When digital surveillance is suspected, handing over a smartphone in person at short notice is not always possible—for example, during a business trip, while abroad or when the client is far away. For suitable iOS and Android devices, the AQON INTELLIGENCE Quick-Check enables an authorised remote analysis of network traffic without the mobile device having to be physically present in the central examination rooms in Krefeld or the forensic laboratory in Vaterstetten near Munich during this check.
The mobile device remains with the user. A secure, expressly authorised remote connection is established for the session. Network traffic relevant to the examination is made available to the analysis device and assessed technically. This may include unusual communication destinations, atypical connections, technical anomalies and possible Indicators of Compromise (IoCs). An IoC is a technical indicator, not automatic proof of compromise. An unfamiliar domain or IP address is not automatically spyware either. The results must always be assessed by a specialist.
Checking a mobile device for spyware without shipping it
In a conventional on-site or laboratory examination, the mobile device may be examined more comprehensively, depending on the assignment, device and technical feasibility. This can include acquiring and analysing available device data. For this type of smartphone forensics, the device generally has to be physically available for examination.
The AQON INTELLIGENCE Quick-Check takes a narrower approach: the mobile device remains with the user while network traffic relevant to the session is technically analysed through an authorised connection. This can provide an initial assessment at short notice, but it does not replace a complete examination of the device storage.
How the AQON INTELLIGENCE Quick-Check works
1. Assignment and technical pre-check
Before the session, the question to be examined, the mobile device in use and the technical requirements are clarified. This determines whether the AQON INTELLIGENCE Quick-Check is suitable for the specific case.
2. Establishing an authorised remote connection
The secure connection is established only with express authorisation for the device being examined. The mobile device remains with the user throughout.
3. Analysing network traffic during the session
Network traffic relevant to the examination is made available to the analysis device and technically assessed within the agreed period.
4. Assessing anomalies and possible IoCs
Communication destinations, recurring patterns, technical anomalies and possible IoCs are not considered in isolation. They are assessed in the context of the device, its use and the examination period.
5. Documenting the result and recommending next steps
The findings and the limits of what they can establish are documented transparently. If further clarification is needed, suitable next examination steps are recommended.
What is analysed technically?
The examination may cover communication destinations, domains and IP addresses where technically visible, as well as connection times, recurring communication patterns, unusual endpoints, technical anomalies and possible IoCs.
Encrypted HTTPS content is not routinely decrypted. Message content is not read as part of this network-traffic analysis. Visibility and evidential value depend on the connection, device, services used and other technical conditions.
What is an Indicator of Compromise?
An Indicator of Compromise, or IoC, is a technical characteristic or artefact that may point to a possible compromise. Examples can include unusual communication destinations or particular behavioural patterns.
An IoC is an indication, not proof on its own. The same technical finding may have a legitimate or suspicious cause depending on its context. It must therefore be compared with other findings and assessed by a specialist.
What the AQON INTELLIGENCE Quick-Check expressly is not
The AQON INTELLIGENCE Quick-Check is not a complete remote forensic extraction of the device storage and not a complete substitute for smartphone forensics. It does not guarantee that every form of spyware will be detected. Equally, an unremarkable result does not prove that a device was never compromised in the past.
The check is a focused network-traffic analysis within the agreed scope and period. More extensive questions may require an in-depth spyware examination or a physical examination of the device.
When is the Quick-Check useful?
The AQON INTELLIGENCE Quick-Check can be particularly useful during business trips or stays abroad, and for executives and internationally active companies. It may also be appropriate where there is an immediate concern but an in-person handover or shipment of the device is not possible at short notice.
Whether the method is suitable in an individual case depends on the question, the device and the technical conditions. These points are clarified before work begins.
Available worldwide—subject to technical requirements
The analysis can generally be carried out independently of location where a suitable internet connection, a compatible device, the required technical conditions and express authorisation are available. It therefore cannot be promised for every location or every device.
The stability and quality of the connection can affect the scope of communication that is technically observable. Suitability is therefore checked before the appointment.
Complementing technical surveillance counter-measures
A technical surveillance counter-measures examination examines rooms, vehicles or other areas for unwanted recording, tracking or transmission technology. Digital device and network-traffic analysis, by contrast, considers the communication paths of a mobile device.
These two fields of examination must be kept professionally distinct because they assess different information channels. Depending on the suspected scenario, however, they may complement one another effectively.
Price of the AQON INTELLIGENCE Quick-Check
For consumers, the price is **€892.50 gross per device**.
€750.00 net + €142.50 VAT (19%) = €892.50 gross per device.
The price applies to the focused network-traffic analysis described here, including professional assessment. The precise scope and technical requirements are agreed before work begins.
What happens if a suspicious finding is identified?
Unusual communication destinations, anomalies or possible IoCs are first assessed technically. This includes considering legitimate explanations and whether further findings support or reduce the concern.
Depending on the findings, further smartphone forensics or a spyware examination may be recommended. The contact page is available to discuss the specific case.
Can an unremarkable Quick-Check rule out a compromise?
No. An unremarkable result means only that no corresponding anomalies were identified within the examined scope and period. It provides neither a 100% all-clear nor proof that the device was never compromised previously.
Technical surveillance can change, remain temporarily inactive or occur outside the network traffic examined. The significance of the result is therefore always limited to the specific session.
Advanced or state-deployed spyware such as Pegasus and FinFisher/FinSpy
Highly developed spyware, including products associated with state deployment such as Pegasus and FinFisher/FinSpy, can use changing infrastructure, temporary communication patterns and methods designed to reduce technical visibility. A remote network-traffic analysis can identify relevant anomalies or known IoCs where these are observable during the agreed session, but it cannot guarantee detection of a particular product.
The absence of a known IoC is not proof that no compromise exists. Findings must be interpreted in context, and a physical forensic examination may be required where the question cannot be answered within the limits of the AQON INTELLIGENCE Quick-Check.
Conclusion
The AQON INTELLIGENCE Quick-Check is a location-independent initial technical security analysis for suitable mobile devices. The mobile device remains with the user while relevant network traffic is examined through a secure and expressly authorised connection.
Where distance or an urgent need for clarification makes physical handover impractical, the method can provide a professionally assessed first result. It remains a focused network-traffic analysis and does not replace complete device forensics.