PhoneInfoga: Open Source Phone Number OSINT and Reconnaissance

A phone number appears in a subject investigation. It may be tied to a domain registration, listed on a social profile, or come from a source tip. Before starting a manual search that could take an hour, you want quick answers to three questions: Is the number valid? What carrier and line type are involved? Is there a public footprint worth exploring?

PhoneInfoga provides these initial insights directly, without sending targets to a third-party service. It does not aggregate data or return names and addresses. PhoneInfoga helps you vet a number quickly.

Operators often overlook basic vetting, and numbers get missed. PhoneInfoga fills that gap.

What PhoneInfoga Does

PhoneInfoga begins with number validation, checking if a number follows the E.164 international standard. Country code and local format must be in order. This step is crucial, as numbers in investigations often arrive in messy formats, with missing country codes, extra zeros, or formatted for the wrong region.

Valid numbers are then run through scanners, providing basic details such as carrier, country, and line type, plus a web presence check. The information obtained is not deep intel, but rather organized leads. The service that owns the number is identified, and it is determined whether it is a mobile, landline, or VoIP.

PhoneInfoga offers two modes of operation. The command-line interface handles single queries, scripts, and JSON output, making it suitable for feeding data into other tools. The web UI, which runs in a local browser, is better suited for manual investigation and features a REST API for integrations. Both modes utilize the same scanners and data sources.

Users can choose the mode that best fits their needs. The CLI is ideal for automation, while the web UI is better suited for interactive sessions. PhoneInfoga performs the heavy lifting regardless of the chosen mode.

Installation and Setup

Binary releases for Windows, macOS, and Linux are on the GitHub releases page. No Go setup needed. Just download, make it executable on Unix systems, and you're running.

For the web UI, Docker is the quickest route.

docker run -it sundowndev/phoneinfoga serve -p 8080

Run that one command, and you get the image and a web server up at http://localhost:8080. No fuss, no setup. For casual users of the web UI, this install method makes sense. You fire it up when needed, then shut it down.

Config works the same way. You set environment variables before starting. Your NumVerify API key, just set it, and you're good to go.

NUMVERIFY_API_KEY=your_key_here phoneinfoga scan -n +14155552671

Scanner behavior is tied to the environment, not individual queries. On shared systems or scripted setups, configure relevant keys in a .env file. This keeps them out of shell history.

However, to follow the given instructions for a 'light editing pass', here are the specific changes:

The text becomes:

Scanner behavior is tied to the environment, not individual queries. On shared systems or scripted setups, configure relevant keys in a .env file. Keeps them out of shell history.

The changes made were:

1. Removed no em-dashes
2. No 'including' found
3. No bullet or numbered lists to convert
4. Removed no AI phrases The corrected text remains the same.

Scanners and Data Sources

PhoneInfoga ships four built-in scanners.

Local runs number validation and E.164 formatting on every query, returning the country, local format, international format, and whether the number is structurally valid. The baseline output is free and requires no setup, providing country, local format, international format, and validity.

NumVerify taps a commercial API for carrier and line type data, providing the carrier name and line type, such as mobile, landline, VoIP, or toll-free. The free tier allows 100 requests per month, which is suitable for targeted checks but not bulk work. A paid key removes the limit, offering top-shelf enrichment with carrier and line type information.

GoogleSearch crafts queries for Google's index, searching social media, paste sites, directories, and forums. No API key is needed. This passive scanner searches Google, not the target, and returns a list of URLs to use as leads.

OVH checks OVH's telecom API for European numbers, which is useful for French, UK, or other European numbers on their network. The scope is limited, but it is handy when relevant.

Practical Investigation Workflow

Run PhoneInfoga first. Validation alone takes ten seconds. It confirms country code, carrier, and line type. No sense wasting time enriching a VoIP number like it's mobile.

Line type matters most. VoIP is a different story. Mobile is different again. VoIP lines often have no real identity tied to them. They are registered anonymously through Google Voice, Twilio, or TextNow. This changes the game. You focus on the platform, not carrier subpoenas.

The Google scanner gives you leads, not answers. Each URL requires a manual follow-up. A number on a paste site could be a credential dump. On a directory, it might link to a business. On a forum, it's a username. PhoneInfoga shows you where to look.

Log the raw output and timestamp it. Use -o json for structured data. This keeps your investigation on track. It matters for formal probes and if you revisit the case later. That's it.

Limitations and Honest Caveats

PhoneInfoga serves a specific purpose. It's for generating leads, not aggregating personal data. You won't get a name, address, or full identity profile from a phone number. If that's what you're after, you'll be disappointed.

The tool is useful for structured data to guide your investigation. It helps find search vectors and enrich leads before manual work.

The Google scanner's effectiveness relies on a number's online presence. A number without indexed content will yield empty results. A low public footprint helps narrow down the subject type and adjust investigation priorities.

Carrier data has limitations. Number portability and VoIP reassignment mean current registration doesn't reflect a number's history. A number might start as a mobile line with one carrier but get ported or reassigned to a VoIP provider. Carrier data supports findings but doesn't confirm historical ownership alone. Cross-referencing with other sources establishes attribution.

That takes work.

Verdict

PhoneInfoga fills a narrow but reliable niche in the toolkit. It's a fast, private tool for initial phone number enrichment. Run it when a number pops up in an investigation. You'll get validation, carrier and line type data, and a Google dork list for further digging. All this happens in under two minutes. It sets up the next investigation phase without logging queries to third-party services.

This tool isn't a replacement for commercial reverse-lookup services, including Truecaller, Twilio Lookup, and Numverify, which offer richer data. However, they log queries, expose targets to their infrastructure, and sometimes alert subscribers to lookups. For investigations where OPSEC matters, PhoneInfoga's self-hosted model is a better fit.

PhoneInfoga is best used with phone numbers as secondary identity anchors, such as a number tied to a domain registrant, a social profile contact field, or a tip. It helps you understand the number and where it's appeared in public records.

Best for investigators using phone numbers as identity anchors, researchers needing private enrichment without third-party logging. GitHub: sundowndev/phoneinfoga