A practical detector, not a magic shield
Rayhunter addresses a hard security problem with a surprisingly understandable product. Cell-site simulators impersonate legitimate cellular towers, causing nearby devices to reveal identifiers or accept weaker connection conditions. Detecting that behavior has traditionally required a rooted phone or an expensive software-defined radio setup. Rayhunter instead installs on certain inexpensive mobile hotspots and watches the control traffic between the modem and the network.
The distinction between control traffic and user traffic matters. Rayhunter is not reading web requests or message contents. It records signaling data, analyzes it on the hotspot, and changes a visible line from green to yellow, orange, or red when a heuristic fires. A local web interface lets the user stop or start recordings, inspect warnings, and download captures for deeper review.
That is useful, but it is detection rather than protection. Rayhunter does not prevent a phone from connecting to a suspicious tower, and an alert is not a verdict. EFF's FAQ says there is no universal response because the circumstances vary. Depending on the threat, turning off nearby phones and leaving the area may be appropriate, but the software cannot make that decision for you.
The heuristics are thoughtful and explainable
Rayhunter's strongest technical choice is to look for sequences and conditions rather than treating every identity request as hostile. A normal network may ask for an IMSI or IMEI during initial attachment, roaming, a temporary-identifier failure, or a core-network restart. The IMSI Requested analyzer becomes suspicious when an identity request appears in a sequence without expected authentication, after authentication, or without the device first connecting to the tower. The documentation acknowledges a false-positive case around aircraft reconnecting near landing.
Other analyzers look for a forced redirect toward 2G, LTE broadcasts that prioritize older networks, incomplete system-information chains, and requests for null encryption at the radio or NAS layer. Each explanation includes the legitimate network behavior, the suspicious variation, and known ambiguity. Users can disable noisy or experimental heuristics because behavior differs across countries and carriers. A deliberately loud test analyzer fires when a new tower appears, providing a reasonable installation check without asking users to build an illegal test transmitter.
The analysis can improve after data is collected. Old captures may be reanalyzed on the device or with the bundled rayhunter-check desktop tool. That feature is valuable for research, but it also proves why a colored line should not be treated as permanent truth: refined heuristics can turn a former warning green or flag a recording that was previously clear. Preserve the software version and raw capture alongside any finding.
Hardware selection is part of setup
The project now documents eight functional device families, but only two sit in the recommended tier. The Orbic RC400L is the preferred choice for the Americas; the TP-Link M7350 is recommended for Africa, Europe, and the Middle East. Buyers must compare a device's supported frequencies with local networks. A cheap hotspot from the wrong region can install correctly and still be a poor sensor.
Installation from a release is manageable. Download the archive for the host computer, connect to the hotspot, run an installer command for that model, and wait for a reboot. Orbic installation may require its admin credentials. TP-Link needs a FAT-formatted SD card for recordings. Release assets cover Windows, Intel and Arm macOS, x64 and Arm Linux, but the guide says the documented flow has only been tested on macOS and Ubuntu 24.04. An open August report also says TP-Link hardware version 10 may hang during installation because expected networking settings are absent. Exact hardware revisions still matter.
Source builds are a different tier of work. They combine a Rust daemon and installer with a SvelteKit interface, plus Node.js and C build tools. Device access varies across trimmed Android systems and modem interfaces. The source guide warns that people have bricked Orbic units while using ADB on Windows. Most users should take that as a firm reason to use a published release and a recommended device.
Treat captures and the interface as sensitive
Rayhunter's web dashboard is served over HTTP. The docs tell users to click through the browser's insecure-connection and blocked-download warnings. That is tolerable on a dedicated hotspot network under your control, but enabling Wi-Fi client mode makes the dashboard reachable from another local network. Operators should decide who can join that network and avoid exposing port 8080 beyond it.
The recordings deserve stricter handling. EFF warns that a capture may contain the SIM's IMSI and unique identifiers for nearby towers, which can help reconstruct where the device was. Optional GPS collection can add exact location history, and WebDAV upload can move closed QMDL and analysis files to another server. Those features are excellent for field teams, but only when retention, access, transport, and deletion policies are decided before collection.
Healthy enough for field use, still research software
The repository was pushed on August 14, 2026, one day before this review, and release v0.12.0 arrived on August 3. That release added compressed capture support, serving-cell and neighbor-cell measurements, JSON output for the checker, a roaming false-positive fix, and dependency updates. GitHub reported 94 open issues and PRs, with same-day discussion and contributions around SIM health, clock drift, and analyzer behavior. This is active maintenance, not a dormant security demo.
Open reports still cover real operational problems: false alerts around suspicious identity requests, a TP-Link installation revision, PinePhone installation failures, and malformed capture handling in the desktop checker. The right conclusion is not that Rayhunter is unreliable. It is that cellular networks and inexpensive modem hardware create messy evidence.
For field research, Rayhunter combines the right things: affordable hardware, transparent detection logic, a simple physical indicator, raw evidence export, and unusually good documentation. Use the recommended hardware, keep it updated, protect the captures, and have an expert review serious alerts. Under those conditions, it turns a specialist investigation into something a small organization can genuinely operate.