Phone number OSINT is narrower than username or email work, and the hit rate is higher. A number is expensive to change, tied to a carrier, and used as the login or recovery key for a short list of high-value services. The trade-off is that most platforms expose very little about a number, and reverse directories that map numbers to names are bound to the country that publishes them. Knowing which checks exist, and what each one can and cannot return, is most of the skill.
This guide covers formatting a number so checks work, which apps confirm a registered number and what they leak while doing it, how country-scoped reverse directories behave, and how to combine phone results with the username and email pivots. All of it reads public endpoints and sends nothing to the number.
Format first: E.164 or nothing
Every serious phone lookup wants E.164: a plus sign, the country code, and the subscriber number with no spaces, dashes or parentheses. +14155551234 is valid; (415) 555-1234 is a guess about which country you meant. OSINTsearch strips punctuation and validates the result before any module runs, and rejects a number it cannot make E.164.
import phonenumbers
n = phonenumbers.parse("(415) 555-1234", "US")
print(phonenumbers.format_number(n, phonenumbers.PhoneNumberFormat.E164))
# +14155551234
print(phonenumbers.region_code_for_number(n), phonenumbers.number_type(n))The phonenumbers library also gives you the region and the line type, mobile or fixed, which decides which checks are worth running. A landline is not on WhatsApp, and a VoIP number from a bulk provider is a strong hint that the number was acquired for a signup rather than a life.
Registration checks: which apps know this number
The most useful class of phone module asks a service, silently, whether an account is registered to a number. WhatsApp, Facebook, Instagram, Snapchat, Amazon, eBay, Microsoft, Airbnb, Battle.net, Adobe, Yandex, VK and Flipkart all have flows that answer that question without sending anything to the phone, and the engine behind OSINTsearch runs two dozen such modules per phone scan.
What comes back is usually existence plus a masked recovery hint. Facebook's recovery flow, for example, confirms the number and may show a masked email like e*****0@t*******. Instagram's shows a display name and avatar with a masked hint. On the free preview those hints are narrowed further: the last digits are dropped and the domain is replaced, so the preview never publishes more than the platform already did. Paid plans return the hint as the platform shows it.
| Module class | Examples | Returns | Contacts the number? |
|---|---|---|---|
| Registration existence | whatsapp_phone, snapchat_phone, amazon_phone, vk_checkphone | registered: true | No |
| Recovery-flow hints | facebook_phone, instagram_phone, microsoft_phone | masked email, display name, avatar | No |
| Reverse directories, NANP | whocallsme_phone, 800notes_phone | community reports, sometimes a name | No |
| Reverse directories, country-bound | telsearch_phone (CH), dasoertliche_phone (DE), opplysningen1881_phone (NO), fonecta_phone (FI) | listed name and address where the directory publishes it | No |
A hit that requires a proof marker is better than a hit that trusts a status code. The Microsoft module is a good illustration: it reports found only when the reset page carries explicit markers, and classifies challenge or interstitial pages as rate limited rather than as a match. That change removed a whole class of false positives, and it is the kind of upkeep a static script cannot do for you.
Reverse directories stop at borders
Number-to-name directories are a legal artifact. Countries that publish subscriber books openly, mostly in the DACH, Nordic and Central European markets, have directories that answer a query with a listed name and sometimes an address. The United States and Canada have community-report sites and little else, and much of Western Europe sits behind bot walls with no public read.
The practical consequence is that a directory only ever answers for its own country. A Swiss directory queried with a German number returns a clean not-found, never a false positive, and the engine reports it that way. A number that resolves nowhere in the directories is not evidence of anything; it usually just means the number is from a country with no open book.
Tools: PhoneInfoga, Ignorant, and hosted lookup
PhoneInfoga is the standard open-source starting point. It parses the number, identifies the carrier and line type, and runs a set of search-engine dorks and optional API scanners. It is good at the formatting and metadata layer and thin on registration checks. Ignorant, from the Holehe author, checks a number against a small set of services (Amazon, Instagram, Snapchat) using the same silent-oracle approach Holehe uses for email.
phoneinfoga scan -n "+14155551234"
ignorant 1 4155551234A hosted phone lookup differs in breadth and maintenance rather than in kind. OSINTsearch runs its phone modules through the same fleet as username and email, with proxy routing for services that block datacenter exits and a health monitor that catches a module when a recovery page changes shape. Phone lookups are available on paid plans; the pricing page lists the quotas, and the username search is free to try first.
Phone number OSINT alongside the other pivots
A phone result rarely closes a case alone. It confirms that a number is real and active, and it produces one or two masked identifiers. The value is in joining those with what you already hold. A masked recovery email j••••@gmail.com from the phone side matches or excludes a candidate address from the email side. A display name from Instagram's recovery flow matches or excludes the display names on a username sweep.
- Normalize to E.164, note the country, carrier and line type.
- Run registration checks and collect every masked hint and display name.
- Query reverse directories only for the number's own country.
- Match hints against candidate emails and usernames from the other pivots.
- Export the lot as JSON or CSV and keep the masked hints exactly as returned, since they are evidence of shape, not of value.
The beginner's kit puts phone, email and username together into one sequence if you are starting from scratch.
FAQ
Can I find who owns a phone number for free?
Sometimes, in countries with open subscriber directories. In the US and most of Western Europe there is no public name lookup, only community-report sites and registration checks that confirm which apps the number is used on.
Does checking a number on WhatsApp notify the person?
Not through a silent existence check. Adding the number to your contacts or starting a chat does. Tools that use the silent path make no contact.
What is E.164 and why does it matter?
E.164 is the international format: plus sign, country code, number, no punctuation. Most lookup endpoints reject or misread anything else, so normalize before you query.
Why does a reverse directory return nothing for a valid number?
The directory is bound to its own country, or the number is unlisted, mobile, or VoIP. A miss in a directory is not evidence that the number is fake.
Narrow pivot, high confidence
Phone number OSINT will not give you a life story, and that is fine. It gives you a small number of high-confidence facts: the number is real, it is registered on these services, and its recovery hints look like this. Used as a check against the wider username and email picture, those few facts are often the ones that settle whether two profiles are one person.
