Phone number analysis breaks a number into its structural components: country code, area code, carrier, line type, and porting history. Carrier lookup resolves the operator behind the number and flags VoIP, virtual, or disposable lines that sit between the analyst and the real account holder. The core identifier throughout is the E.164-formatted number, which normalises every input to a single international standard regardless of how the number was originally recorded.
A phone number is an attribution signal, not just a contact detail. It places a subject in a country, ties them to a carrier, exposes whether the line is a throwaway, and links the account to a history of reuse across platforms and breach data sets. The technique applies wherever a number appears in source material: registration data, leaked records, messaging platform profiles, or field reporting. Each data point, individually, is ambiguous. The pattern, corroborated across sources, is not.
TEL-001 sets out the methodology for parsing a number, resolving its carrier and line type, and probing its presence across messaging platforms and breach data sets to evidentiary standard.
Eight workflow steps, six tooling sources, five false-positive checks, six chain-of-custody requirements.
|
01
Required Tools
Six platforms covering carrier lookup, breach data, and messaging enumeration.
|
02
OPSEC
Isolation and attribution risks when querying carrier and breach APIs.
|
|
03
Workflow
Eight-step sequence from E.164 normalisation to chain-of-custody documentation.
|
04
False Positives
Ported numbers, recycled lines, and VoIP misclassification risks.
|
|
05
Chain of Custody
Six requirements for timestamped, hashed, verifiable query output.
|
06
Key Queries
Operator syntax for number search, breach lookup, and platform enumeration.
|
Download the card.
A PDF version of TEL-001 is available to download below.
