# Find Anyone's Identity, Address & Social Media From Just Their Number

**URL:** <https://onehack.st/t/find-anyones-identity-address-social-media-from-just-their-number/314870>\
**Category:** Tutorials & Methods\
**Tags:** tools, hacking, privacy, trading\
**Created:** [December 17, 2025, 4:50pm UTC](https://onehack.st/t/find-anyones-identity-address-social-media-from-just-their-number/314870 "2025-12-17T16:50:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [December 17, 2025, 4:50pm UTC](https://onehack.st/t/find-anyones-identity-address-social-media-from-just-their-number/314870/1 "2025-12-17T16:50:33Z")

</div>

# 📱 How to Track Down Anyone Using Only Their Phone Number — Complete OSINT Guide

> 🗺 **One-Line Flow:** Got a phone number? This guide turns those 10 digits into a name, face, address, social accounts, and embarrassing data breaches — grab your target number and start at Phase 1.

![](https://i.pinimg.com/originals/82/ee/71/82ee71ee2f51e393eae8242b2c4cd69a.gif)

* * *

## 🤔 What The Hell is Phone Number OSINT?

A phone number isn’t just digits. It’s a master key.

People use the same number for everything. Banking apps. Social media. Two-factor auth. Job applications. Dating profiles. Every single platform they’ve ever signed up for.

That means one number connects to:

- Their real name
- Their face
- Where they live
- Where they work
- Who they know
- What accounts they have
- What data breaches they’re in

This guide walks you through every method to extract that info. From basic Google tricks to tools that would make a private investigator jealous.

* * *

## ⚠ Before You Start: Don’t Be a Creep

Real talk — this knowledge is powerful. Use it for:

- Verifying sketchy callers
- Investigating scams and fraud
- Journalism and research
- Checking your own digital footprint
- Security work with proper authorization

Don’t use it for:

- Stalking your ex
- Harassing anyone
- Doxxing people
- Any illegal bullshit

Laws exist. GDPR, CCPA, computer fraud acts. Violate them and you’re the one getting investigated.

Now let’s get into it.

* * *

## 🔍 Phase 1: Basic Recon — Figure Out What You’re Working With

Before you go deep, get the basics.

### 📡 Carrier and Line Type

First question: is this a real cell phone, a landline, or some VoIP burner?

This matters because VoIP numbers (Google Voice, TextNow) are harder to trace. Real mobile numbers link to carrier databases with actual identity verification.

**Free tools:**

- [FreeCarrierLookup.com](https://freecarrierlookup.com) — enter number, get carrier and line type
- [NumLookup](https://numlookup.com) — same deal, sometimes catches what others miss

What you’ll learn: carrier name (Verizon, Vodafone, Jio, whatever), whether it’s mobile/landline/VoIP, and sometimes the original registration state or region.

### 🌍 Format That Number Right

International format matters. Tools choke on weird formatting.

Always convert to: `+[Country Code][Number]`

Examples:

- US: `+14155552671`
- UK: `+447911123456`
- India: `+919876543210`

Get this wrong and half your tools return nothing.

* * *

## 🎯 Phase 2: Google-Fu — Search Engines Are Your First Weapon

Google indexes more than you think. People paste their numbers everywhere — invoices, forum posts, business listings, leaked documents.

### 🔎 The Exact Match Trick

Put the number in quotes. This forces Google to find that exact sequence:

```auto
"555-123-4567"

```

Try every format variation:

```auto
"5551234567"
"(555) 123-4567"
"+15551234567"
"555.123.4567"

```

People format numbers inconsistently. Search all versions.

### 🧩 Combine With Context

Add keywords to narrow results:

```auto
"555-123-4567" "invoice"
"555-123-4567" "contact"
"555-123-4567" "resume"
"555-123-4567" linkedin
"555-123-4567" facebook

```

### 🚫 Filter Out The Garbage

People search sites like Whitepages dominate results with useless previews. Exclude them:

```auto
"555-123-4567" -site:whitepages.com -site:spokeo.com -site:truepeoplesearch.com

```

Now you get the unique mentions — forum posts, business directories, leaked pastebins.

### 🦆 DuckDuckGo As Backup

Google personalizes results. DuckDuckGo doesn’t. Run the same searches there — you’ll often find different results.

* * *

## 📂 Phase 3: People Search Engines — The Aggregators

These sites scrape public records, social media, and data broker databases. They’re hit or miss, but worth checking.

**The main players:**

- [Whitepages](https://whitepages.com) — US-focused, shows name/address previews
- [TruePeopleSearch](https://truepeoplesearch.com) — actually free, US only
- [FastPeopleSearch](https://fastpeoplesearch.com) — another free US option
- [ThatsThem](https://thatsthem.com) — email and address correlation
- [Spokeo](https://spokeo.com) — aggregates social profiles (paywalled for details)

**How to use them:**

Enter the phone number. Note any names or addresses that come up. Don’t trust any single result — these databases mix current data with decade-old records.

Treat everything as a lead, not a fact. Cross-reference before you believe anything.

**The catch:** Most good data is paywalled now. Free tiers show just enough to confirm a hit exists, then demand $20-40 for actual details.

* * *

## 📲 Phase 4: Social Media — Where People Actually Live Online

Social platforms are goldmines because people voluntarily connect their real identities to phone numbers.

### 🔵 Facebook — The Forgotten Password Trick

This is one of the most reliable techniques and it’s been working for years.

**How it works:**

1. Go to [facebook.com/login](https://facebook.com/login)
2. Click “Forgotten password?”
3. Enter the phone number (international format)
4. Watch what happens

**Possible outcomes:**

- “No account found” — number isn’t linked to Facebook
- Partial profile reveal — Facebook shows a blurred photo and masked name like “Jo\*\* Sm\*\*h”

That partial info is huge. You now know:

- An account exists
- First name starts with those letters
- What they roughly look like (even blurred photos reveal gender, age range, glasses, etc.)

**Pro tip:** Right-click the blurred image, inspect element, and check the `src` attribute. Sometimes the actual image URL is less obscured than what’s displayed.

**Don’t actually reset the password.** That’s illegal. You’re just using the lookup to confirm association.

### 👥 Facebook Contact Upload Method

Alternative approach:

1. Create a throwaway Facebook account (use a burner email)
2. Add the target number to your phone contacts with a fake name
3. Let Facebook sync your contacts
4. Check “People You May Know” suggestions

Facebook’s algorithm connects phone contacts to accounts. If the number is linked, their profile appears in suggestions.

### 📸 Instagram and TikTok

Both platforms have phone-based friend finding:

1. Add target number to your phone contacts
2. Open the app’s “Find Friends” or “Sync Contacts” feature
3. See if their profile appears

This works because these apps encourage connecting phone contacts to find friends. Most people leave this enabled.

### 💼 LinkedIn

LinkedIn’s phone search is garbage through the interface, but Google works:

```auto
site:linkedin.com "555-123-4567"

```

People sometimes list phone numbers in their contact info sections. Recruiters and salespeople especially.

### 🐦 Twitter/X

Phone search is disabled in the UI, but the data exists in their backend. Try:

```auto
site:twitter.com "555-123-4567"

```

Also useful: if you find a username through other methods, check if they’ve ever tweeted their number.

* * *

## 📞 Phase 5: Truecaller — The Crowdsourced Monster

[Truecaller](https://truecaller.com) is the most comprehensive phone directory that shouldn’t exist.

### ⚙ How It Actually Works

When you install Truecaller, it uploads your entire contact list to their servers. Every name you’ve saved for every number.

Multiply that by 400+ million users.

The result: a database where your number is tagged with whatever name your contacts saved you as. Your mom saved you as “Sweetie”? That might be in there. Your dealer saved you as “Tuesday Guy”? Possibly in there too.

### 🔬 Using It For OSINT

**Web version:** Go to [truecaller.com/search](https://truecaller.com/search), enter the number.

**What you get:**

- Name (as crowdsourced from contacts)
- Location (city-level)
- Spam report count
- Sometimes a profile photo
- Sometimes alternative numbers

**Accuracy reality check:** The name might be a nickname, might be outdated, might be wrong. Someone’s bitter ex might have saved them as “Cheating Asshole” and that’s what shows up.

Always verify Truecaller results through other sources.

### 🤖 Truecaller For Automation

[TruecallerJS](https://github.com/sumithemmadi/truecallerjs) lets you query Truecaller programmatically. You’ll need to authenticate with a real account, but then you can script bulk lookups.

* * *

## 🔗 Phase 6: Epieos — The Account Linker

[Epieos](https://epieos.com) is clever as hell.

It doesn’t hack anything. It just queries public APIs and services — like password reset flows and contact lookup features — to see what accounts are linked to a phone number.

### 📊 What It Reveals

Enter a phone number and Epieos might show:

- **Linked Google account:** Profile name, photo, sometimes last activity
- **Linked Facebook account:** Profile ID and name
- **Other services:** Depending on what their APIs leak

This works because platforms like Google and Facebook have features that check “does this phone number have an account?” — Epieos just asks that question systematically.

### ✅ Why This Is High-Confidence Data

Unlike people search sites that aggregate old data, Epieos queries live platform APIs. If it says a Google account exists for that number, a Google account exists for that number.

The platforms themselves are confirming the link.

* * *

## 🥷 Phase 7: The Silent Account Checkers

These tools check if phone numbers are registered on platforms without alerting the target. No notifications, no “someone tried to log into your account” emails.

### 👻 Ignorant — The Stealthy One

[Ignorant](https://github.com/megadose/ignorant) is the most underrated phone OSINT tool.

It silently checks Snapchat, Instagram, and Amazon through password reset endpoint exploitation. The target never knows you looked.

```bash
pip install ignorant
ignorant +15551234567

```

It’ll tell you which platforms have accounts linked to that number. No alerts sent. Clean reconnaissance.

### 🇫🇷 Phunter — Multi-Source French Connection

[Phunter](https://github.com/N0rz3/Phunter) combines multiple lookups including French “Pages Blanches” directory access and Amazon verification with automated CAPTCHA solving.

Good for European numbers especially.

### 🔄 Email2PhoneNumber — The Reverse Technique

[Email2PhoneNumber](https://github.com/martinvigo/email2phonenumber) works backwards. If you have someone’s email, it harvests partially-masked phone digits from password reset pages across multiple sites.

Here’s the clever part: it then uses NANPA (North American Numbering Plan Administration) data to eliminate impossible number combinations and brute-forces the remainder.

Martin Vigo showed at DEF CON that combining eBay and LastPass password resets alone can leak 7 of 10 digits. The remaining combinations are small enough to test.

* * *

## 🛠 Phase 8: PhoneInfoga — The Open Source Standard

[PhoneInfoga](https://github.com/sundowndev/phoneinfoga) is the most comprehensive open-source phone OSINT tool.

### 📋 What It Does

- Validates number format and identifies country/carrier
- Generates Google dorks automatically
- Checks multiple data sources
- Provides a web interface for easy use
- Offers a REST API for automation

### 💻 Installation

```bash
# Using Go
go install github.com/sundowndev/phoneinfoga/v2@latest

# Or grab the binary from releases
# Or use Docker
docker pull sundowndev/phoneinfoga

```

### ▶ Usage

```bash
# Basic scan
phoneinfoga scan -n +15551234567

# Start web interface
phoneinfoga serve

# Then open http://localhost:5000

```

### 🚧 The Google Ban Problem

PhoneInfoga hammers Google with searches. Google will eventually block you.

**The fix:** When you get blocked, complete a CAPTCHA manually in your browser. PhoneInfoga can capture the `GOOGLE_ABUSE_EXEMPTION` cookie and use it to bypass blocks temporarily.

* * *

## ✈ Phase 9: Telegram — OSINT Paradise

Telegram is uniquely valuable for phone OSINT because:

1. Accounts are tied to phone numbers
2. Privacy settings are often left default
3. A massive ecosystem of OSINT bots exists
4. User activity and group memberships are often visible

### 🔬 Bellingcat’s Phone Number Checker

[telegram-phone-number-checker](https://github.com/bellingcat/telegram-phone-number-checker) is the professional standard.

It checks if phone numbers have Telegram accounts and returns:

- Username (if set)
- Profile photo
- Last online status
- Display name

This is the tool journalists and investigators actually use.

### 🇷🇺 Russian OSINT Bots

The Russian-speaking OSINT community has built Telegram bots that query parsed breach databases. These return data you won’t find anywhere else.

**Key bots:**

- **@Smart\_SearchBot** — full names, addresses, emails, social networks from phone numbers
- **@Quick\_OSINT\_bot** — similar comprehensive lookups
- **@HimeraSearch** — covers phones, emails, vehicle registration
- **@GetPhone\_bot** — direct leaked database searches
- **@karma\_cybersec\_bot** — Ukrainian bot for Telegram ID and phone correlation

**Warning:** These bots query breach data. Using them may violate laws in your jurisdiction. The data they return was likely obtained illegally at some point. Understand the legal implications.

### 🔍 Manual Telegram Reconnaissance

Even without bots:

1. Add the number to your phone contacts
2. Open Telegram and sync contacts
3. Check if they appear in your contact list
4. View their profile for photo, bio, username, last seen

If their privacy allows, you can see their profile photo history by clicking through different photos they’ve used.

* * *

## 💬 Phase 10: WhatsApp — 2.4 Billion Users Can’t Hide

WhatsApp is the world’s largest messaging platform. Everyone’s on it. Everyone’s number is their account.

### 📱 The Contact Save Method

1. Save the target number to your phone contacts
2. Open WhatsApp
3. Go to Contacts, let it sync (or force refresh in settings)
4. Find the contact

**What you can see (depending on their privacy settings):**

| Setting | Everyone | My Contacts | Nobody |
| --- | --- | --- | --- |
| Profile Photo | ✅ | ✅ (if they have you) | ❌ |
| Last Seen | ✅ | ✅ (if they have you) | ❌ |
| About/Status | ✅ | ✅ (if they have you) | ❌ |

Most people leave defaults, which means “Everyone” for most settings.

### 🖼 Profile Photo Intelligence

That profile photo is gold. Save it and:

- **Reverse image search** with [Yandex Images](https://yandex.com/images/) (better for faces than Google)
- **Check backgrounds** for location clues — landmarks, workplaces, car models
- **Note metadata** if lucky (rare on WhatsApp but worth checking with exiftool)

### 🚪 The Group Addition Bypass

Here’s a trick that sometimes bypasses privacy settings:

1. Create a new WhatsApp group
2. Add yourself and the target number
3. Before sending any messages, observe their profile info
4. Exit the group immediately

During group creation, WhatsApp sometimes shows profile information that would normally be hidden from non-contacts.

This is inconsistent — WhatsApp patches it periodically — but worth trying.

### 📝 Status Analysis

Profile name patterns tell stories:

| Pattern | Likely Meaning |
| --- | --- |
| “John Smith” | Real name — high value |
| “JS Plumbing” | Business owner |
| “~J-S~” | Personal nickname |
| 🇳🇬 Lagos | Location flex |
| “Available 24/7” | Business or hustle |

The “About” section often contains LinkedIn handles, Instagram usernames, business info, or philosophical quotes that help build a profile.

### ⏰ Last Seen Patterns

If visible, last seen reveals lifestyle patterns:

- Consistently online at 2am? Night owl or different timezone
- Active during business hours only? Probably a work phone
- Last seen a week ago? Inactive account or dead phone
- Never shows last seen? Privacy conscious (notable in itself)

* * *

## 💰 Phase 11: African FinTech Apps — The Identity Goldmine

OPay, PalmPay, and similar apps dominate African mobile finance. They’re OSINT goldmines because financial regulations require real identity verification.

### 💸 The “Send Money” Reconnaissance Method

These apps verify recipients before transfers complete. You can exploit this:

**OPay Method:**

1. Install OPay (use a burner device if paranoid)
2. Go to Transfer → To OPay User
3. Enter the target phone number
4. Before confirming payment, observe what appears

What you might see:

- Full registered name (KYC verified)
- Username if they set one
- Verification badge
- Sometimes profile photo
- Sometimes location

**Cancel before sending anything.** You just wanted the lookup.

**PalmPay Method:**

Same flow. Send Money → Enter number → Note the recipient name that appears for confirmation.

### 📶 Airtime Purchase Verification

Another technique using the same principle:

1. Go to “Buy Airtime” in any financial app
2. Enter the target phone number
3. The app shows “Confirm: Send to [FULL NAME]?”
4. Cancel the transaction

You’ve just confirmed their registered name with their carrier. MTN, Airtel, Glo — they all do KYC. That name is government-ID verified.

### 🌍 Regional App Coverage

This technique works across multiple apps:

**Africa:**

- MTN Mobile Money (35+ countries, 95-100% accuracy)
- Airtel Thanks/Money (Africa, Asia)
- M-Pesa (Kenya, Tanzania, etc.)
- OPay, PalmPay (Nigeria)

**India:**

- Paytm, PhonePe, Google Pay — UPI IDs often ARE the phone number (`phonenumber@paytm`)
- Start a UPI transfer, see the registered name

**Brazil:**

- PIX system — keys can be phone numbers
- Mercado Pago, PicPay show recipient names

**Southeast Asia:**

- GrabPay, GCash (Philippines), Maya, Touch 'n Go (Malaysia)

### 🎯 Why This Works

Financial regulations (KYC/AML) require these apps to verify identity. When you “send money” to a number, the app confirms you’re sending to the right person by showing their verified name.

You’re not hacking anything. You’re using a consumer protection feature for reconnaissance.

* * *

## 📡 Phase 12: HLR Lookups — Telecom Infrastructure Intelligence

HLR (Home Location Register) lookups query carrier infrastructure directly. This is how telecom companies validate numbers internally.

### ⚙ What HLR Actually Does

When you run an HLR lookup, the system sends an SRIforSM (Send Routing Info for Short Message) query through SS7 infrastructure to the carrier’s database.

The response contains:

| Data Point | What It Means |
| --- | --- |
| Valid/Invalid | Does this number actually exist? |
| Active/Inactive | Is it currently in service? |
| Carrier | Which network owns the number |
| Roaming Status | Are they traveling internationally? |
| Connected Network | If roaming, which foreign carrier? |
| Porting Status | Has number been transferred to different carrier? |
| IMSI (sometimes) | International Mobile Subscriber Identity |

### 🎯 OSINT Value

The roaming detection is powerful. If someone claims they’re in New York but their HLR shows they’re roaming on a carrier in Dubai, that’s valuable intelligence.

### 🔧 HLR Services

- [HLR Lookup](https://hlrlookup.com) — 220+ networks, free credits on signup
- [HLR-Lookups](https://hlr-lookups.com) — 100 free evaluation queries
- [SigPloiter/HLR-Lookups](https://github.com/SigPloiter/HLR-Lookups) — open source, DIY option

[Deep-HLR](https://github.com/e-m3din4/deep-hlr) combines HLR data with reputation scores, social media correlation, and portability status in one tool.

* * *

## 🪪 Phase 13: CNAM — Caller ID Names

CNAM (Caller ID Name) is the system that makes your phone display “JOHN SMITH” when someone calls instead of just a number.

### 🤫 The Dirty Secret

There’s no central CNAM database. About 12+ independent databases exist, and each carrier only updates one of them.

This means:

- The same number returns different names depending on where you query
- Updates are inconsistent (some carriers refresh monthly, others weekly)
- About 50% of lookups return actual names, the rest show “Wireless Caller”

### ✅ Why It’s Still Useful

When CNAM returns a real name, it’s often the actual registered account holder name — not a crowdsourced nickname like Truecaller.

**Free CNAM tools:**

- Quality Voice Data’s Caller ID Testing Tool
- Various VoIP providers offer CNAM dips in their APIs

### 🔄 Technical Flow

When a call comes in:

1. Originating carrier sends only the phone number
2. Terminating carrier queries their LIDB (Line Information Database)
3. LIDB returns a 15-character max name string
4. Your phone displays it

The 15-character limit is why names often appear truncated.

* * *

## 💀 Phase 14: Data Breaches — The Dark Goldmine

Every major breach contains phone numbers. Check if your target’s number appears in leaked datasets.

### 🔍 Breach Search Tools

**Have I Been Pwned** — [haveibeenpwned.com](https://haveibeenpwned.com)

- Primarily email-based but some breaches include phone data
- Free, legitimate, widely trusted

**Intelligence X** — [intelx.io](https://intelx.io)

- Searches across pastes, breaches, darknet sources
- Phone number search available
- Freemium with limited free searches

**DeHashed** — [dehashed.com](https://dehashed.com)

- Full breach database search by phone number
- Paid service, but comprehensive

**Snusbase** — [snusbase.com](https://snusbase.com)

- 16+ billion records
- Direct phone number search
- Paid subscription

**LeakCheck** — [leakcheck.io](https://leakcheck.io)

- 7+ billion records
- Freemium model

### 📦 What Breaches Reveal

When a phone number appears in breaches, you often get:

- Associated email addresses
- Passwords (that people reuse everywhere)
- Physical addresses
- Full names
- Account usernames
- Whatever else that service collected

One phone number in one breach can give you the key to finding all their other accounts.

### 📋 Pastebin and Paste Sites

Hackers dump data on paste sites. Search them:

- [Pastebin](https://pastebin.com) — search directly
- [psbdmp.ws](https://psbdmp.ws) — Pastebin dump search engine
- [grep.app](https://grep.app) — searches GitHub and paste sites

Search formats:

```auto
"5551234567"
"+15551234567"

```

* * *

## ♻ Phase 15: Number Recycling — The Haunted Numbers

Phone numbers get reassigned. When someone gives up a number, after 45 days (in the US) carriers can give it to someone new.

### ⚠ Why This Matters For OSINT

You might be investigating a number that now belongs to someone completely different.

A Princeton study found:

- 66% of sampled available numbers were still linked to accounts on Amazon, Facebook, PayPal, etc.
- 100 numbers had associated email addresses in breach databases
- Within one week, 19 of 200 test numbers received sensitive communications meant for previous owners

### 🔎 Detecting Recycled Numbers

**Conflicting information** is the red flag. If Truecaller says “John” but Facebook says “Maria” and breach data shows “Alex” — that number has likely been recycled through multiple owners.

**Check porting history** through HLR services that show porting dates. A number that’s been ported multiple times has had multiple owners.

**Services detecting recycling:**

- Telesign — detects reassignment through carrier data
- TMT ID — number deactivation and recycling APIs
- GSMA is developing a standardized Number Recycling API

* * *

## 🇷🇺 Phase 16: VK and Russian Platforms

If your target has any connection to Russia or former Soviet states, VKontakte (VK) is essential.

### 📱 VK Phone Lookup

The password recovery page reveals partial information:

1. Go to [connect.vk.com/restore/](https://connect.vk.com/restore/)
2. Enter the phone number
3. See partial email/phone associated with account

**Additional VK tools:**

- [vk.barkov.net/mobilephones.aspx](https://vk.barkov.net/mobilephones.aspx) — direct phone lookup for VK accounts
- [KogdaVSeti](https://kogdavseti.ru) — last login time detection
- [vk5.city4me.com](https://vk5.city4me.com) — reveals hidden friends
- [vkdia.com](https://vkdia.com) — shows which friends someone chats with most

### 🤖 Russian Data Bots Revisited

The Telegram bots mentioned earlier are particularly effective for Russian/CIS numbers because:

1. Russian data protection enforcement is… different
2. Massive historical breach data exists
3. The OSINT community there has been building these tools for years

* * *

## 📶 Phase 17: SS7 — The Protocol That Exposes Everyone

SS7 (Signaling System 7) is the protocol that makes phone networks work globally. It was designed in the 1970s-80s when “any network participant was implicitly trusted.”

### 🔓 The Problem

There’s no authentication. If you can send SS7 messages, carriers trust them. This allows:

- Location tracking with just a phone number
- SMS interception
- Call interception
- Voicemail access

### 🌐 What’s Actually Accessible

You personally can’t send SS7 messages (probably). But:

- Some countries sell SS7 access via “Global Title leasing”
- Government agencies use it routinely
- Commercial surveillance vendors offer it as a service
- Criminal organizations have access

SRLabs research found location tracking succeeds approximately 70% globally with just a phone number.

### 🛡 2024-2025 Bypass Attacks

Carriers deployed SS7 firewalls after earlier disclosures. Researchers then found that manipulating the TCAP layer with “extended tag encoding” bypasses these firewalls.

It’s an arms race.

### 💡 OSINT Implications

You won’t be doing SS7 attacks unless you’re a nation-state or working for one. But knowing this exists helps you understand:

- Why phone-based 2FA is considered weak
- Why high-value targets use Signal/secure messengers
- What capabilities exist for well-resourced adversaries

* * *

## 🔔 Phase 18: Ring Patterns and Voicemail Reconnaissance

Low-tech but revealing.

### 📞 Call Analysis

| Pattern | What It Means |
| --- | --- |
| 1 ring → busy | Likely blocked or manually rejected |
| Multiple rings → voicemail | Normal behavior |
| Multiple rings → busy | Conference call or forwarded to busy line |
| Fast busy (reorder tone) | Network issues or terminated service |
| Endless ringing | Voicemail disabled, phone off, or abandoned number |

T-Mobile lets users set call rejection to return busy signals instead of voicemail — intentional obfuscation.

### 🎙 Voicemail Intelligence

**SpyDialer** retrieves voicemail greetings. The greeting often reveals:

- The person’s voice (confirms identity)
- Their name (if they recorded a personal greeting)
- Their workplace (professional greetings)
- Their personality and communication style

**Warning:** SpyDialer causes a brief ring on the target’s phone. Not invisible.

### 📡 Carrier Fingerprinting

Default voicemail prompts vary by carrier:

“The person you are calling is not available. Please leave a message after the tone.”

vs.

“Hi, you’ve reached the Verizon voicemail of…”

The specific wording can confirm carrier even when other methods fail.

* * *

## 🖼 Phase 19: Reverse Image Search From Profile Photos

Found a photo through any of these methods? Now trace it further.

### 🔧 Best Tools

**Yandex Images** — [yandex.com/images/](https://yandex.com/images/)

- Far superior to Google for faces
- Russian platform = less privacy filtering
- Upload the image or paste URL

**Google Images** — [images.google.com](https://images.google.com)

- Good for finding the same image on different sites
- Weaker for face matching

**TinEye** — [tineye.com](https://tineye.com)

- Finds exact and modified matches
- Shows oldest instance (helps find original source)

**PimEyes** — [pimeyes.com](https://pimeyes.com)

- Facial recognition search engine
- Controversial but effective
- Paid service

### 🎯 What You’re Looking For

- **Same photo on other platforms** — Instagram pic also on LinkedIn means same person
- **Photo background clues** — office logos, street signs, landmarks
- **EXIF data** — GPS coordinates, camera info, timestamps (usually stripped but worth checking)
- **Oldest instance** — where did this photo originate?

* * *

## 👤 Phase 20: Username Correlation

Found a username through any method? Trace it everywhere.

### 🧠 The Logic

People reuse usernames. `john_smith_87` on Instagram is probably `john_smith_87` on Twitter, GitHub, and that sketchy forum they forgot about.

### 🔧 Tools

**Sherlock** — [github.com/sherlock-project/sherlock](https://github.com/sherlock-project/sherlock)

```bash
sherlock john_smith_87

```

Checks 400+ sites for that username.

**WhatsMyName** — [whatsmyname.app](https://whatsmyname.app)

- Web-based username search
- Good for quick checks

**Namechk** — [namechk.com](https://namechk.com)

- Username availability checker
- Shows which platforms have that username taken

**Social Searcher** — [social-searcher.com](https://social-searcher.com)

- Searches social media content by keyword
- Can find posts mentioning specific usernames

* * *

## 🏛 Phase 21: Government and Regulatory Databases

Public records often include phone numbers.

### 🇬🇧 UK

**Ofcom Numbering Data** — [ofcom.org.uk/numbering-data](https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/numbering-data)

- Weekly updated, 54MB download
- Complete telephone number allocations
- Shows carrier assignments for every UK number range

### 🇨🇦 Canada

**Canadian Numbering Administrator** — [cnac.ca](https://cnac.ca)

- CO code status lookups
- Area code complex maps
- Shows carrier assignments for Canadian numbers

### 🇺🇸 US

**NANPA (North American Numbering Plan)** — [nationalnanpa.com](https://nationalnanpa.com)

- Number allocation data
- Area code assignments
- Porting administration records

### ⚖ Court Records

**CourtListener RECAP Archive** — [courtlistener.com/recap/](https://courtlistener.com/recap/)

- Millions of federal court documents
- Searchable by text content
- Phone numbers appear in filings, exhibits, contracts

This is huge. PACER only searches by party name. RECAP lets you search actual document text — including phone numbers mentioned in evidence.

* * *

## ⚡ Phase 22: Automation and Pipelines

For serious OSINT work, automate everything.

### 🔮 Maltego Transforms

Maltego is the professional OSINT visualization platform. Phone number transforms:

- **PhoneSearch Transforms** — returns names, social profiles, related persons (law enforcement grade)
- **LoginsoftOSINT Transforms** — detects disposable numbers, finds registered apps
- **IPQualityScore Transforms** — fraud scoring and phone validation

### 🔄 n8n Workflows

[n8n-nodes-osint-industries](https://github.com/KalnuErelis/n8n-nodes-osint-industries) integrates phone enrichment into workflow automation.

Build pipelines that:

1. Take a phone number input
2. Query multiple sources automatically
3. Aggregate results
4. Generate reports

### 🖥 PhoneInfoga REST API

```bash
phoneinfoga serve
# API available at http://localhost:5000
# POST to /api/v2/numbers

```

Script it into your existing tools.

### 🐍 Python Libraries

- **phonenumbers** — Google’s library for parsing, formatting, validating
- **truecallerpy/truecallerjs** — Truecaller API access
- **ignorant** — silent account checking

* * *

## 🧩 Phase 23: Building The Complete Profile

You’ve gathered fragments from a dozen sources. Now synthesize them.

### 📊 The Confidence Framework

Rate each piece of information:

| Confidence | Criteria | Example |
| --- | --- | --- |
| **High** | Multiple independent sources agree | Name from Truecaller matches Facebook partial matches LinkedIn |
| **Medium** | Single reliable source or partial corroboration | Name from Epieos alone, or Truecaller + breach data match |
| **Low** | Single unreliable source, no corroboration | Name from one people-search site only |

### 📁 The Final Dossier

For each investigation, document:

**Confirmed:**

- Full name (confidence level)
- Location (city/state)
- Verified accounts (with profile URLs)

**Likely:**

- Workplace
- Associated emails
- Social connections

**Possible:**

- Additional names (aliases, maiden names)
- Previous addresses
- Family members

**Contradictory Data:**

- Conflicting names from different sources
- Evidence of number recycling
- Possible confusion with similar numbers

### 📝 Source Documentation

Always note:

- What tool/method found each piece
- When you found it
- The exact data returned

This matters for verifying your work and understanding reliability later.

![](https://ic.pics.livejournal.com/falseeeyelashes/9129439/16037/16037_600.gif)

* * *

## 🧰 Complete Tool Reference

### 💻 GitHub Tools

| Tool | URL | Purpose |
| --- | --- | --- |
| PhoneInfoga | [github.com/sundowndev/phoneinfoga](https://github.com/sundowndev/phoneinfoga) | All-in-one phone OSINT |
| Ignorant | [github.com/megadose/ignorant](https://github.com/megadose/ignorant) | Silent account checking |
| Phunter | [github.com/N0rz3/Phunter](https://github.com/N0rz3/Phunter) | Multi-source + European directories |
| email2phonenumber | [github.com/martinvigo/email2phonenumber](https://github.com/martinvigo/email2phonenumber) | Reverse phone from email |
| Deep-HLR | [github.com/e-m3din4/deep-hlr](https://github.com/e-m3din4/deep-hlr) | HLR + social correlation |
| telegram-phone-number-checker | [github.com/bellingcat/telegram-phone-number-checker](https://github.com/bellingcat/telegram-phone-number-checker) | Telegram account lookup |
| TruecallerJS | [github.com/sumithemmadi/truecallerjs](https://github.com/sumithemmadi/truecallerjs) | Truecaller API |
| PhoneIntel | [github.com/phoneintel/phoneintel](https://github.com/phoneintel/phoneintel) | Batch processing |
| NumSpy | [github.com/spyboy-productions/numspy](https://github.com/spyboy-productions/numspy) | Indian number OSINT |
| Sherlock | [github.com/sherlock-project/sherlock](https://github.com/sherlock-project/sherlock) | Username search |
| HLR-Lookups | [github.com/SigPloiter/HLR-Lookups](https://github.com/SigPloiter/HLR-Lookups) | DIY HLR queries |

### 🌐 Web Services

| Service | URL | What It Does |
| --- | --- | --- |
| Epieos | [epieos.com](https://epieos.com) | Account linking via APIs |
| Truecaller | [truecaller.com/search](https://truecaller.com/search) | Crowdsourced caller ID |
| Intelligence X | [intelx.io](https://intelx.io) | Breach/paste/darknet search |
| HLR Lookup | [hlrlookup.com](https://hlrlookup.com) | Carrier infrastructure queries |
| FreeCarrierLookup | [freecarrierlookup.com](https://freecarrierlookup.com) | Basic carrier ID |
| Yandex Images | [yandex.com/images/](https://yandex.com/images/) | Reverse image search |
| WhatsMyName | [whatsmyname.app](https://whatsmyname.app) | Username search |

### 🤖 Telegram Bots

| Bot | Purpose |
| --- | --- |
| @Smart\_SearchBot | Full profile from phone |
| @Quick\_OSINT\_bot | Comprehensive lookups |
| @HimeraSearch | Phones, emails, vehicles |
| @GetPhone\_bot | Breach database search |

* * *

## 🗺 The Methodology Flowchart

```auto
📱 Phone Number Input
       ↓
🌍 Format to International (+1...)
       ↓
┌──────┴──────┐
│ 🔍 Basic │
└──────┬──────┘
       ↓
📡 Carrier ID (FreeCarrierLookup)
       ↓
🎯 Google Dorks (all format variations)
       ↓
┌──────┴──────┐
│ ⚡ Quick │
└──────┬──────┘
       ↓
📞 Truecaller → Name lead
🔗 Epieos → Linked accounts
🛠️ PhoneInfoga → Comprehensive scan
       ↓
┌──────┴──────┐
│ 📲 Social │
└──────┬──────┘
       ↓
🔵 Facebook password reset → Partial profile
💬 WhatsApp contact add → Photo, status, last seen
✈️ Telegram checker → Username, profile
👻 Instagram/Snapchat (Ignorant) → Account exists?
       ↓
┌──────┴──────┐
│ 🔬 Deep │
└──────┬──────┘
       ↓
💀 Breach databases → Emails, passwords, addresses
📡 HLR lookup → Carrier, roaming, porting
💰 Financial apps → KYC-verified names
       ↓
┌──────┴──────┐
│ 🔄 Correlate│
└──────┬──────┘
       ↓
🖼️ Reverse image search on found photos
👤 Username search (Sherlock)
🧩 Cross-reference all data points
       ↓
┌──────┴──────┐
│ 📁 Report │
└──────┬──────┘
       ↓
✅ Confidence-rated profile with source documentation

```

* * *

## 🛡 Protecting Yourself

Run every technique in this guide against your own phone number. Seriously.

### 🔍 Audit Yourself

1. Search your number on every tool mentioned
2. Check breach databases for your number
3. See what Truecaller shows
4. Try the Facebook password reset on yourself
5. Check WhatsApp privacy settings

### 🔒 Reduce Your Exposure

**Use separate numbers:**

- Primary number for trusted contacts only
- Secondary number for signups and services
- Burner numbers for anything sketchy

**Privacy settings:**

- WhatsApp: Set photo, last seen, about to “My Contacts”
- Telegram: Same approach
- Facebook: Remove phone from searchable info

**Financial apps:**

- Use different numbers if possible
- Disable social features
- Review what info appears when others send you money

**Consider:**

- Google Voice for a free secondary US number
- Prepaid SIMs for compartmentalization
- MySudo or similar for multiple identities

* * *

## 🎯 Final Thoughts

A phone number is an identity anchor. Every service connects to it. Every login texts it. Every contact list uploads it.

The tools and techniques here aren’t secret — they’re just not obvious. Anyone willing to spend an hour can find more than most people realize is public.

Use this knowledge to protect yourself. Use it for legitimate investigations. Don’t be the reason someone needs protection from people like you.

Now go audit your own digital footprint before someone else does.

![](https://media.tenor.com/JfG-B-awzhIAAAAM/fbi.gif)