety, Genetec, Perceptics, Quercus, Tattile	Flock- SSIDs, FS Ext Battery / Penguin- / FS- BLE names, company ID 0x09C8, plus the OpenStreetMap / DeFlock camera map
Speed & red-light cameras	Fixed cameras mapped in OpenStreetMap	Offline map layer, warned ~30 s ahead with the mapped limit
Audio sensors	Flock Raven	128-bit service UUIDs 0x3100-0x3500
Patrol vehicles	Two or more kinds of police-type gear travelling together	Signal correlation between body cams, radios, in-car routers, printers, rugged laptops
Public-safety gear	P25 / TETRA radios, police radar makers, vehicle upfit, Zebra e-ticket printers, cell-site simulator and forensic makers	Company IDs, UUIDs, IEEE prefixes, Zebra factory-serial names
Trackers	AirTag & Find My, Google Find Hub, Samsung SmartTag, Tile	Separated-from-owner frames, then follow detection
Drones	Any ASTM F3411 / FAA / EU Remote ID broadcaster	Decoded Remote ID over BLE and WiFi: serial, position, altitude, speed, operator location
Camera glasses	Ray-Ban Meta, Snap Spectacles, Vuzix, HeyCyan-based glasses	Company IDs 0x0D53, 0x03C2, 0x060C, Meta UUIDs
Fake cell towers	IMSI catchers / cell-site simulators	Test network codes, sudden 4G→2G, cloned or reserved cell identities, unexpected networks
Network cameras (off by default)	Arlo, Blink, Ezviz, Wyze, Amcrest, Swann, Night Owl...	SSIDs and IEEE blocks

Every match shows its evidence, its source and a confidence tier: weak (< 50), probable (50-79) or strong (80+). Full reference: docs/SIGNATURES.md.

Features

Detection

• Payload, name, UUID and company-ID signatures plus IEEE vendor prefixes (MA-L / MA-M / MA-S), each with a cited source and a confidence
• Evidence fusion: independent matches on one device strengthen each other (noisy-OR, capped at 90)
• Patrol-vehicle detection: police-type gear whose signals rise and fall together is grouped as a possible police vehicle
• Address-rotation linking: keeps following a device when its Bluetooth address changes
• Follower alerts: a tracker or flagged device that stays with you (default 10 min and 800 m, adjustable) raises may be following you
• Remote ID drones decoded live, with a drone overhead alert within 200 m
• Fake cell tower signs checked every 15 s, with persistence, call and border suppression (modelled on EFF's Rayhunter as far as Android allows without root)
• Hidden WiFi networks identified from WPS data, Cisco AP names and vendor elements, and linked to the visible network on the same router
• Ordinary devices named precisely: exact AirPods / Beats model, device class, IEEE registrant; decoded Apple Continuity, iBeacon, Eddystone, Fast Pair
• Editable watchlist (exact addresses, prefixes, name / vendor rules) with Global, Canada and US presets; per-category on/off switches
• Bluetooth 5 extended advertising and LE Coded (long range) where the phone supports it; a filtered scan keeps key signatures alerting with the screen off

Known cameras

• Plate-reader, speed and red-light cameras from OpenStreetMap appear on the map by themselves and are kept offline, refreshed weekly
• Warned as you approach one, even cellular-only cameras no radio can detect
• Pre-download everything within a radius you set (10-200 km), or every mapped Flock camera in the US and Canada (~143,000)
• Tap a camera to silence its alerts for good

Alerts

• Sound, vibration pattern per tier (1 / 2 / 3 pulses) and spoken announcements through the phone's own speech engine (prioritised, voice and speed pickers)
• Discreet mode, adjustable alert threshold, mute from the app or the car
• Floating threat bubble over Waze, Google Maps or any app
• Notification, Quick Settings tile and home-screen widget

Map & history

• OpenStreetMap map with your GPS trace and every device placed where its signal peaked, the same filter chips as the list, self-centering
• Record traces of your route and the devices along it, with the screen off
• History map & timeline: heatmap of where flagged equipment showed up, and when (hour of day, day of week)

Driving

• Android Auto app: threat headline, device lists, live map with cameras and drones, OpenStreetMap turn-by-turn navigation, alerts through the car speakers
• Starts by itself in the car (your car's Bluetooth or Android Auto) and stops when you leave
• Night Drive red-only theme; screen stays on while charging

Hardware

• ESP32 boards over USB OTG (OUI-Spy, GhostESP) or Bluetooth (OUI-SPY App-Controlled) add their detections and extend range

Interface

• Live list and radar view, filter chips with live counts (flagged, trackers, drones, new, ESP32, favorites, Bluetooth, WiFi), search
• Device details: evidence, identity, decoded data, signal graph, Locate mode, history, raw advertisement
• Setup wizard (theme, region, alerts, camera radius, screen, permissions)
• 13 themes, including the DedSec (Watch Dogs 2) and fsociety (Mr. Robot) fan themes

Data & privacy

• Everything stays on the phone; export as CSV, JSON, KML, GPX or GeoJSON
• Report unknown device: a privacy-safe signature (no full address, serials, location or times) to help add new equipment
• No accounts, no cloud, no analytics

Quick start

Requires Android 8.0 or newer.

1. On your phone, tap Download the app above, or open the latest release.
2. Under Assets, tap the file ending in -release.apk (not the "Source code" archives).
3. Open the downloaded file from the notification, or from Files → Downloads.
4. If Android blocks it, tap Settings, enable Allow from this source, go back and tap Install.
5. Open RF Sentinel. The setup wizard walks you through theme, region, alerts, camera radius and permissions.
6. Tap Start scanning and grant location and Nearby devices.

Updating: install the newer APK over the existing one. History and settings are kept. Samsung, Xiaomi or OnePlus stopping the scan? Set RF Sentinel's battery usage to Unrestricted (Settings has a shortcut).

How it works

BLE adverts ─┐
WiFi beacons ─┼─> signatures + watchlist ─> evidence fusion ─> patrol grouping ─> alerts
Cell info ────┤    (SIG IDs, UUIDs, payload   (noisy-OR,       (RSSI correlation    (sound, voice,
ESP32 boards ─┘     tags, IEEE prefixes)       cap 90)           r ≥ 0.6, ≥ 8 s)      bubble, car)
                         │
                         └─> address-rotation linking ─> follow detection (time + distance with you)

• Confidence tiers: weak < 50 (amber, silent by default), probable 50-79 (alerts at the default threshold), strong 80+.
• Fusion: 1 - (1 - top) × Π(1 - 0.5 × support); e.g. watchlisted address 70 + Zebra serial name 50 → 78.
• Patrol vehicle: at least two different roles whose RSSI correlates (Pearson r ≥ 0.6 over ≥ 8 s), or both parked and seen within 30 s; scored 24 + 12 × roles, +10 if moving together, cap 88.
• Rotation linking: same advert fingerprint (names, UUIDs, payload sizes, TX power, connectable) as exactly one device that went silent 1.5-30 s earlier.

Details: How it works and docs/SIGNATURES.md.

Using the app

Main screen

• Threat banner: all clear, weak, probable or strong, or may be following you.
• Live list: every device heard in the last 3 minutes, with vendor, type, radio, signal, rough distance, and NEW / ★ / FOLLOWING badges. A green INTERNAL badge means the phone heard it; a blue ESP32 badge means a connected board reported it. Flagged devices sort first and flash in their category colour.
• List / Radar / Map: the toggle switches list and radar; Map sits right next to it. On the radar, closer to the centre means a stronger signal; the angle is not a direction (a phone can't measure one).
• Filters and search: All, Flagged, Trackers, Drones, New, ESP32, Favorites, Bluetooth, WiFi. Search matches name, address, vendor and type.
• Tap a device for details. Long-press for watchlist, whitelist, favorite, copy, ignore, and Report unknown device.
• Floating bubble (Settings, needs Display over other apps): green when clear, orange for probable, red for strong or a follower, with the count.
• In the car (Settings → Start scanning automatically in the car): pick your car's Bluetooth; scanning starts when the phone connects to it or to Android Auto, and stops when you leave if the car started it.

Device details

The app never connects to a device. The details screen shows why it's flagged (each signature with its evidence and source), identity and how it was determined, address type and trackability, decoded protocol data, WiFi band, channel and security, drone Remote ID with drone and operator positions, a live signal graph with Locate mode (beeps faster as you get closer), history, and the raw advertisement.

Map and traces

• The map shows your position, the trace being recorded, and every device heard around you, placed where your phone was when its signal was strongest. That's an approximation, not a fix. Devices heard from the same spot fan out when you zoom in.
• Known cameras (map menu ⋮): Download nearby cameras fetches plate readers within your radius (10-200 km, 100 by default); Download Flock fetches every plate reader mapped in the US and Canada (~18 MB, refreshed weekly on WiFi). Both use DeFlock's hourly snapshot of OpenStreetMap, plus cameras it leaves out, straight from OpenStreetMap. Tap a camera → Ignore alerts to never be warned about it again.
• Record trace saves your route and every device heard along it, with the screen off, and can start with each scan.
• Screen: always on, on while charging (default) or normal.

Export

Menu → Export all devices... or Export...:

Export	Formats
Current scan (all devices)	CSV, JSON, KML
All devices ever seen	CSV, JSON
Match log	CSV, JSON, GPX, KML
Recorded traces	GPX, KML, GeoJSON, CSV
Watchlist	JSON
Everything in one file	JSON

Android Auto

A driver-safe, template-based Android Auto app:

_{Home, flagged devices, live map, and known cameras (demo data).}

• Home: threat headline, live counts, Start/Stop, and a speaker button that mutes or unmutes all alert sound.
• Device lists (flagged, drones & trackers, all nearby) and details with Whitelist, Watch and Favorite. Navigate hands drones with a known position to your navigation app.
• Live map: RF Sentinel's own OpenStreetMap map on the car screen with devices, known plate / speed / red-light cameras and your position. Drag, pinch or + / −; ◎ follows the car again. Needs car API level 7; older Android Auto gets car-drawn maps with device and camera lists.
• Navigation: Navigate to... searches with Nominatim (on submit only), keeps recent destinations on the phone, routes with OSRM, speaks turns and re-routes.
• Alerts appear as heads-up cards and play through the car speakers as navigation audio, briefly lowering your music.

Sideloaded apps need one-time setup: Android Auto settings → tap Version ten times → ⋮ → Developer settings → enable Unknown sources. Then install (or reinstall) the APK, open RF Sentinel once on the phone, and reconnect. Still missing? Check Customize launcher for hidden apps.

ESP32 boards (optional)

Plug an ESP32 board into the phone with a USB OTG cable while scanning (allow USB access the first time), or pair one over Bluetooth. What the board reports merges into the list with a blue ESP32 badge.

Firmware	Link	What RF Sentinel gets
OUI-Spy (recommended)	USB	Flock-You, Detector and Sky Spy detections as they happen: Flock cameras, the board's watchlist matches, Remote ID drones with position
OUI-SPY App-Controlled	Bluetooth	Flock-BLE, Flock-WiFi, Sky Spy, Detector and (optional) Wardrive survey engines
GhostESP	USB	The WiFi networks it scans, about every 10 s

Native-USB boards (ESP32-S2/S3/C3/C6) and boards with a CP210x or CH340 bridge work. RF Sentinel never sends OUI-Spy anything over USB, and only asks GhostESP to scan and list networks.

OUI-SPY over Bluetooth: start scanning with the board on, then Settings → Pair OUI-SPY board and pick OUI-SPY-xxxx. Pair it only there, not in Android's Bluetooth settings: the board keeps no pairing keys, so a phone-side pairing breaks the link (the app tells you to tap Forget if it finds one). While scanning, RF Sentinel switches on the board's Flock-BLE, Flock-WiFi, Sky Spy and Detector engines, and by default its Wardrive survey engine so the board relays every WiFi network and Bluetooth device for RF Sentinel's own rules. In that mode the board sends standard WiFi probe requests; turn Settings → OUI-SPY: relay every network and Bluetooth device off to keep it listening only. The board's UniPwn, PCAP and Foxhunter engines are never used.

Themes

Pick a theme in the setup wizard or under Settings → Appearance.

Theme	Look
DedSec	Watch Dogs 2-style: black and white with electric blue, a full-width DedSec poster banner, a sliced wordmark and a marcus@ctOS-2.0:~$ terminal typing hacktivist lines
fsociety	Mr. Robot-style: black and blood red, a full-width fsociety poster banner, a red striped wordmark and a root@fsociety:~# terminal typing quotes from the show
Night Drive	Red-only cockpit HUD that preserves night vision while driving
Night Vision	Green phosphor image intensifier with grain and a scope vignette
Amber CRT	1980s terminal with a blinking cursor and scanlines
Synthwave	Chrome title, striped sunset and a scrolling wireframe grid
Tactical	Olive and coyote tan, stencil callsign, Zulu clock and reticle
Blueprint	Technical drawing on drafting blue
Paper	Newspaper masthead, the most readable theme in direct sunlight
System / Light / Dark / Material You	Standard looks; Material You follows your wallpaper colours

DedSec	fsociety	Night Drive	Night Vision
Amber CRT	Synthwave	Tactical	Blueprint
Paper	System	Light	Dark
Material You

Radar view in every theme

DedSec	fsociety	Night Drive	Night Vision
Amber CRT	Synthwave	Tactical	Blueprint
Paper	System	Light	Dark
Material You

_{Screenshots use made-up demo devices (debug builds only), run through the real detection pipeline, so scores, groupings and labels match what the app shows.}

Privacy

• Receive-only. Nothing is transmitted, jammed, spoofed or connected to.
• No accounts, no cloud, no analytics. Detections live in a local database excluded from cloud backup.
• Network use is limited to OpenStreetMap data: map tiles while the map is open, and the known-camera list for the area you look at, fetched once per area and refreshed weekly from overpass-api.de (or the mirrors overpass.kumi.systems and overpass.private.coffee). Camera downloads also fetch DeFlock's region files from cdn.deflock.me. These servers see your IP address and the area, never your scans. Turn off Show known cameras automatically to fetch only when you tap a download. In Android Auto, navigation uses Nominatim and OSRM only when you search or start a route. Map data © OpenStreetMap contributors (ODbL).
• Data leaves the phone only when you export or share it.
• Optional permissions: Nearby devices → connect only to list your paired Bluetooth devices when you pick your car; Display over other apps only for the floating bubble. No contacts, storage, camera or microphone access.

Limitations

• A match is a signature, not an identification. 00:25:DF means "a device registered to Axon Enterprise", not "a police officer". Verify weak matches.
• Phone radios are weaker than dedicated hardware. Expect shorter range and fewer catches than purpose-built scanners; an ESP32 board helps.
• WiFi scanning is throttled by Android to about four scans per two minutes; the default 30-second interval respects that.
• WiFi only sees access points. Client devices, such as in-car laptops, are invisible without monitor mode.
• Signal strength is not distance. Estimates are often off by 2-3×, and the radar angle is not a direction.
• Screen-off coverage is partial. With the screen off, Android keeps only a filtered scan: payload signatures, trackers, drones, glasses and exact-address watchlist entries keep working, prefix-only matches don't.
• Cellular-only devices are undetectable by radio, including most non-Flock plate readers and LTE GPS trackers. The known-camera map covers mapped ones.
• Not a radar detector. Police radar and lidar, and radios' voice channels (VHF / UHF / 700 / 800 MHz), can't be received by a phone.
• Fake cell tower checks are heuristic. Without root, Android shows the cells but not ciphering or signalling, so each sign has innocent explanations. The strongest protection is turning off Allow 2G (Android 12+); Android 15+ can also warn when a network asks for your SIM identity or turns encryption off (Cellular security → Network notifications, linked from Settings).
• Randomized addresses defeat vendor-prefix matching. Payload signatures and rotation linking partly compensate.
• Android only. iOS doesn't expose the advertisement data, WiFi scans or cell info this needs.

Q&A

How do I detect police with my Android phone?

Install RF Sentinel, tap Start scanning, and grant location and Nearby devices. It matches the Bluetooth LE and WiFi signals of body cameras, radios, in-car routers, printers and plate readers, and groups gear that moves together into a possible police vehicle. More

How do I know if an AirTag is following me on Android?

A separated AirTag broadcasts Apple company ID 0x004C, type 0x12. RF Sentinel flags it, follows it through address changes, and warns once it has been with you for 10 minutes over 800 m (adjustable). Locate mode helps find it. More

Can it detect Flock cameras?

Yes: Flock- WiFi networks, Flock BLE names and company ID 0x09C8, plus every Flock camera mapped in OpenStreetMap / DeFlock, offline. More

Can it detect a Stingray / IMSI catcher without root?

It checks the signs Android exposes: test network codes, sudden 4G→2G switches with strong LTE still visible, cloned or reserved cell identities. It's heuristic; disabling 2G is the real protection. More

Is there a free alternative to SØPHIA (s0phia ops)?

RF Sentinel: free, open source, a normal APK without Termux. Comparison

Does it need root? Is it on Google Play?

No root. Not on Google Play: the signed APK is on GitHub Releases.

70+ more answers on the Q&A page.

Building from source

Requirements: Android Studio, or JDK 17+ with the Android SDK (platform 37).

./gradlew assembleDebug

./gradlew testDebugUnitTest lintDebug

The debug APK is written to app/build/outputs/apk/debug/. tools/gen_assets.py regenerates the offline IEEE and Bluetooth SIG databases. The website is built from site/ with python tools/build_site.py (see site/README.md).

Component	Version
Gradle	9.6.0 (wrapper included)
Android Gradle Plugin	9.4.0 (built-in Kotlin)
KSP / Room	2.3.12 / 2.8.5
compileSdk / targetSdk / minSdk	37 / 36 / 26

Signed release builds

./gradlew assembleRelease signs the APK using keystore.properties in the project root (git-ignored):

storeFile=keystore/rfsentinel-release.jks
storePassword=...
keyAlias=rfsentinel
keyPassword=...

Without this file, the release APK is unsigned. Updates must be signed with the same key as the installed app, so keep the keystore backed up. Each version is published as a GitHub Release with the signed APK attached. Bump appVersionCode and appVersionName in app/build.gradle.kts for every release.

Demo data for screenshots

Debug builds can fill the list with made-up devices that run through the real detection pipeline:

adb shell am start -n com.rfsentinel.app.debug/com.rfsentinel.app.MainActivity --ez demo true

Signatures and sources

Every bundled prefix, company ID and UUID was checked against the IEEE registry or the Bluetooth SIG assigned numbers, and each entry cites its source, score and category. The full reference, including evidence fusion, patrol-vehicle detection and WiFi identification, is in docs/SIGNATURES.md.

• all-cameras-are-beacons signature reference (Apache-2.0): signature values and confidence ladder
• opendroneid-core-c (Apache-2.0): Remote ID message layout
• IEEE Registration Authority: vendor database
• Bluetooth SIG assigned numbers: company IDs, service UUIDs, appearance values

Contributing

• Found an unidentified device? Long-press it → Report unknown device, check what's shared, and paste it into a new issue or the Discord.
• New signatures are welcome when they cite a registry or published research. Please don't guess.
• Map cameras in OpenStreetMap (e.g. through DeFlock): every RF Sentinel user gets them.
• Bugs and ideas: issues or Discord.
• Star the repo so others find it.

Acknowledgements

Inspired by the nyanBOX hardware device and the RF Party app, which was based on Alan Meekins' DEF CON 31 talk "Snoop Unto Them As They Snoop Unto Us". Some feature ideas come from SØPHIA and BLE Radar (MetaRadar). No code from those projects is included.

Part of the MAC-prefix data was cross-checked with, and extended from, the lists in Flock You and OUI-Spy (with @NitekryDPaul's nite-oui-collection), Wardrive Go, Flock-You-Android and Fieldwatch - thank you. Every prefix was re-checked against its IEEE registrant; see docs/SIGNATURES.md. Known plate-reader locations come from DeFlock's snapshot of OpenStreetMap, mapped by its volunteers (data © OpenStreetMap contributors, ODbL) - thank you. The DedSec and fsociety theme font is Share Tech Mono (SIL Open Font License 1.1). The DedSec theme is an unofficial fan homage to Watch Dogs; its header poster uses DedSec imagery. Watch Dogs, DedSec, ctOS and Blume are trademarks of Ubisoft. The fsociety theme is an unofficial fan homage to Mr. Robot and quotes short lines from the show; Mr. Robot is a trademark of Universal Content Productions. RF Sentinel is not affiliated with or endorsed by Ubisoft, USA Network or NBCUniversal.

License

Copyright © 2026 CIS-C0

RF Sentinel is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License v3.0 as published by the Free Software Foundation. It is distributed in the hope that it will be useful, but without any warranty; see the LICENSE file for the full text.

Any modified version you distribute must also be released under GPL-3.0 with its source code. Bundled third-party material keeps its own license: the Share Tech Mono font (SIL Open Font License 1.1, app/src/main/assets/licenses/), and the signature and Remote ID references credited above (Apache-2.0).

Disclaimer

RF Sentinel is provided for awareness, research and personal privacy. Whether passive Bluetooth and WiFi scanning is legal depends on where you are, so check your local laws. A detection indicates that a device with a given signature is nearby. It is not proof of who is present or what they are doing. This is not legal advice.