Enterprise capability
Phone-number risk profile
Bulk registration, promo abuse and account trading nearly all come in through a phone number. What your
risk system sees at signup is a well-formed number with a plausible home region that can receive an SMS
code — indistinguishable from a real user.
We look at it from a different position: the numbers are captured directly from SMS-receiving platforms
and SIM-vending platforms, not inferred from behaviour. So we can answer more than “is this number
suspicious” — we can say what it is being used for in the attacker economy, and whether it is
still in use.
Why behavioural signals cannot see it
Judging a number by behaviour assumes it has already done something in your system — registered,
claimed a coupon, been reported. But an attacker's number is appearing at your door for the first time:
it was bought from a card vendor moments ago and has no history with you at all. By the time it has
accumulated behavioural signals, that wave is over.
The supply side is different. Before a SIM-farm card is ever pointed at your business, it has been
sitting on an SMS-receiving platform for a long time — rented out, priced, used again and again.
That is where we see it.
Which also means: we know what it costs
A matching number comes back with the platform selling it and the price it goes for in the attacker
market. That a number costs a few cents says more about your opponent's cost structure than any risk
score does — and explains better than anything why making the SMS challenge harder does not stop them.
Not one score, but a set of judgements you can route on
Two numbers can both be “risky” and still deserve completely different
handling. This is the most practical part of the profile:
| Type | What it is | Suggested handling |
|---|
| SIM-farm card |
Captured directly from SMS-receiving and SIM-vending platforms; held and actively used by attackers |
Block outright at signup and coupon claim |
| Account-farm card |
The number bound to a ready-made business account sold by attackers |
Step up verification on login and on changing the bound number |
| Intercepted card |
SMS send/receive hijacked by malware; the owner is a normal user |
Do not block as an attacker — they are the victim. Notify and re-verify |
| Privacy number |
A privacy number from a number-rental platform or a cloud vendor, easily bought by attackers |
Decide by your own tolerance; a blanket rule is a poor fit |
| Historic-risk card |
Captured once, but absent for more than 90 days and the number's status has changed — it may now belong to an ordinary user |
Do not treat as current risk, or you are penalising a real user |
| Likely crowdsourced human |
The device tied to the number carries several crowd-work apps |
A priority target for campaign-redemption and ad-fraud controls |
“Intercepted card” and “historic-risk card” are the two we most
want you to notice. In a product that returns only a score, they land in the same high band as
SIM-farm cards — and what you then block is an ordinary user whose phone has malware, and a new
customer who happens to have inherited a number. Labelling them separately exists to stop you doing that.
Where it gets used
Signup and acquisition
Check once at registration, new-user coupon claim and first-order campaigns. Bulk-registered
numbers are stopped before they enter your user base, rather than showing up as an anomaly after
the coupons have gone out.
Account security
On anomalous logins, rebinding and account recovery, whether the number belongs to a ready-made
account traded by attackers directly decides whether to add a challenge.
Campaign and ad-fraud controls
For numbers entering redemptions, group-buy discounts and referral campaigns, this identifies
crowd-work participants — they are real people whose behaviour is nearly impossible to separate
out, but their numbers left traces on the supply side.
Stock-taking on your existing base
Run your whole user table through once to see how much of what you have accumulated is attacker
supply. Billed per number, so one pass tells you the baseline without wiring up a real-time path first.
What we return is a judgement that expires
Numbers get recycled, change owner, and attackers abandon one batch of cards and buy another. So every
result carries when it was last observed and whether that evidence still counts.
A number captured three years ago and never seen since, and a number that was on an SMS-receiving
platform yesterday, are not the same conclusion here — even when their raw risk scores match. Treating
those two alike is the most common, and most expensive, source of false positives in phone-number risk.
No match does not mean safe
The set contains only risk numbers we have already captured. No match means we hold no verifiable
evidence; it does not mean the number is clean. Read it as “nothing found”, not as
“cleared” — it is in the API reference, and it is here.
Coverage and refresh
About 210 million numbers
Mainland-China and international sources merged into one consistent definition; international
numbers also come back with their home region.
Rebuilt daily, incremental within a minute
Every response carries the data version used for that lookup, so you can archive the version
alongside the conclusion and reproduce it afterwards.
Integration and billing
One HTTP endpoint, single and batch forms, JSON responses. Numbers go in the request body, never in
the URL — URLs end up in CDN edge logs, reverse-proxy logs and browser history, and a phone number is
personal data that we would rather not scatter through any of those. We suggest you keep the same
convention on your side.
Billed per number, not per request: a batch of 500 numbers counts as 500. Numbers that cannot be
parsed are not billed. The allowance is entirely separate from IP lookups and the two never draw on
each other. Endpoint details are in the API reference; for addresses see the
IP risk profile.
This is an enterprise capability
A phone number is personal data, so we do not offer this as something anyone can self-serve after
signing up. Contact us first with your use case; pre-sales can open a time-limited trial allowance so
you can run it against your own data before deciding.