01
What it is
Phone number OSINT is the practice of extracting carrier, line type, geographic and identity signals from a phone number using open sources and commercial lookup services, without contacting the number's holder.
A phone number is a structured identifier long before it is a way to reach someone. Its country code, national prefix and subscriber block encode a carrier, a line type and often a rough geographic origin, all queryable without ever dialling the number. Investigators use phone number OSINT to verify a source's claimed identity, trace a number surfacing in a leaked document or confirm whether a contact method is a disposable VoIP line before relying on it.
The workflow sits alongside email OSINT and username pivoting as one of the identifiers practitioners resolve early in an investigation.
When to use this guide
- Verifying a claimed phone number belongs to a specific individual or organisation
- Establishing whether a number is a mobile, landline or VoIP line before contacting a source
- Tracing a number found in a leaked document or public filing back to a carrier and jurisdiction
- Cross-referencing a number against social media and messaging platforms to build an identity picture
- Assessing whether a number has been ported or reassigned since it last appeared in a record
02
How do you run phone number OSINT?
This section covers the tools and sequence for turning a raw phone number into a graded carrier, line type and identity picture.
Five tools cover the phone number OSINT workflow from format validation through to live network status, free tools first.
libphonenumber: Free, no login. Google's open-source phone number library validates a number's structure and normalises it to E.164, the format the rest of this workflow uses as a common reference.
PhoneInfoga: Free and open source, no account for the tool itself, though it runs locally rather than as a hosted web tool and the public demo instance was shut down in December 2023. Its local scanner returns format and country data, while carrier and line type require a free apilayer key for its Numverify scanner, and its search-engine scanner generates dork queries to open manually rather than retrieving results. The last tagged release was v2.11.0 in February 2024, so treat its carrier database as a starting point rather than a final answer.
HLR Lookups: Free evaluation credits, paid beyond that, account required. Queries the mobile network directly to confirm whether a number is currently active and which network now serves it, and compares that against the original allocation to show whether the number has been ported. A last ported date is available for some countries only.
Epieos: Paid tier required for phone lookup, account required. The free tier covers the Google, Email Checker and Skype modules only; Phone Checker sits on the paid tier. Runs a reverse lookup across its supported social and messaging modules without alerting the number's holder.
Twilio Lookup: Paid API, account and credentials required. Line Type Intelligence is generally available worldwide. SIM Swap is in private beta and requires carrier approval, and Reassigned Number covers US numbers only. Use it when a finding needs carrier-grade corroboration.
Before you begin
Stop at the login
libphonenumber and PhoneInfoga's local and search-engine scanners run without an account, returning validation, country and manual search leads. Carrier and line type need a free apilayer key for PhoneInfoga's Numverify scanner. HLR Lookups requires registration, Epieos requires a paid tier for phone lookup, and Twilio Lookup requires API credentials. Stop before creating an account or entering payment details unless the investigation specifically calls for the deeper tier.
Legal considerations
Phone number lookups sit close to telecom and data-protection regulation in most jurisdictions. GDPR-covered investigators need a lawful basis before cross-referencing a number against identity data. Do not query a number to locate, contact or harass its holder outside the investigation's legitimate purpose.
The method
01
Normalise the number to E.164
Goal · Establish a canonical format before any other tool is queried
Paste the number as given, with any country context you have, into a libphonenumber-based validator. Confirm the output E.164 string and note whether the source format used local dialling conventions, since a dropped or added leading zero produces a different, incorrect number downstream.
02
Run the first phone number OSINT lookup for line type
Goal · Confirm whether the number is mobile, landline or VoIP before choosing an investigative path
Run PhoneInfoga against the normalised number. Country and format come back from its local scanner without configuration; carrier and line type require a free apilayer key for its Numverify scanner. A VoIP result changes the rest of the workflow: VoIP numbers are cheap to provision and disposable, so treat a VoIP classification as a flag rather than a dead end.
03
Resolve the carrier and check for reassignment
Goal · Identify the current network operator and whether the number has changed hands
Query HLR Lookups for a live carrier read and a comparison of the current serving network against the original allocation, which is what indicates a port. A number that has been ported since it last appeared in a record may now belong to an unrelated subscriber, which matters directly for the false positives covered in Section 03.
04
Confirm active status without alerting the holder
Goal · Establish whether the number is currently in service before investing further effort
The HLR query in the previous step also returns a live or absent status. A number that returns absent or unreachable across multiple queries is unlikely to be worth pursuing further through platform lookups.
05
Run a stealth reverse lookup for linked accounts
Goal · Surface social and messaging accounts tied to the number without notifying its holder
Submit the number to Epieos and review which of its supported modules return a match. The phone module sits on the paid tier, so budget for it before this step. Treat any single-platform match as a lead to corroborate, not a confirmed identity link.
06
Corroborate phone number OSINT findings with open web search
Goal · Catch cases where the number appears in a listing or record that dedicated OSINT tools miss
Search the E.164 and national formats of the number separately in quotation marks across a general search engine. Business directories, court filings and old forum posts often surface a number that dedicated phone OSINT tools miss entirely.
03
What phone number OSINT gets wrong
Carrier and line-type data expire and get reassigned, and a single lookup treated as final is a frequent source of wrong attribution.
VoIP misread as a personal mobile line: Some carrier lookups classify certain VoIP ranges as mobile because the underlying number block was originally allocated to a mobile carrier before being repurposed. Treat any classification that seems inconsistent with the number's apparent context as unconfirmed. Verifying check: cross-check the line type across at least two independent tools before treating VoIP-or-not as settled.
Carrier name reflects the wholesale host, not the retail provider: Many numbers route through an MVNO or wholesale carrier whose name appears in lookup results instead of the retail brand the subscriber actually uses. Verifying check: where the carrier name is unfamiliar, search it directly to confirm whether it is a wholesale or MVNO operator rather than assuming an error.
Reassigned numbers pointing to a previous, unrelated holder: Carriers recycle disconnected numbers after a dormancy period, so an old record, breach entry or cached profile may describe someone who no longer holds the number. Verifying check: compare the record's date against a current HLR porting and status check before attributing a historical finding to the number's present holder.
Caller-ID services surfacing a household member: Some caller-ID data sources return a family member, previous subscriber or the name on a shared account plan rather than the individual actually using the number. Verifying check: corroborate the name against a second, independent identifier such as an email address or social profile before treating it as the number's user.
Reverse lookups returning a false negative on aliased registrations: A number registered under a business name, nickname or alias will not match a reverse lookup built around a legal name. Verifying check: run the open web search step in quotation marks regardless of whether the dedicated reverse-lookup tools return a hit, since aliasing defeats structured lookups but not general search indexing.
Chain of custody: carrier, line-type and porting data all change over time, so a lookup result is only as good as the record of when and how it was captured. Screenshots alone lose the underlying structured data; retain the raw response wherever a tool exposes one.
Screenshot every lookup result with the query timestamp visible in the frame
Export the raw API or JSON response where the tool supports it, not only the rendered summary
Record which specific service returned each finding, since carrier and porting data sourced from different tools can disagree
Log the exact input format used for each query, since a malformed or locally-formatted number silently narrows or changes results
Retain a hash of any exported data set used to support a finding in the investigation
04
Go deeper
Reference cards for practitioners who want to build on this guide's phone number workflow.
CARD · TEL-001
Phone number analysis and carrier lookup.
Parse to E.164, resolve the carrier, flag VoIP and probe platforms without alerting the holder.
CARD · TEL-002 · PREMIUM
Trace a mobile number to a named subscriber identity.
MSISDN parsing, HLR status, social and breach pivots, and a graded attribution dossier.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.
