Skip to content
HackIndex logo

HackIndex

Messaging Platform Enumeration from Phone Numbers

4 min read Apr 11, 2026

Overview

Messaging platform enumeration checks whether a phone number has active accounts on WhatsApp, Telegram, Signal, and similar services. These accounts often expose profile photos, display names, status messages, and last-seen timestamps that are not available through carrier or reverse lookup sources. A profile photo alone can confirm identity when cross-referenced with photos from other platforms.

WhatsApp

WhatsApp accounts are tied directly to a phone number. There is no username system. To check presence and retrieve profile data, add the number to a device's contacts and open WhatsApp. If the number has an account, a profile picture and display name will appear.

For bulk or automated checking without a personal device, the WhatsApp Business API can be used to check number registration status. This requires a verified Business API account:

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST "https://graph.facebook.com/v18.0/$WHATSAPP_BUSINESS_ID/contacts" -H "Authorization: Bearer $WHATSAPP_TOKEN" -H "Content-Type: application/json" -d '{"blocking":"wait","contacts":["+$PHONE_NUMBER"],"to_json":true}' 
{
  "contacts": [
    {
      "input": "+447911123456",
      "status": "valid",
      "wa_id": "447911123456"
    }
  ]
}

A status of valid confirms a WhatsApp account exists for that number. The wa_id is the internal WhatsApp identifier and can be used to construct a direct chat link: https://wa.me/447911123456. Opening this link in a browser when logged into WhatsApp Web shows the contact's current profile if they have not restricted visibility.

Telegram

Telegram accounts can use either a phone number or a username. Not all accounts have public usernames, but all are registered to a phone number. Two methods are available for enumeration.

If you have a suspected Telegram username, search directly:

┌──(kali㉿kali)-[~]
└─$ curl -s "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/getChat?chat_id=@$USERNAME" | jq '{id: .result.id, first_name: .result.first_name, username: .result.username, type: .result.type}' 
{
  "id": 123456789,
  "first_name": "John",
  "username": "johnsmith",
  "type": "private"
}

Phone Number to Account

Telegram allows finding accounts by phone number if the user has enabled this in their privacy settings. Using the Telegram client, import the number as a contact and check whether a Telegram account appears. This is a manual step but does not require any API access beyond a standard Telegram account.

Alternatively, the Telethon Python library can check number registration programmatically using a verified Telegram account:

from telethon.sync import TelegramClient
from telethon.tl.functions.contacts import ImportContactsRequest
from telethon.tl.types import InputPhoneContact

client = TelegramClient('session', API_ID, API_HASH)
client.start()

contact = InputPhoneContact(client_id=0, phone=PHONE_NUMBER, first_name='Test', last_name='')
result = client(ImportContactsRequest([contact]))

if result.users:
    user = result.users[0]
    print(f'Found: {user.first_name} {user.last_name} @@{user.username}')
else:
    print('No Telegram account found')

This only returns a result if the account owner has not restricted phone number lookup in their Telegram privacy settings. A null result does not confirm the number has no Telegram account.

Signal

Signal does not expose profile data publicly. There is no web interface and the API does not support unauthenticated lookups. The only practical method is adding the number to a Signal-registered device and checking whether the app shows the number as a registered Signal user.

Signal confirms registration status in the UI with a small indicator when composing a message. No profile photo or name is visible until the contact accepts a message. This makes Signal the least useful platform for passive enumeration.

Viber

Viber accounts are registered to phone numbers. Adding a number to your device contacts and opening Viber will show whether the number has an account and display their profile photo and display name if set.

iMessage and FaceTime

Apple's iMessage and FaceTime can confirm whether a number is registered to an Apple ID. Send an iMessage from an Apple device — if the message bubble is blue, the number is registered to an Apple ID. If it falls back to SMS, it is not. FaceTime audio or video call attempts also confirm Apple ID registration without completing the call.

Correlating Profile Photos

Profile photos retrieved from messaging platforms are high-value intelligence. Download every distinct profile photo and run it through reverse image search. The same photo appearing on other platforms under a different name, or appearing in news articles or public records, is a strong attribution link. Cross-reference with photos found during cross-platform correlation to build a consistent identity picture.

References