Data Points

📱 IMEI / Device Identifier

🔗 Analyst pivots

🔍 Lookup

📜 Playbook — IMEI / Device Identifier exploitation

1. Direction — frame the requirement for IMEI / Device Identifier: what decision does this support, by when?
2. Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 IMEI / Device Identifier

An IMEI is the unique hardware identifier of a mobile device's radio, distinct from the SIM/IMSI. It matters for tracing a physical handset across SIM swaps, identifying stolen/blacklisted devices, and linking a device to its make/model and network activity.

Format: 15 digits: 8-digit TAC (type allocation code) + 6-digit serial + 1 Luhn check digit. IMEISV is 16 digits (2-digit software version, no check).

📡 How it is collected

• CDRs and signaling (EIR/HLR) records
• Device netmonitor / *#06# readout
• Carrier equipment identity register (EIR) queries
• Seized-device forensic extraction
• IMSI-catcher / survey captures
• Retail / warranty registration records

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• Luhn check-digit validation
• TAC decode to make/model/capabilities
• SIM-swap tracking (one IMEI, many IMSIs)
• Multi-device attribution (one IMSI, many IMEIs)
• Blacklist / stolen-device screening
• IMEI-cloning duplicate detection
• Handset pattern-of-life via serving cells

🔧 Tools

• GSMA TAC DB
• imei.info
• SnoopSnitch
• Cellebrite (ref)
• i2 Analyst's Notebook
• Maltego

⚡ Workbench actions

• Validate IMEI Luhn check
• Decode TAC to make/model
• Query blacklist/stolen status
• Map IMEI-to-SIM swap history
• Correlate with serving cell towers
• Detect cloned/duplicate IMEIs
• Link device to actor profile

📊 Dashboard KPIs

📂 Open