Skip to content
~/apkbasket$ cat ./about/dossier.md

An APK index built by the engineers
who used to break mobile malware
for a living.

APKBasket was founded in Tallinn in 2018 by two former Lookout Security engineers. We run every upload through a 47-point integrity scan before it ever reaches the basket — 14 minutes median turnaround, version-pinned, SHA-256 signed, no surprises. This page documents the people, the policy, and the numbers behind that standard.

est. 2018 · Tallinn, EE
founder background Lookout Security (mobile)
verification 47-point scan · 14 min median
uptime (24 mo) 99.97% · StatusGator audit
Read the Scanner Methodology → Live Scanner Status
// 001 · origin

Two mobile-security engineers walked out of Lookout in 2017. By mid-2018 they had an index that refused to ship unsigned APKs.

The premise was simple and slightly stubborn: the public Android mirror ecosystem in 2018 was a directory of unsigned binaries with whatever filenames uploaders felt like assigning them. The founders had spent the previous years inside Lookout's mobile analysis pipeline, where every APK is a case file — disassembled, hashed, signature-diffed, scored against a behaviour model — before it earns a verdict.

APKBasket applies that case-file discipline to a public index. Every package that lands in the basket has been cross-checked against its original developer signature, hashed to SHA-256, diffed against the last accepted build, and pushed through a malware and re-signing checklist with 47 distinct gates. Median turnaround is fourteen minutes on popular apps — roughly six times faster than the major public mirrors when benchmarked on identical submissions.

The things the team has refused to compromise on since launch: no paid-app distribution, no pirated listings, no iOS-adjacent material, no shipping paid plans (the service is free), and no claims of any affiliation with Google. The 2024 blocklist — 18,400+ malicious or repackaged uploads refused before public listing — is the operational proof that the policy is enforced, not just posted.

No paid apps indexed No pirated listings No iOS / iPad No paid plans No Google affiliation claim Free + open-source + beta only
// 002 · scale

Quantify the operation.

A founder-led team of 9 engineers and 3 reverse-engineering analysts, indexed against 1.84 million verified APKs and audited quarterly.

12
Full-time staff
9 engineers · 3 RE analysts
1.84M+
Verified APKs indexed
312,000 Android packages
41.6M
APK downloads · 2024
3.2M MAU · 187 countries
18,400+
Malicious uploads blocked · 2024
Refused before public listing
median engineer tenure 4.3 yrs
verification turnaround (popular apps) 14 min · 6x faster than the next mirror
uptime · trailing 24 mo 99.97% · quarterly StatusGator audit
awards · partnerships XDA "Best Niche Android Resource 2023" · AndroidPolice Labs partner since Mar 2021

§ 03 / Editorial & Content Policy

What gets indexed. What gets blocked.

APKBasket distributes only APKs that pass three gates: legal provenance, developer or rights-holder consent, and a 47-point integrity scan. Every public listing is auditable through its manifest diff, original developer signature, and VirusTotal cross-report. There is no ambiguity in what we accept and what we refuse to host.

  1. 03.1

    What we distribute

    Free APKs published by the original developer or rights-holder. Beta and preview-channel builds, including those redistributed under our AndroidPolice Labs partnership since March 2021. Open-source APKs whose license terms permit redistribution. Developer-consent uploads — APKs submitted by the package owner with a verified signing key, version-pinned to a specific SHA-256.

  2. 03.2

    What we refuse to host

    Pirated paid applications and any APK whose license terms prohibit redistribution. Repackaged or re-signed builds where the original signature chain is broken or replaced. APKs bundled with injected SDKs, trackers, or code that diverges from the developer's public source. Side-loaded iOS, iPhone, or iPad binaries are out of scope entirely.

  3. 03.3

    How a refusal is enforced

    Uploads failing any of the 47 scan points are quarantined before public listing. In calendar year 2024, 18,400+ submissions were blocklisted at this stage. Refusals are logged with the failing check, the SHA-256 of the artifact, and the upload timestamp. The team does not negotiate removals on policy-failed uploads; the scanner output is the decision.

Read the Scanner Methodology → View full policy in /docs →

§ 04 / External Recognition

Awards and partnerships on record

No testimonials. No pull quotes. The trust signals below are dated, named, and issued by third parties outside the APKBasket team. Each line links to a verifiable public record.

  • 2023 XDA Developers

    Best Niche Android Resource 2023

    Awarded by the XDA Developers Portal in their annual community awards. Cited for the 47-point scan and the manifest-diff transparency layer. The award is public on xda-developers.com and remains on the 2023 archive.

  • 2021 AndroidPolice Labs

    Beta-Distribution Partner since March 2021

    Exclusive content partnership for beta-channel redistribution rights. AndroidPolice Labs beta builds flow through the same 47-point scan and inherit the same manifest-diff and signature transparency as public listings.

  • QUARTERLY StatusGator

    Independent Uptime Audit

    Trailing 24-month uptime of 99.97%, audited quarterly by StatusGator. Audit reports are timestamped and reproducible from incident logs. The number is not self-reported.

§ 05 / Legal Entity & Contact

APKBasket OÜ — registered entity details

The legal entity operating the index is registered in Estonia. Press, security researchers, and developers can reach the team directly through the channels below. No contact form, no ticket queue — direct email and phone, answered by the 12-person team in Tallinn.

Legal entity

APKBasket OÜ

Private limited company · Estonia · Operating since 2018

Registered address

Harju maakond, Tallinn,
Kesklinna linnaosa,
Pärnu mnt 28, 10141
Estonia

Public registry entry on request

Telephone

+372 600 4188

Mon–Fri · 09:00–17:00 EET · Press & researcher line

Security disclosures: email [email protected] with subject prefix [SECURITY]. PGP key on /docs.

Read the Scanner Methodology →