Telephony Intelligence (TELINT): Intelligence Discipline Guide

A phone number is a routing address issued under a published plan, not a person. Telephony intelligence extracts everything the plan will legitimately tell you, and stops precisely where lawful authority ends.

What Telephony Intelligence is as a discipline

Telephony intelligence is the analysis of phone numbers and telephony infrastructure from lawful sources: E.164 structure, country and area codes, allocated ranges and the operators holding them, line type covering fixed, mobile, VoIP, premium and non-geographic numbering, portability status where published, and the operator context around a number. In investigations it also covers the lawful public footprint of a number in business listings, filings and advertisements, and the reconciliation of that footprint against a claimed identity or presence.

Sub-methods include parsing and validation against national numbering plans, range-holder lookup through regulator allocation data, line type and portability checks through lawful commercial services, virtual provider identification, and pattern analysis across the set of numbers used by one operation. Call detail records, cell-site data, live location and interception sit outside this discipline for private practitioners: they require legal process and belong to authorities holding that power.

Why it matters

Telephony intelligence answers whether a number is even valid and issuable, what type of line it is, which operator and country hold the range, and whether an apparently local presence is a virtual number bought last week. It links entities through shared contact infrastructure across filings and advertisements, and it exposes the cheap, disposable numbering on which mass fraud and impersonation operations depend.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Valid E.164 structure and length consistent with the national numbering plan for the country being claimed.
Range allocation records identifying the operator or service provider that holds the block.
Line type: fixed, mobile, VoIP, premium rate or non-geographic, each carrying different fraud and cost implications.
Portability status showing the number no longer sits with the operator that was allocated the range.
Reuse of one number across multiple company filings, adverts or listings, linking otherwise unconnected entities.
Numbers advertised as a local office while allocated from virtual or non-geographic ranges.
Blocks of sequential numbers appearing across one operation, indicating bulk provisioning from a single provider.
Historic appearances of the number in archived pages and directories, establishing a first-seen date.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

ITU-T numbering resources and Operational Bulletin — Assigned country codes, national numbering plan references and amendments published by the ITU
National telecom regulator allocation data — Published number range allocations to operators, often downloadable in full by regulators
libphonenumber — Open-source parsing, validation and formatting against per-country numbering rules and line types
ITU-T E.212 mobile country and network codes — Official mobile network code assignments identifying operators behind mobile numbering
Company registers and official gazettes — Filed contact numbers tying a number to a registered entity, address and date
Internet Archive Wayback Machine — Historic websites and directories showing when and by whom a number was advertised
Public business directories and regulator registers — Lawfully published business contact numbers useful for corroboration rather than identification

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Normalise and validate — Convert to E.164 and validate against the national numbering plan, discarding numbers that could never have been issued.
Identify range and line type — Resolve the country, allocated range holder and line type, using regulator allocation data rather than a single aggregator.
Check portability and provider — Establish through lawful services whether the number has been ported or is served by a virtual provider.
Search the lawful footprint — Look for the number in filings, adverts, archived pages and public directories, recording each occurrence with its date.
Correlate across entities — Cluster entities, adverts and filings that share numbers or sequential ranges, and test whether the link is meaningful.
Separate inference from fact — Mark clearly what is verified from allocation data and what is inferred from a directory of unknown provenance.
Escalate through legal process — Where the question requires subscriber, traffic or location data, route it to law enforcement or a lawful production order.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Person / Name — A named individual — the subject of identity resolution and profiling.
Phone Number — Telephone number for voice, SMS, or messaging identification.
Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.

Related disciplines

Email Intelligence — Email Addresses, Headers, and Mail Infrastructure
Identity Intelligence — Resolving and Verifying Who Someone Is

Inside the platform: where Telephony Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=TELINT — Discipline hub
source-catalog.php?disc=TELINT — Source catalogue filtered to this discipline
search.php — Person / Name profile
phone-profile.php — Phone Number profile
blockchain.php — Cryptocurrency Address profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Normalise and validate is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Check portability and provider turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Escalate through legal process feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Telephony Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Lawful telephony analysis in defence is limited to numbering plan structure, allocation and operator context drawn from published regulator data, plus the open footprint of a number in published material. It supports communications planning, understanding of local operator coverage in an area of operations, and identification of the correct emergency and liaison numbers. Anything involving interception, geolocation from network signalling or call records requires specific national authority and is executed by dedicated elements under legal oversight, not by an analyst. Confusing the two is an operational, legal and command failure, and the boundary must be explicit in tasking.

🕵 National intelligence

Agencies with lawful interception authority operate under statutory regimes with judicial or ministerial authorisation, oversight bodies, minimisation rules and audit. The discipline described here, meaning numbering plan analysis and open footprint work, is what remains available to analysts without that authority and is used to structure and validate identifiers before any authorised collection is sought. Handling of communications data obtained under warrant is governed by the authorising instrument and by minimisation requirements protecting uninvolved parties. Any product must make clear which findings derive from authorised collection and which from open sources.

👮 Law enforcement

Investigators obtain call detail records, subscriber data and cell-site information through the statutory process applicable in their jurisdiction, which typically requires an authorisation or court order and, for foreign-held data, an MLAT or equivalent. Interception requires a separate and higher authorisation. Cell-site evidence requires expert interpretation because a cell serving a call indicates coverage, not a precise location, and overstating it has caused serious miscarriages of justice. Chain of custody applies to records and devices, and disclosure obligations extend to the data that undermines the prosecution case.

🔍 Private investigation and corporate security

Private practice is confined to what is published: E.164 parsing, country and area code identification, allocated range and operator lookup through regulator data or lawful commercial services, line type, and the open appearance of a number in company filings, advertisements, listings and archived pages. A private actor may not obtain call records, subscriber data, cell-site or live location by any route, may not use services claiming handset location from network signalling, and may not make pretext or silent calls to test a line, which can breach communications, privacy and anti-harassment law and destroy an investigation.

📰 Journalism and OSINT media

Journalists use number analysis to corroborate that a business or individual is connected to a claimed presence, and to identify the operator or virtual provider behind a number in fraud reporting. Verification means establishing that the number is validly formed for the claimed country, allocated to an operator serving that market, and independently associated with the entity through published records. Source protection is critical: contacting numbers can expose interest, and metadata about journalists' own communications is itself a target. Never commission or use unlawful location or record services, which is both criminal and a recurring cause of press scandals.

🌍 NGO, humanitarian and human rights

Humanitarian and human rights organisations use numbering data to configure hotlines, verify that a claimed office or service line exists, and understand which operators serve a displaced population for communication planning. Protection considerations are serious: contact lists of beneficiaries and activists are extremely sensitive and are frequently targeted, so numbers are stored encrypted, minimised and shared as narrowly as possible. Duty of care includes advising staff and partners about the surveillance capabilities of the state they operate in, without providing false assurance about what any communications method can protect.

🎓 University and research

Researchers study numbering plans, telecommunications market structure, mobile penetration and fraud typologies. Reproducibility requires citing the regulator allocation data and its version, since ranges are reallocated regularly. Ethics approval is required for any work involving individuals' numbers, which are personal data and often the most sensitive identifier a person has in low-connectivity settings. Datasets containing real numbers are generally not shareable; publish aggregate statistics, methodology and code. Active measurement involving calls or messages to real numbers raises serious ethical and legal problems and is rarely justifiable.

Playbook: working Telephony Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the lawful boundary first

Before any work, state explicitly what is available to you: parsing, allocation and published footprint if you are a private practitioner; more only if you hold statutory authority. Write down that call detail records, subscriber data, cell-site, live location and interception are outside scope and will be referred to legal process. This is not a formality, because the market is full of services offering exactly those capabilities unlawfully. A good output is a scope note the client has seen. Stop and refer if the requirement needs authorised collection.

Phase 2 — Parse and validate the number

Normalise to E.164 with country code, and validate the national significant number against the numbering plan of the claimed country: correct length, valid prefix, and a range that exists. Invalid structure is a finding in itself and frequently indicates a fabricated contact detail. Record the plan version used, since plans change. A good output is a canonical E.164 value with a validity determination and the reference used. Stop when the number is either valid for a specific country or shown to be malformed.

Phase 3 — Identify country and geography

Resolve the country code and, where the plan is geographic, the area or region the prefix serves. Note where a country code covers multiple territories, where non-geographic ranges exist, and where mobile numbering carries no geographic meaning at all, which is the norm in most countries. Do not infer a person's location from a number. A good output is a documented geographic scope with its limits stated. Stop before treating a mobile prefix as evidence of where anyone is.

Phase 4 — Determine line type

Establish whether the range is fixed, mobile, VoIP, premium rate, freephone, shared cost, machine-to-machine or non-geographic. Line type materially changes the interpretation: a VoIP number claiming a local office presence, or a premium rate number in a supposed customer service context, are meaningful findings. Use regulator range data or a lawful commercial lookup. A good output is a line type with the source and date. Stop when the type is established from allocation data rather than assumed from the prefix pattern.

Phase 5 — Identify the range holder

Look up which operator holds the allocated block through the national regulator's published allocation data. Note that this identifies the range holder, not necessarily the current serving operator, because portability moves numbers between operators without changing the range. Where the regulator publishes portability data, use it; where it does not, state the limitation. A good output is a range holder with an explicit statement about portability. Stop before asserting the current operator from range data alone.

Phase 6 — Detect virtual and reseller provision

Identify whether the number is provided through a virtual operator, a VoIP platform or a communications platform reseller, which is common in fraud and in numbers presented as local business lines. Range allocation to a wholesale provider, or a known platform range, is the usual indicator. This does not make a number illegitimate, but it changes what the number evidences about presence. A good output is a provisioning assessment with its evidentiary implication stated. Stop before treating virtual provision as proof of deception.

Phase 7 — Search the open footprint

Search for the number as it lawfully appears in public material: company filings, regulatory registers, official directories, advertisements, job listings, archived web pages and court documents. Search multiple formats, since numbers appear with and without country codes, with varied spacing and punctuation, and sometimes obfuscated. Archive what you find. A good output is a dated footprint with each appearance preserved. Stop when the footprint either corroborates or fails to corroborate the claimed association.

Phase 8 — Reconcile against the claim

Test the number against what is being claimed: does a business asserting a physical presence in a city use a geographic number for that area or a VoIP line; does an individual's claimed employer show that number in filings; do multiple entities in a network share a number or a contiguous block. Mismatch is the analytic product here. A good output is a reconciliation note stating what the number supports and what it contradicts. Stop before overreading a mismatch, since legitimate businesses use virtual numbers routinely.

Phase 9 — Analyse sets rather than singles

Where an operation uses several numbers, analyse them together: contiguous allocation blocks, the same provider, the same registration pattern in listings, or the same appearance across a set of front entities. Patterns across a set are far more informative than any single number. A good output is a set-level finding with the shared characteristics evidenced. Stop when the pattern is documented per number rather than asserted for the group.

Phase 10 — Refer what needs legal process

Where the requirement genuinely needs subscriber identification, call records, location or content, prepare a referral: what is sought, why it is necessary and proportionate, which authority holds it, and what legal instrument is required. For a client this means advising them to report to law enforcement or to seek a court order, not finding a workaround. A good output is a referral note that helps the lawful process succeed. Stop and never engage a service offering these capabilities commercially.

Phase 11 — Avoid alerting and harassment

Do not call, message, or use silent or pretext contact to test a line. Such contact can breach communications, privacy, harassment and anti-fraud law, alerts the subject, and can destroy an investigation or a later prosecution. If contact is necessary, it should be open and for a legitimate stated purpose, or conducted by the authority that holds the case. A good output is a documented decision not to make contact, with the reasoning. Stop the moment a proposed technique depends on the subject not knowing.

Phase 12 — Minimise and retain proportionately

Numbers linked to individuals are personal data and, in many contexts, among the most sensitive identifiers a person has. Hold only what the requirement needs, restrict access, set a retention period tied to the purpose, and delete numbers of uninvolved third parties collected incidentally. Record the lawful basis. A good output is a minimised dataset with a documented retention decision. Stop when the holding is proportionate to the stated purpose rather than to what was easy to collect.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ITU-T E.164 numbering resources	Open	International numbering plan standard, country code assignments and national numbering plan notifications submitted by administrations.	Authoritative reference for country codes and the structure of the international numbering plan.
National regulator numbering allocation data	Open	Published allocation of number ranges to operators, with range type, holder and allocation dates, per national plan.	Primary source for range holder and line type, and the only authoritative basis for allocation claims.
US FCC and NANPA numbering resources	Open	North American Numbering Plan administration data including area codes, central office code assignments and rate centres.	Establishes geography and range holder for North American numbers, including non-geographic and toll-free ranges.
libphonenumber	Open	Open library encoding numbering plan rules for parsing, validating, formatting and typing numbers across countries.	Reference implementation for structural validation and line type classification without contacting any network.
ITU ICT statistics and country profiles	Open	Telecommunications indicators including subscription rates, operator counts and market structure by country.	Contextualises which operators serve a market and how prevalent mobile and fixed lines are in a given country.
GSMA resources	Registration	Mobile industry data on operators, network deployment, roaming and market structure across countries.	Identifies operators genuinely serving a market and their network characteristics for communications planning.
Company registries and statutory filings	Registration	Registered company records including contact telephone numbers declared in statutory filings and registers.	Lawful corroboration that a number is associated with a company, using an official record rather than a directory.
Internet Archive Wayback Machine (archived)	Open	Historic snapshots of web pages including business pages that previously displayed contact numbers.	Establishes historic association of a number with an entity and preserves listings that have since been removed.
Tenders and procurement portals	Open	Public procurement notices and awards which frequently include supplier contact details in published documents.	Independent official appearance of a number associated with a supplier, useful for corroborating claimed presence.
National fraud and scam reporting bodies	Open	Reporting channels and published typologies covering telephone-enabled fraud, spoofing and scam number patterns.	Checks whether a number or its pattern is already reported, and provides the lawful route for reporting fraud.
GSMA and industry guidance on number spoofing	Open	Industry material on calling line identity spoofing, authentication frameworks and mitigation approaches.	Explains why a displayed number is not evidence of origin, which is fundamental to interpreting reported numbers.
UN/LOCODE and ISO 3166	Open	Standard codes for countries, territories and transport locations with documented change histories.	Canonical coding of the country and territory a number belongs to, so records join reliably across systems.
Court and regulatory enforcement records	Open	Published decisions and enforcement actions against telecommunications providers and fraudulent operations.	Provides documented findings about providers and numbers already subject to enforcement, avoiding rediscovery.
Have I Been Pwned	Open	Index of identifiers including phone numbers appearing in known breach corpora, with breach dates and descriptions.	Establishes public exposure of a number, relevant to fraud risk and to SIM swap and account takeover assessment.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Telephony Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

libphonenumber — Parses, validates, formats and classifies numbers against encoded national plan rules. Limitation: plan data lags real-world changes, and validity does not mean the number is assigned or in service.
Regulator allocation lookup — Maps a number to the operator holding the allocated range from published data. Limitation: identifies the range holder rather than the current serving operator, because portability is not reflected in range data.
Lawful commercial number intelligence services — Return line type, range holder and, where lawful and published, portability status. Limitation: many vendors in this market offer unlawful location and record services alongside legitimate lookups, so procurement diligence is essential.
Archived web search across formats — Finds historic listings of a number in varied formatting and punctuation. Limitation: number formatting variance is large, so recall depends heavily on generating the right search variants.
Registry and filing search — Retrieves statutory filings that declare contact numbers for companies. Limitation: filings are often stale, and a declared number may have been reassigned years earlier.
Case management with entity linking — Associates numbers with entities, records provenance and supports set-level analysis. Limitation: numbers are weak identifiers that are reassigned, so links must carry dates or they become misleading.
Breach exposure notification services — Report whether a number appears in known breach corpora. Limitation: establishes exposure only, and the underlying corpora carry legal restrictions on possession and processing.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

A displayed calling number is a claim, not an origin. Calling line identity is trivially spoofed, so any analysis that treats a number shown on a handset or in a report as evidence of who called is starting from a false premise.
Range allocation identifies the range holder, not the serving operator. Portability moves numbers between operators without changing the range, so asserting the current operator from allocation data alone is a routine and avoidable error.
Mobile numbers carry no geographic meaning in most countries, and inferring a person's location from a prefix is wrong even before it becomes disproportionate. Geographic inference belongs only to genuinely geographic fixed ranges.
Structural validity means a number is well formed, not that it is assigned or in service. Invalid structure is a strong negative finding; valid structure is almost no evidence at all.
Any technique that tests whether a line is live also tells the subject you are looking. Silent calls, pretext contact and messaging probes breach law in many jurisdictions and destroy investigations in all of them.
Sets of numbers reveal what single numbers cannot. Contiguous allocation, shared provider, identical listing patterns and repeated appearance across front entities are the findings that actually support a network conclusion.
Virtual and VoIP provision is not evidence of deception. Legitimate businesses use virtual local numbers constantly, so the finding is only meaningful when reconciled against a specific claim about physical presence.
Treat any vendor offering handset location from network signalling as disqualifying. Those services are unlawful for private use, frequently fraudulent, and engaging them exposes the practitioner and the client to criminal liability.
Numbers are among the most sensitive identifiers a person holds, especially in low-connectivity settings where one number reaches an entire household. Minimise, encrypt and time-limit retention accordingly.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Telephony Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of number findings supported by regulator allocation data with a recorded version date, rather than by commercial lookup alone.
Rate at which requirements needing subscriber, record or location data were correctly referred to legal process rather than attempted internally.
Share of number-to-entity links carrying an as-of date and a preserved source appearance, reflecting that numbers are reassigned over time.
Detection rate for structurally invalid or implausible numbers in supplied contact data, as a measure of the validation gate working.
Number of set-level patterns identified across related entities, as a measure of whether analysis goes beyond single-number lookups.
Audit results on retention and minimisation of numbers relating to uninvolved third parties, tracked against the documented retention schedule.
Vendor assurance outcomes, measured as the proportion of telephony data suppliers reviewed and confirmed not to offer unlawful location or record services.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Assuming the country code reflects where the subscriber actually is, when numbers travel and roam freely.
Treating VoIP as inherently suspicious, when it is ordinary business telephony for most organisations.
Relying on stale aggregator range data after a reallocation or portability event has changed the answer.
Calling or messaging the number, which destroys covert posture and may alert the subject immediately.
Inferring identity from a caller-identification database entry with no provenance and no correction process.
Forgetting that disconnected numbers are recycled to unrelated people, often within months.

Legal and ethical considerations

This is where the legal line is sharpest. Interception, call detail records, cell-site and live location data require lawful authority and legal process, and are simply unavailable to private practitioners. Do not use services that claim to return handset location from network signalling. Numbers linked to individuals are personal data, so minimise, justify and time-limit retention. Silent calls, pretext contact or messaging to test a line can breach communications, privacy and anti-harassment law, and can also destroy an investigation.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Telephony Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 5 data points, 3 mission domains, 2 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can a phone number be located?

Not by a private practitioner, and not lawfully by anyone without legal process. Network-based location, whether from cell-site data, signalling protocols or operator systems, requires statutory authority and is available only to authorities holding it. Services advertising handset location from signalling are operating unlawfully for private customers, are frequently fraudulent, and engaging them can expose the practitioner and the client to criminal liability. Where location is genuinely needed, the answer is a referral to law enforcement with a clear statement of necessity. A number's country and, for geographic fixed ranges, its area are the only lawful geographic inferences.

Does the operator shown by a lookup tell you who serves the number?

Not reliably. Regulator allocation data identifies the operator holding the range, but number portability lets a subscriber move to a different operator while keeping the number, and portability data is published in only some jurisdictions. So a lookup may correctly report the range holder while the number is served by a competitor. State the distinction explicitly in reporting. Where portability data is published by the regulator or available through a lawful service, use it and record the date, because portability status changes and a stale answer is worse than an acknowledged unknown.

Is a VoIP or virtual number a red flag?

Only when it contradicts a specific claim. Virtual and VoIP numbers are used constantly by entirely legitimate businesses for local presence, call routing and cost, so the mere fact of virtual provision evidences nothing. It becomes analytically meaningful when reconciled against an assertion: a company claiming a staffed office in a city, whose only contact is a VoIP line provisioned through a reseller with no other presence in that market, is a finding. Report the reconciliation and its limits rather than the provisioning type as though it were suspicious in itself.

Can I call the number to see if it is real?

No, and this is one of the sharpest boundaries in the discipline. Silent calls and pretext contact can breach communications, privacy, harassment and fraud legislation depending on jurisdiction, and even a hang-up leaves a record on the subject's device. Beyond legality, the alerting cost is usually decisive: a subject who realises they are being examined destroys evidence, changes numbers and warns associates. If contact is genuinely required, it should be open, identified and for a stated legitimate purpose, or conducted by the authority holding the case under its own procedures.

What can call detail records show, and who can get them?

They show which numbers connected, when, for how long, and often which cell served the connection, but not content. They are held by operators and are obtainable only through the applicable statutory process, typically an authorisation or court order, with an MLAT or equivalent for foreign-held data. Interception of content requires a separate, higher authorisation. Private practitioners cannot obtain any of this lawfully. Where cell-site data is used evidentially, it requires expert interpretation, because a serving cell indicates coverage rather than a precise position and overstating it has caused serious miscarriages of justice.

How reliable is a number as an identifier over time?

Weak and decaying. Numbers are reassigned after disconnection, ported between operators, shared within households and businesses, and used through multiple devices and applications. A number that was associated with a person three years ago may belong to someone unconnected today, and acting on a stale link can cause serious harm to an uninvolved individual. Always attach an as-of date and a preserved source to any number-to-entity link, re-verify before relying on it, and prefer stronger identifiers where the decision matters.

What due diligence should be done on telephony data vendors?

Establish what each product actually queries and under what authority. Legitimate services return structural validation, range allocation and, where published, line type and portability. Any vendor offering subscriber identification, call records, or location from network signalling to private customers is offering something unlawful, and its presence in a catalogue is disqualifying for the whole supplier. Ask for the data source and the legal basis in writing, check for enforcement history, and record the assessment. Procuring an unlawful capability exposes the buyer as well as the seller, and ignorance of the source is not a defence.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ITU-T Recommendation E.164, defining the international public telecommunication numbering plan, country codes and number structure.
National numbering plans and regulator allocation instruments, which are the authoritative source for range holders, line types and geographic significance.
Interception of communications regimes such as the UK Investigatory Powers Act and equivalent national frameworks, which place interception and communications data acquisition under judicial or ministerial authorisation.
Mutual legal assistance treaties and the Budapest Convention on Cybercrime, governing cross-border acquisition of communications data from foreign providers.
GDPR and equivalent regimes, treating telephone numbers as personal data with lawful basis, minimisation and retention obligations, and treating communications metadata as highly sensitive.
ePrivacy rules on unsolicited communications and silent calls, which restrict contact for verification purposes and create enforcement exposure.
Anti-harassment and malicious communications legislation, which can be engaged by repeated or pretextual contact undertaken as an investigative technique.
Calling line identity authentication frameworks addressing spoofing, which govern how displayed numbers may be attested by originating networks.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

E.164 numbering plan and country code assignments — International Telecommunication Union. International standard for public telecommunication numbering
National telephone numbering plan and allocation data — Ofcom. Published allocation of number ranges to operators with range types
Numbering resources and North American Numbering Plan administration — US Federal Communications Commission. Area code, central office code and toll-free numbering administration
libphonenumber — Google. Open library encoding numbering plan rules for parsing and validation
Mobile industry data and operator resources — GSMA. Operator, network and market structure data across countries
Internet Crime Complaint Center — US Federal Bureau of Investigation. Reporting channel and typologies for telephone-enabled fraud
UN/LOCODE and international location codes — UN Economic Commission for Europe. Standard country and location codes used to normalise records
Wayback Machine — Internet Archive. Historic web snapshots preserving business contact listings (archived copy — the publisher moved or withdrew the original)
European e-Justice Portal — European Union. Access to national court, insolvency and business registers
Have I Been Pwned — Have I Been Pwned. Index of identifiers including numbers appearing in known breaches

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: numbering plan validation, range and line-type enrichment and lawful footprint correlation at scale. Explore the platform, or browse the rest of the library by following any tag above.