Telephone Numbers

If you have a target telephone number, first identify the type of number and provider.

Next, identify any subscriber information such as the name and address associated with the account.

Finally, locate any online web content with a connection to the target number.

Carrier Identification

- Free Carrier Lookup (freecarrierlookup.com)

Also consider the sites Carrier Lookup (carrierlookup.com) and Phone Carrier Check (phonecarriercheck.com). If both of these services disappear by the time you need them, a Google search of

"carrier lookup" should provide new alternatives.

- Scout (scout.tel/phone-number-lookup)

Caller ID Databases

Once you have identified the provider, you should focus on the subscriber data associated with the number.

- Twilio (twilio.com/lookup)

Locate the "Sign up" button and create a free account. You should be presented with a $15 credit within Twilio. This should provide numerous searches.

Once logged in, click "Explore Products" in the left menu. Scroll down to the "Lookup" feature on the right.

Only select the "Include caller name unless you want confirmation of the carrier. These searches are $0.01 each, which means you should be able to conduct 1500 queries on this single trial.

Make sure vou have a valid email and Google Voice account ready before registering. If Twilio demands to know why you created an account, tell them you are a developer who has been asked to review their API, and explain you will only need internal testing without an outside number.

On the Lookup search page, insert the target number and allow the page to generate a result.

We can also rely on their API (The following queries through their API are included in the "Custom api.sh script"):

Assuming my Twilio Account SID was 11111; my Twilio API key was 22222; and my target U.S. number was 202-555-1212, the following command:

curl -X GET 'https://lookups.twilio.com/v1/PhoneNumbers/+1202-555-1212?Type=caller-name&Type=carrier' \

-u 11111:22222 | python3 -mjson.tool

Twilio also offers additional Lookup services, which may provide additional value to your investigations. These each withdraw an additional small fee from your trial balance, and some require a verified or "upgraded" account to function.

In the Twilio portal click "Explore Products" and scroll down to the "Add-Ons" option under "Marketplace". Clicking the "Activate" option will display a notification about pricing per search. Once you have activated an add-on, you will see a new tab called "Configure" within the specific product. This tab presents the "Unique Name".

The following commands would conduct queries with each of the extended add-on services (rarely use any Twilio Add-ons. Bbasic name and carrier queries to suffice for most of the needs):

Twilio Validation:

curl -X GET 'https://lookups.twilio.com/v1/PhoneNumbers/+1'$data'?AddOns=real_phone_validation_rpv_turbo' \

-u XXXX:XXXX | python3 -mjson.tool > $data-TW-V.txt

Twilio OpenCNAM:

curl -X GET 'https://lookups.twilio.com/v1/PhoneNumbers/+1'$data'?AddOns=telo_opencnam' \

-u XXXX:XXXX | python3 -mjson.tool > $data-TW-O.txt

Twilio DataAxle:

curl -X GET 'https://lookups.twilio.com/v1/PhoneNumbers/+1'$data'?AddOns=dataaxle_bizinfo' \

-u XXXX:XXXX | python3 -mjson.tool > $data-TW-D.txt

Twilio Ekata:

curl -X GET 'https://lookups.twilio.com/v1/PhoneNumbers/+1'$data'?AddOns=ekata_reverse_phone' \

-u XXXX:XXXX | python3 -mjson.tool > $data-TW-E.txt

Twilio Ekata Validate:

curl -X GET 'https://lookups.twilio.com/v1/PhoneNumbers/+1'$data'?AddOns=ekata_phone_valid' \

-u XXXX:XXXX | python3 -mjson.tool > $data-TW-EV.txt

- Telnyx (telnvx.com)

Second pick after Twilio.

They are extremely scrutinous of new accounts, but once you do obtain a trial, it could last several years with minimal usage.

The following is the submission structure:

curl -X GET \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer XXXX" \
  "
https://api.telnyx.com/v2/number_lookup/+12025551212?type=carrier&type=caller-name" | python3 -mjson.tool

Replace "XXXX" with your Telnyx API key (visible within your portal) and "2025551212" with your target number.

- CID Name (cidname.com)

Create a free account, you must provide an email address and telephone number (temporary addresses and Google Voice bypass this restriction).

Upon completion, you should receive an email with an API license key that is valid for approximately 100 free successful searches.

To query the API with key (XXXXXXXXX), and out target number (2025551212):

https://dip.cidname.com/2025551212/XXXX&output=raw&reply=none

- Apeiron (https://apeiron.io/cnam)

Similar to Twilio, but is completely free but results are not as comprehensive as the previous option, but could be valuable.

- Truecaller (truecaller.com)

When you install the app, you give it permission to collect all of your contacts and upload them to the original database. Basically, millions of users have uploaded their contact lists for the world to see.

It has the ability to seatch within this data on the True Caller website. You must connect to the service via a covert Microsoft or Google account.

- Spy Dialer (spydialer.com)

Much of this data was acquired many years ago, but this can still be beneficial.

- Caller ID Test (calleridtest.com)

This resource should be checked when others have failed.

- The Other Board (theotherboard.com)

If you have any suspicion that the target of your investigation is involved in prostitution, drugs, or any related activity, The Other Board should be checked against the telephone number of your subject.

To query via URL:

https://theotherboard.com/escort-reviews?phone=6185551212

Another option for this tvpe of querv is The Erotic Review (theeroticreview.com):

https://www.theeroticreview.com/reviews/newreviewsList.asp?Phone=5551212&AreaCode=618

- Calls.ai (sync.ai/calls-ai)

It queries a large database of crowd-sourced contact details from unknown sources. Most telephone number search results reveal only a first name, but I find them to be highly accurate. Conduct the following to use this app:

  • Launch your Android virtual machine through VirtualBox or Genymotion.

  • Launch the Google Play Store or Aurora Store and search "Calls.ai".

  • Install Calls.a from Sync.ai.

  • Launch the Calls.a app and allow default permissions.

  • When prompted, associate with the Google account within the VM.

  • Click the search option in the lower left and input any number.

Telephone Search Websites

Telephone Search Engines

- Traditional Search Engines

Most people use traditional search engines as a first step toward identifying the owner of a telephone number.

The number is usually provided in a standard format such as 202-555-1212. This can confuse some search engines because a hyphen (-) is often recognized as an operator to exclude data.

The following should be searched in order to exhaust all possibilities:

  • "2025551212"

  • "202-555-1212"

  • "202.555.1212"

  • "202 555 1212"

  • "(202) 5551212"

  • "(202) 555-1212"

  • "(202) 555.1212"

  • " (202)5551212"

  • "(202)555-1212"

  • "(202)555.1212"

  • "two zero two five five five one two one two"

  • "202 five five five one two one two"

"two zero two five five five 1212"

  • "202 555 one two one two"

  • "two zero two 555 one two one two"

  • "202 five five five 1212"

  • "two zero two 555 1212"

After submitting these through Google, you should attempt each through Bing.

- Sly Dial (slydial.com)

This service contacts the cellular provider of the target telephone number and sends you straight to the outgoing voicemail message.

Sly Dial does not work through a website, instead, you must call a general Sly Dial telephone number and follow the automated prompts. You must listen to a brief advertisement. number and follow the automated prompts. You must listen to a brief advertisement before your call is placed. Finally, the service will play the target's outgoing voicemail message through this audible telephone call.

There is a very small chance that the target will know that someone attempted a call. In the tare occurrence that the telephone rings, the target will never know the identity of the person making the calls.

To use the Sly Dial service, call 267-759-3425 (267-SLYDIAL) from any telephone service including landlines, cellular lines, or VOIP.

If this number does not work, visit slydial.com for updates.

- Old Phone Book (oldphonebook.com)

It provides historical White Pages landline listings from 1994-2014.

This search is vital for background checks.

- Craigslist (craigslist.org)

Many people use Craigslist to sell items or services.

Some people choose not to list a number because of automated "scrapers". Either way, the solution that most users apply to bypass this hindrance is to spell out the phone number. The hard way to do this is to conduct several searches similar to the following:

  • site:craigslist.org "314-555-1212"

  • site:craigslist.org "314" "555" "1212"

  • site:craigslist.org "three one four" "five five five" "one two one two"

  • site:craigslist.org "314" "five five five" "1212

One search that will cover most of these searches in a single search attempt would look like the following:

site:craigslist.org "314" | "three one four" "555" "five five five" "1212" "one two one two"

Contact exploitation & other techniques

Technique explained in Android Virtualization section.

- Grocery Reward Cards / Loyalty Cards

Most grocery chains have adopted a reward/loyalty card system that mandates the participant to enroll in their program. The consumer completes an application and receives a plastic card to use during checkout for discounts.

Enter the store, purchase a pack of gum, and enter the target telephone number as the reward/loyalty program number. You will likely receive a receipt with the target's name on the bottom.

Advanced Telephone Investigation Tools

- API robust tool

- IntelTechniques Telephone Tool

With this tool you can submit an area code, prefix, and number and execute all queries. It also has a section of Caller ID services which allow query via direct URL.

If you want to use those, you must add your API keys to the source code of the page.

Code in Telephone.html.

PreviousMetadataNextOnline Maps

Last updated