OSINT: How To Research & Investigate U.S. Phone Numbers
U.S. phone numbers are unique, compared to other countries, because of the publicly available information affiliated with their registered owners.
This post (that is intended for educational purposes only) is about ways of investigating U.S. phone numbers by using different sources of information that are reliable but generally invisible to Google searches.
Why Are U.S. Phone Numbers Special?
U.S. phone numbers are unique, compared to other countries, because of the kinds of publicly available information affiliated with their registered owners.
Marketing databases, US public records, and the existence of people trying to profit off of that information have made US numbers uniquely useful from a research perspective (or, depending on your view, a stalker’s perspective).
The process for researching a US number involves using one piece of information to find a second bit of information that leads to a third and then again.
So the researcher looks up the number to find the owner’s name/address, other people that lived with them (roomates, current and former spouse), and their email address. Along the way, the researcher will also pick up a few more bits of information too.
This research will involve finding other phone numbers and their owners, which could be confused with the original phone number’s owner. For sake of clarity, the owner of the original phone will be referred to as “Lex” from here on out.
Where To Begin
The first and easiest step is to search the number in a people-searching websites, such as:
These sites have access to large databases that link a phone number to its owner and their address. So if the number is listed at these sites the results will usually include, for starters, Lex’s name, home address, and possibly email address.
These results will often also include the Lex’s past addresses, the phones and names of others registered at those addresses, and a rough approximation of when all of those people had those phones and addresses. Sometimes these results are a jumble of names, numbers, addresses with only tenuous links. However, if a researcher spends a bit of time looking over this data it can often be possible to determine where and when Lex grew up, his siblings and parents, where he moved, who he lived with, and his current and former romantic partners.
What If There Were No Results?
If these sites gave you no results or conflicting results then there are a few alternative options that will at least find or confirm Lex’s name (which you still don’t know yet because you only have his phone number). These methods originate from episode 160 (click here to see it) of Michael Bazzell’s podcast, The Privacy, Security, and OSINT Show.
A.) You can lookup the phone number in a caller ID database on websites such as opencnam.com and calleridservice.com. The sites do require that you sign up for a free account. These websites will only give you the name of the person that owns the phone. However, anecdotal experience has shown that these sites ALWAYS had results.
Caller ID databases are a great way to confirm the owner’s name when you have conflicting information. Sometimes the people-searching sites mentioned above will provide conflicting results. This is often because one site identifies the phone’s current owner (Lex) while another site only identifies the previous owner of the same number. The owner identified in a caller ID website is usually the right one.
B.) Truecaller.com is another easy alternative but you do have to sign up for free. This is a interesting resource. The popular Truecaller app logs all of its users’ contacts. Once again, anecdotal experience suggests that there is a high likelihood that you will get results with this.
The website lets you search a phone number, like Lex’s, and if you get a result that means that Lex has the app or someone with Lex in their contacts list has the app. What is even more interesting is that when the website gives you the name of the phone’s owner, it is actually giving you the name that Lex’s associate had typed in their contacts list for Lex.
Maybe a coworker lists Lex as “Lex – IT guy,” or maybe Lex has a nickname and his friends call him “Lex Luther,” finally maybe a friend of his wife
C.) oldphonebooks has a database of phone books from before 2015.
The Name
Now that you have the person’s name, you can use it to try to find their email. There are several websites that can identify someone’s email address based on the information you have obtained by this point. Specifically, their U.S. -based name, address, phone number. Try using the following:
- That’s Them (thatsthem.com),
- Search People Free (searchpeoplefree.com),
- Public Email Records (publicemailrecords.com),
Now you will hopefully have an email address which should round out your research on this phone number.
Phone-Email Divide
One issue that can arise when you are researching an individual living in the U.S. is the Phone-Email Divide. If you have a phone number, at least in the U.S., you can use various people-searching websites to find additional information like the name and address. Similarly, an email address can be used to find affiliated social media accounts. But it is difficult to connect a phone number to an email, or vice versa. This post is about how to cross that gap between phones and emails.
The answer is to first use the email address to find a social media account that reveals the owner’s name. Once you have a name you can search it in a people-searching website that will find the phone affiliated with that name. This process also works in reverse.
People-Searching Websites
There are five people-searching websites in particular that can be used for this process. Each website has its own inputs (data you can search on) and outputs (results).
It is important to note that if you do not want your personal information listed on these sites, they each have an “opt out” option available.
True People Search (truepeoplesearch.com) is by far the most reliable site for researching a phone number. The site uses name, address, and phone number as search inputs or outputs. The site will sometimes give the person’s email as an output.
That’s Them (thatsthem.com) and Search People Free (searchpeoplefree.com) are not always consistent with their results but they use name, address, phone, and email as inputs and outputs. These people-searching websites have the obvious potential to solve the whole problem by linking a phone directly with an email, thus negating the need for the rest of this process. Therefore, it makes sense to start with these sites.
Xlek.com and Radaris.com will only let you search by name to find the phone, but not let you search in reverse. Public Email Records (publicemailrecords.com) uses email, name, and address as both inputs and outputs.
The Email
There are a few things we can learn about an email aside from social media accounts. The website hunter.io can tell us if it is a real, functional email or not. The website emailrep.io will guess how long the email has been active.
If It Is a Work Email Address
If the email is a work email address, we can look up the domain to see where the user works. We can also do a “domain lookup” at the website Snov.io and it will lookup for (usually successfully) email addresses with the same domain. These emails essentially identify the user’s coworkers.
If the domain is in Snov.io’s pre-existing list of known domains, it will identify the company and provide information from LinkedIn on individual employees. You can also do a domain search at Hunter.io and Normshield to find employees. If you are interested, this subject is addressed in greater detail here.
Identify Social Media Accounts Registered to the Email
We can identify social media and other online accounts registered to a specific email address in a very straightforward process of 6 steps.
CREDIT WHERE IT IS DUE: This process does not require a knowledge of Python but the explanation must address the computer language a bit. The Github user account Megadose hosts an amazing Python script named Holehe and deserves a lot of credit for this creation.
The script will find the different social media networks where the email is registered to an account. However, because many people do not know anything about Python, I’ve come up with a process intended for people that do not know anything about python and do not want to learn about it. It is a rote process requires no knowledge of python, no downloads, and no thinking at all.
Instructions for First Time Using Holehe
Step 1 (the hardest) – Click here and sign up for an account on Github . Sorry, that is more than one step but the process is simple and it gets easy afterward.
Step 2 – Login to Gitpod. You do not need to sign up for Gitpod if you already have a Github account. Go here (https://gitpod.io/login/) and you will see an option on the left to sign in with your Github account even though you don’t have a Gitpod account. See below:
Once you have logged in your page will probably look like this:
Step 3 – Copy and paste this url into your browser and hit Enter:
gitpod.io/#https://github.com/megadose/holehe
Why? – Basically, you are making a url that consists of the gitpod website url, a hashtage, and the url of the github page for the script.
Here is the explanation. We want to run a Python script but to do so we need a development environment. Normally you would download it but in this case, Gitpod provides a development environment online where you can run Python scripts. When you identify a script posted on Github you create a url of the Gitpod website’s url, a Hashtag, and the url for the page hosting the Python script. So with our script hosted at https://github.com/megadose/holehe, we create a url like this:
gitpod.io + /# + https://github.com/megadose/holehe
Gitpod will create a workspace, a virtual computer, specifically for running the script. The script and its affiliated files will be downloaded though you will likely still have to run the setup.py file, or its equivalent. If you go to the script’s page on Github there should be instructions for downloading and running the script.
Wait for Gitpod to do some processing and then your computer should look like this:
Step 4 – At the bottom of the screen find where it says “/workspace/holehe $”.
Click to the right of these words and type “python3 setup.py install” and then hit enter.
Step 5 – Wait for the install to complete and then right click on the folder on the type left that is named “holehe” (not the one titled “holehe.egg-info”). When you right click on the folder a drop down menu appears, choose “open in terminal”.
A new tab has appeared in the terminal, notice the new tab that reads “gitpod /workspace/holehe/holehe” and the cursor is located next to a similarly named prompt.
Step 6 – Finally, choose your email that you want to research, in our case we will use the fake example email “[email protected]”
Now the last thing to do is type in the final sequence with your email in place of our fake example. So find the prompt “gitpod /workspace/holehe/holehe $” and next to it you will type the following and hit enter:
“holehe [email protected]”
Results: Separately, I ran a real email address for an example to show how the results should look. The output is a list of 50 or so social media networks and other websites. If the name of the site/network is purple, there was no account on it, green means there is an account registered with the email address and red means the script could not check the site. Hopefully you got something like this:
Now that you’ve done this once, the process will be much easier in the future. Next time
Login to Gitpod and there will be a workspace named for the script. It should look like the image below. Just click “Open” on the workspace.
From here, you repeat steps 4, 5, and 6. You install setup.py, open a new terminal tab, and run the command.
n the future, login to ur accountclick on workspacesfind the workspace for that script (the only one), and click on start (maybe its a dif word) then, repeat the last 3 steps from the initial guide (install setup.py, open the specified folder, type in the command)
What Next? Use Breach Data Websites
Breach data websites will let you search if an email address (or other personal information) was listed in a specific data breach. For our purposes here, many data breaches are not useful. However, for example, there was a Linkedin data breach in the past and therefore if you search for an email address and find it was listed in that databreach, that means the email was registered to an unidentified Linkedin account. Now you know to look for an account in Linkedin for that email.
You can use these websites that may find additional accounts that were not discovered by Holehe. There is a lot of overlap between these sites so I would only search one or two.
How to Find Specific Accounts
Now that you hopefully have a list of social media sites where the email is/was registered, you can use a few tricks to find the specific accounts.
Please note, I did not create any of these methods. I am merely listing them together to make it easier to use them all. I will identify specifically who deserves the proper credit and I encourage you to follow them online.
Find Linkedin Account
Side Note: Remember that a LinkedIn user can see who looked at their account.
If the email address is registered to a Linkedin account we can find the specific address and avoid having to search around for it. One of the default settings of Linkedin is to allow others to find you based on your email. Linkedin does this to encourage people to use its paid services. But it is possible to take advantage of this opening without needing to pay.
Many sites inaccurately report that a Linkedin account can be identified using the url “linkedin.com/sales/gmail/profile/viewByEmail/[example email address here]”. This no longer works. The process below that currently works might similarly stop if LinkedIn decides to block it.
A new, working method was discovered by Steve Adams of IntelligenceBySteve.com, click here to see his article (you are highly encouraged to follow his website). Below is a shortened version of what he wrote but is largely verbatim.
- Create a Microsoft account at “https://account.microsoft.com/account?lang=en-us”
- Sign in to the web-based version of Outlook with the url “https://outlook.live.com/owa/” and using your Microsoft account.
- Within Outlook, go to your contacts section at “https://outlook.live.com/people”
- Create a new contact by selecting “Add a contact” and add the email address to its details. [sidenote from search-ish: In the contact details type a random unrelated letter, like “x”, as the name. This avoids confusion later, because if the site can’t find the Linkedin account it will show a list of guesses based on the name.]
- Click on the profile photo or letters, next to your new contact and within the new sub-window select “LinkedIn”.
- Click “Continue to LinkedIn” on the pop-up and then sign in to your LinkedIn account, then finally click “Accept”. [end of info from Steve Adams]
Find More Info with LinkedIn Account URL
Once you have identified the LinkedIn account , you can copy and paste the account page’s url into the search function at Rocketreach.co. As seen below, its search function use a Linkedin url, among various other criteria.
This search on Rocketreach can potentially find phone numbers, email addresses, and social media accounts that are not publicly connected to the Linkedin account holder.
Find Their Facebook Account
CREDIT WHERE IT IS DUE: This process was explained by Technisette on the OsintCurio.us webcast from December 19th 2019, titled “20191223 The OSINT Curious Special Facebook Webcast”, available on Youtube (click here) where Kirby (website, Twitter: @kirbstr) and Technisette (website, Twitter: @technisette) explain updated methods for investigating on Facebook. You are highly encouraged to follow Kirby, Technisette, and OsintCurious.
The first step is to log into facebook and click the 3 horizontal lines that mean the “more” option, then click “pages” and then ” + create a new page”. After you’ve created a page take these steps
- click on “pages” once again and then click on your page, which should appear.
- click on the page you created
- click “settings”
- “page roles” and you will get to this page below:
5. “assign a new page role”
6. type in the email address below that
7. if a facebook account appears in the drop down menu, click on it. (if no facebook account appears, sorry but that means you have hit a dead end with this process, it is time to try something else)
8. click “network” tab
9. in the search bar that is slightly down and to the left of the “network” tab, typed in the word “account” or “ANYONE_EXCEPT_VERIFIED_ACCOUNT”
10. That should filter the results to the ones with “ANYONE_EXCEPT_VERIFIED_ACCOUNT”. click on the bottom one in the list and a “preview” tab should appear.
11. look under the “preview” tab and the account’s name and ID number should be in there (if that information is not in the preview tab, try clicking the other results in the list, it should be in one of those results).
12. Verify that you have found the account info by pasting the ID number at the end of the url “facebook.com/” and this should bring up the account that you saw in the drop down menu from step 7.
If the facebook account is completely private, there is a nice guide at osintcurio.us for researching private accounts, click here.
Google Account
CREDIT WHERE IT IS DUE: I learned of the following by listening to the OsintCurio.us podcast/webcast #45 that you can access here. I give more specific credit for individual developments where it is due in the paragraphs below.
EPIOS (https://epieos.com/) created a google account finder (click here). If someone has a google account this will find it. The results generally include their real name, a general location down to the city level, and any reviews they posted on Google Maps. This last one is a bit weird but I promise you that it is surprisingly common that people leave random reviews of places and businesses that they have used and are often revealing about the person or their location.
If you are researching an email address that is gmail, you can assume they have a google account. Other email addresses also often have associated google accounts.
ADDITIONAL RESOURCES AND CREDIT: You can also use the Python code GHUNT that is located here, on the Github account for MXRCH. In order to understand the role of Google IDs in Osint and how to obtain and use them more manually, see these articles here and here by Sector35 (website, Twitter: @Sector035)
Okay that is it, Good Luck!
About The Art Used In This Article
The awesome artwork used in this article is the work of Zaki Abdelmounim. He is a 25-year-old Moroccan 3D generalist living in Qatar and working in the TV industry. This project is called Hardcoding:Redshift Study, Zaki started the project after watching the movie Chappie, he really liked the concept of the command chair that was done by George Hull, and wanted to recreate something similar in 3D for the sake of practice and fun, resulting in what we think is the worlds best hacker desk design. Learn more about this project here.
