How to check that an Android device isn't being used in a botnet / sending spam emails? I've discovered that my home network IP address has ended up on several blacklists after spam traps received emails from this IP address. I've tested the one PC that uses this network, and it seems to be fine. That leaves the most likely culprit looking like one of the two Android devices on this network.

On a PC, common ways to check for botnet-type activity include checking traffic on specific ports, and monitoring outgoing traffic. Is there any equivalent for Android?



I've searched on this but found nothing beyond generic anti-malware articles talking about antivirus software. I've not found anything specific to spam or unsolicited outgoing mail, and common anti-malware apps like AVG and Avast seem to only mention spam in the context of preventing incoming spam (not a problem for me), not outgoing.

If possible, I'd prefer a solution based on checking for the actual malicious activity (i.e. detecting actual outgoing mail), rather than relying that an anti-malware app has its listings up to date. 

If possible, I'd also prefer to not need to root the devices, or change the operating system from the manufacturers' (Samsung and Sony in my case).
I suggest using the Android VPN feature to route all of your network traffic to an OpenVPN server. This will send all traffic, Wifi and cellular, through one chokepoint where you can log and analyze it, and it will do so regardless of what network the phone is using. Then you can log and analyze traffic from the OpenVPN server using any of the standard tools.

For an example of a project that uses this approach for a different sort of network security analysis, namely to find apps that send data over unencrypted or insecurely-encrypted connections, see nogotofail.