This article will teach you how to identify the person behind a phone number. By the end of this tutorial, you will be able to obtain the full name, photo, and other personal details using just the phone number. Phone number OSINT is a valuable skill, as it provides valuable insights during investigations of any complexity. Now, let's dive into the practice!

Google Dorks

Google is an excellent tool for searching phone numbers in public sources. For more accurate results, enclose the phone number in quotes. This will give you exact matches the number across the web. This method helps to filter out irrelevant results by ensuring Google only returns pages where the exact sequence of digits appears. You can also combine the phone number with additional keywords, like "contact" or "phone", to narrow down the search even further.

• "79521020220" – Search the exact matches across the web.
• "79521020220" site:example.com – Search the exact matches across particular website.
• "79521020220" site:*.ru – Search for the phone number on Russian websites (or adjust for a specific country).

Reverse lookup tools

Below I listed both paid and free phone number OSINT tools. There is a variety to explore, from online platforms to CLI tools and breach directories. Before diving into those tool I would like to give a notable mention to Epieos and OSINT Industries. Both are incredibly easy to use and provide comprehensive results that go beyond just information about phone numbers.

Phone number hints

When researching phone numbers, you need to cross-validate your sources and use other data points to pivot from. OSINT Industries offers reverse phone lookups as well, but imagine you don't have one. Imagine you start with an email. Use the email address to get phone number hints:

Phone number hints depend on the services your target is signed up for. Use the password reset feature with the target's email. The more websites the email was used on, the more of the phone number you may be able to guess. Leaked digits cheatsheet:

• First three and last two digits: eBay.
• First and last four digits: Paypal.
• First and last two digits: Yahoo.
• Last four digits: Lastpass.
• Last two digits: Google, Facebook, Twitter, Hotmail, Steam.

Online reverse lookup tools

Looking up phone numbers in caller ID apps (like Getcontact, Truecaller, etc.) can provide valuable insights. These apps not only reveal the name associated with the number but also show how others have saved that contact in their address books. This can uncover details such as the person's occupation, activities, and other relevant information.

The following image is a result of the Inteleye's investigation into the Lockbit leader. As you can see it provides a lot of info on what that person is up to:

• Spy Dialer – Free reverse phone number lookup tool for identifying unknown callers using public data. Moreover, it works with email addresses, and even physical addresses.
• Get Contact – Allows to identify unknown callers, block spam calls, and view how their numbers are labeled in other users' contact lists. One of the most popular apps on the market.
• Truecaller – Allows to research mobile numbers from any country. Pulls up the name and a profile picture. Currently it's one of the best resources for phone number investigations.
• Sync.me – Used to identify unknown calls, block unwanted spam calls, and telemarketers.
• SEON – A comprehensive fraud-prevention platform. It will show technical information about the number. Whether it's valid, its type (e.g., mobile or landline), and its carrier. It will also check if the phone number has been registered with popular social media networks or messaging apps.
• Thatsthem – Is a people search engine that allows users to look up contact information, including phone numbers, addresses, email addresses, and more.

🇺🇸 US only tools:

• NumLookup – Used to perform free lookups for US phone numbers. Simply enter the phone number and get the owner's full name and more.
• People Search Now – Retrieves limited contact information from a phone number, requires payment for a more detailed report.
• Phonevalidator – Helps to find out if any U.S. or Canadian phone number line type is cell, landline, VOIP, toll-free or fake/invalid.
• Nuwber – US-focused people search engine, that also provides reverse phone number lookups.
• Whitepages.com – Provides information for people, addresses, and phone numbers. While it may include some limited international data, its main database is centered around US.

Command-Line Interface (CLI) tools

• Phoneinfoga – An advanced information gathering framework for phone numbers. It allows to first gather basic information such as country, area, carrier and line type, then use various techniques to try to find the VoIP provider or identify the owner.
• Ignorant – Allows to check if a phone number is used on various social media sites, including Instagram, Snapchat, and more.
• DetectDee – Hunts down social media accounts by username, email or phone across social networks.

Breach databases

• Haveibeenzuckered – Is a large dataset containing 533 million Facebook accounts was made available for download. Helps to find out if the given number was involved in the breach.
• Have I Been Pwned – Allows to search across multiple data breaches to see if an email address or phone number has been compromised. Contains one of the most comprehensive datasets.
• Dehashed – Is a data breach search engine that allows users to find compromised information, such as email addresses, passwords, phone numbers and other personal data.
• Intelligence X – Is a privacy-focused search engine and a data archive. It provides access to a vast range of historical and leaked data, including Dark Web content, public records, and breached databases.

Telegram bots

• @UniversalSearchBot – Finds people by usernames, emails and phone numbers.
• @HowToFindRU_Robot – Paid bot for searching database breaches.
• @SocialSearchBot – Finds social media profiles associated with the phone number.
• @HimeraSearch_2024bot – Works with names and phone numbers. Identifies places of residence, income, vehicle ownership, offences, and much more.

More bots can be found on CQCore's Telegram resources.

Automated tools

Investigations can become quite complex and involve many data points. Keeping all your work in one environment that organises and beautifully presents the data can be a game changer. There are many tools available that allow you to build complex graphs and use modules to enrich the data you already have. Here are two excellent tools:

• Spiderfoot – Automates OSINT gathering process and displays all the results in a single environment. This open-source tool can gather intelligence on IPs, domain, phone numbers and more.
• Maltego – Is a powerful data mining tool used for gathering and analysing information from various online sources. It visually maps relationships between entities such as people, organisations, domains, and IP addresses, making complex connections easier to understand.

Compare the results you get from different sources to eliminate false positives. Some carriers transfer a number that hasn’t been used for a while to another user, so be sure to double-check your findings.

More useful tools

Additionally, Michael Bazzell created a list of phone number lookup tools on his website, inteltechniques.com. It allows you to populate all the phone number lookup resources and query them with a single click. It also serves as a valuable reference for good OSINT resources to use in your investigations.

To find even more tools, visit The OSINT Newsletter collection and uk-osint.net, which their owners keep up to date. While the above-mentioned resources primarily list tools, you also need a solid methodology to conduct a thorough investigation. For a comprehensive theory on international phone number investigations I recommend the following article:

Mastering the Puzzle of International Phone Numbers

Challenges and Strategies in Investigating International Phone Numbers

OSINT TeamAlisa Gbiorczyk

Contact exploitation

"Contact exploitation" refers to the process of leveraging the contacts in your phone book to uncover additional information. The idea is to sync or add a phone number to your contacts, and then use social media apps like WhatsApp and Telegram to see what information is linked to that number.

For example, when you add a phone number to your contacts and check it on WhatsApp or Telegram, you might be able to see the person's name and photo. On Telegram, you might also get their username. Afterward, delete the added contact to see the original name the person has set. This method allows you to gather more details about the individual, which can then be used to explore further connections or information across other platforms.

Add your target's number in mobile banking apps or try to initiate a money transfer (but don't complete the process). Before the final confirmation of the transaction, you will receive details of the recipient, which usually include their true name and surname. The data you obtain using this method is more reliable, as banks conduct thorough vetting of their clients and prevent the input of false information.

Setting up the lab

Now that you know OSINT methods and have practical knowledge, it's time to set up your investigative environment. You can use a virtual emulator or buy a cheap burner phone. Get a new SIM card and sign up for TrueCaller and similar services using a fake email. Note that reverse lookup services harvest your contacts, making them accessible to others. Therefore, your environment must be clean. More tips on how to set up your lab while maintaining good OPSEC (Operational Security) practices are described in the following article:

Using Phone Contact Book Apps For Digital Research - bellingcat

Translations:English (UK)Русский (Россия)Popular apps such as TrueCaller or GetContact advertise the ability to see who is really calling you, even if you do not know the number, and alert the app user of spam or scam calls. However, the way that these apps gather information to determine the name of an unknown caller is not […]

bellingcatAric Toler

Pivoting tips

Use people search websites mentioned in the article to get email from a phone number. With an email you can:

Find other email accounts

The first part of the email (the username portion) might be used with other email providers. Check if your target has Protonmail, Gmail, Yahoo, or other addresses. Use Hunter.io or similar email validators for that purpose.

Research usernames

Treat the email address as a username by removing the @ and everything that follows. For example, johndoe@gmail.com becomes johndoe. Search this using Sherlock, Whatsmyname.app, or other username OSINT tools.

Get related domains

To find related domains enter the email address into a reverse WHOIS tool (like viewdns.info or whoxy.com). The goal is to uncover all domains registered with this specific email. It will reveal connections between different websites managed by the same individual or organisation.

Conclusion

In this article, you learned how to use various techniques and tools to identify the person behind a phone number. By leveraging Google searches, reverse lookup tools, and other OSINT methods, you can obtain valuable details. These strategies are crucial for conducting thorough investigations.

For more insights, subscribe to our newsletter using the form below. In conclusion, thank you for finishing this comprehensive writeup.