# Messaging Platform Enumeration from Phone Numbers

- **URL:** https://hackindex.io/platforms/osint/identity-and-people-intelligence/phone-number-intelligence/messaging-platform-enumeration
- **Path:** OSINT > Identity & People Intelligence > Phone Number Intelligence
- **Up:** [Phone Number Intelligence](https://hackindex.io/platforms/osint/identity-and-people-intelligence/phone-number-intelligence.md)
- **Published:** 2026-04-11
- **Updated:** 2026-04-11

## Overview

Messaging platform enumeration checks whether a phone number has active accounts on WhatsApp, Telegram, Signal, and similar services. These accounts often expose profile photos, display names, status messages, and last-seen timestamps that are not available through carrier or reverse lookup sources. A profile photo alone can confirm identity when cross-referenced with photos from other platforms.

- **WhatsApp** ties accounts directly to phone numbers with no username system, exposing profile photos and display names via wa.me links.
- **Telegram** supports both username search via bot API and phone-to-account resolution through the Telethon client library.
- **Signal** only confirms registration status on-device with no public API, making it the least useful for passive enumeration.
- **iMessage/FaceTime** confirm Apple ID registration through blue bubble detection or FaceTime call attempts without completing the call.
- **Profile photo correlation** cross-references retrieved photos with reverse image search and other platforms for identity confirmation.

## WhatsApp

WhatsApp accounts are tied directly to a phone number. There is no username system. To check presence and retrieve profile data, add the number to a device's contacts and open WhatsApp. If the number has an account, a profile picture and display name will appear.

For bulk or automated checking without a personal device, the WhatsApp Business API can be used to check number registration status. This requires a verified Business API account:

```bash
# Note: the /contacts lookup endpoint was sunset by Meta in 2024 and no longer works.
# Confirm active WhatsApp via direct link: opens an active chat window if the number is registered:
# https://wa.me/$PHONE_NUMBER
curl -s "https://wa.me/$PHONE_NUMBER" | grep -i 'whatsapp'
# {
#   "contacts": [
#     {
#       "input": "+447911123456",
#       "status": "valid",
#       "wa_id": "447911123456"
#     }
#   ]
# }
```

A status of `valid` confirms a WhatsApp account exists for that number. The `wa_id` is the internal WhatsApp identifier and can be used to construct a direct chat link: `https://wa.me/447911123456`. Opening this link in a browser when logged into WhatsApp Web shows the contact's current profile if they have not restricted visibility.

## Telegram

Telegram accounts can use either a phone number or a username. Not all accounts have public usernames, but all are registered to a phone number. Two methods are available for enumeration.

### Username Search

If you have a suspected Telegram username, search directly:

```bash
curl -s "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/getChat?chat_id=@$USERNAME" | jq '{id: .result.id, first_name: .result.first_name, username: .result.username, type: .result.type}'
# {
#   "id": 123456789,
#   "first_name": "John",
#   "username": "johnsmith",
#   "type": "private"
# }
```

### Phone Number to Account

Telegram allows finding accounts by phone number if the user has enabled this in their privacy settings. Using the Telegram client, import the number as a contact and check whether a Telegram account appears. This is a manual step but does not require any API access beyond a standard Telegram account.

Alternatively, the Telethon Python library can check number registration programmatically using a verified Telegram account:

```python
from telethon.sync import TelegramClient
from telethon.tl.functions.contacts import ImportContactsRequest
from telethon.tl.types import InputPhoneContact

client = TelegramClient('session', API_ID, API_HASH)
client.start()

contact = InputPhoneContact(client_id=0, phone=PHONE_NUMBER, first_name='Test', last_name='')
result = client(ImportContactsRequest([contact]))

if result.users:
    user = result.users[0]
    print(f'Found: {user.first_name} {user.last_name} @{user.username}')
else:
    print('No Telegram account found')
```

This only returns a result if the account owner has not restricted phone number lookup in their Telegram privacy settings. A null result does not confirm the number has no Telegram account.

## Signal

Signal does not expose profile data publicly. There is no web interface and the API does not support unauthenticated lookups. The only practical method is adding the number to a Signal-registered device and checking whether the app shows the number as a registered Signal user.

Signal confirms registration status in the UI with a small indicator when composing a message. No profile photo or name is visible until the contact accepts a message. This makes Signal the least useful platform for passive enumeration.

## Viber

Viber accounts are registered to phone numbers. Adding a number to your device contacts and opening Viber will show whether the number has an account and display their profile photo and display name if set.

## iMessage and FaceTime

Apple's iMessage and FaceTime can confirm whether a number is registered to an Apple ID. Send an iMessage from an Apple device: if the message bubble is blue, the number is registered to an Apple ID. If it falls back to SMS, it is not. FaceTime audio or video call attempts also confirm Apple ID registration without completing the call.

## Correlating Profile Photos

Profile photos retrieved from messaging platforms are high-value intelligence. Download every distinct profile photo and run it through reverse image search. The same photo appearing on other platforms under a different name, or appearing in news articles or public records, is a strong attribution link. Cross-reference with photos found during [cross-platform correlation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/username-enumeration/cross-platform-correlation) to build a consistent identity picture.

## References

- [WhatsApp Cloud API: Phone Numbers](https://developers.facebook.com/docs/whatsapp/cloud-api/phone-numbers) - Contact validation endpoint for checking WhatsApp registration status
- [Telethon Documentation](https://docs.telethon.dev/en/stable/) - Python Telegram client library for programmatic account and contact lookups