Enter a Phone Number, CVE ID, IP address, Domain, Email, File Hash, URL to scan/analyze threat intelligence data
Nothing searched yet

Phone Number lookup

Breach exposure, spam reporting and linked identity for a number, for use in an authorised security investigation -- typically a smishing, vishing or account-takeover case.

For authorised security investigations only. This returns information about a person -- have a reason before you search. See acceptable use.

What you can paste

These are format examples. Clicking one puts it in the search box — it does not run a search, so you choose when to spend a lookup.

How to run one
  1. 1Paste the phone number into the box above. The type is already set to Phone Number on this page.
  2. 2Press Analyze. If the indicator is new to the platform it is queued for enrichment, and the page holds a progress view while that runs rather than telling you to come back later.
  3. 3Read the report top-down. The verdict is the headline; the sections below it are the evidence, and the evidence is the part worth your time.
  4. 4Pivot. Almost every value in the report is itself searchable, which is how one indicator becomes an investigation.
Where to go next
  • Search any linked email address
  • Compare the report timeline against when your users were contacted
  • Check whether the same number appears across multiple cases
Cross-referenceThreat huntingDo this by API
What comes back, and how to read it

These are the sections of the report, in the order you will meet them.

  1. 01Risk Score and Threat Type

    The aggregate call and what kind of abuse it is associated with -- spam, scam, smishing or robocalling all behave differently.

  2. 02Phone Information

    Carrier, line type, series and area code, and verification status. Line type is quietly one of the most useful fields: a VoIP number in a vishing case means something a mobile number does not.

  3. 03Geographic Location

    Where the number is registered. Registration and the caller's actual location are not the same thing, especially for VoIP.

  4. 04Spam Reports

    How many reports exist and when they were filed. A cluster of recent reports is an active campaign; a handful over years usually is not.

  5. 05Risk Factors and Suspicious Patterns

    The specific things that drove the score, so you can judge them yourself rather than take the number on faith.

  6. 06Linked accounts and social media

    Addresses and accounts that appear alongside the number in the same records.