Data Points

📞 Phone Number

🔧 Native workbench

🔎 Live indicators (IoC view)

🔗 Analyst pivots

🔍 Lookup

📜 Playbook — Phone Number exploitation

1. Direction — frame the requirement for Phone Number: what decision does this support, by when?
2. Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Phone Number

A phone number is an E.164-formatted subscriber identifier tied to a carrier, line type, and geographic region, used for contact, 2FA, and messaging-app registration. It is a durable identity anchor that links people to accounts, messaging apps, and physical geography, and is often the recovery key that unlocks broader account clusters.

Format: E.164: + followed by up to 15 digits (country code + national number). Parse/validate with libphonenumber; classify line type (mobile/VoIP/landline), carrier, and region.

📡 How it is collected

• Breach and marketing datasets
• Messaging-app registration checks (Signal/Telegram/WhatsApp)
• WHOIS and business contact records
• Social media recovery-hint probing
• Public directories and classified listings
• SIM/HLR lookup queries

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• E.164 parsing, region and carrier classification
• Line-type detection (VoIP vs. mobile) for burner identification
• Messaging-app presence enumeration
• HLR lookup for live/ported status
• Recovery-hint correlation to email/social accounts
• Reverse-lookup against directories and breaches
• Number-block and range analysis for bulk registrations
• Timezone/geo inference from country and area code

🔧 Tools

• PhoneInfoga
• libphonenumber
• Maltego
• SpiderFoot
• Sync.ME (reference)
• IntelTechniques tools
• Recon-ng
• Ignorant (Python)

⚡ Workbench actions

• Validate and normalize to E.164
• Classify line type and carrier
• Check messaging-app registration
• Run HLR live-status lookup
• Reverse-lookup owner/name
• Check breach exposure
• Pivot to recovery-linked accounts
• Map geographic origin on country dashboard

📊 Dashboard KPIs

📂 Open