When it comes to OSINT in China, one data point consistently outperforms the rest: the phone number. That's because in China, phone numbers are an essential part of the unique internet ecosystem; they’re integrated into real-name requirements, messaging apps, financial accounts and a whole host of other identity-verified online services.
Thanks to these real-name requirements, a single number can unlock an entire digital footprint - making OSINT Chinese phone number investigation a key skill in any investigator’s toolkit. So what’s the catch? Well, like anything else on the Chinese internet, Chinese phone numbers are different to Western ones.
Chinese phone numbers follow different patterns, use idiosyncratic carriers, and connect to platforms many Western investigators overlook. That’s where specialised China OSINT tools and skills come in. This guide will walk you through everything you need to know about doing OSINT with Chinese phone numbers. We’ll tell you how to analyse a target’s digits, what their structure reveals, and how to use cutting-edge OSINT tools to automate your investigations.
For a rundown on the Chinese internet, check out our ultimate guide to Advanced OSINT for China: SOCMINT on WeChat, Weibo, and More
Understanding Chinese Phone Numbers for OSINT
Before we dive into investigative techniques, let’s learn some more about Chinese phone numbers. It’s important that every China OSINT investigator understands their structure; that way, a phone number can instantly become a lead, no tools required.
Chinese Mobile Numbers (eg. +86 1XX-XXXX-XXXX)
All Chinese mobile numbers start with a set structure:
- +86 is the country code
- 1 indicates a mobile device
- Then, the carrier prefix identifies the carrier.
Common carrier prefixes include:
- Major networks, eg. China Mobile, China Unicom, China Telecom
130–139, 150–159, 180–189, 190–199 - MVNOs / resellers (Snail Mobile etc.)
170, 171, 175, 176, 177, 178
MVNO (or Mobile Virtual Network Operators) numbers frequently correlate with short-term or anonymous usage - basically, burner phones - and are popular for sketchy activity: scams, fraud, or VoIP rerouting.
If you have a Chinese mobile number, this knowledge gives you some instant investigative leads. First, the country code confirms if the caller is Chinese or not. Second, the 1 tells you they’re calling from a mobile device; which raises the question of burner phones. If the carrier prefix matches a major network, the number is persistent and worth plugging in to OSINT tools. If it’s an MVNO, that could indicate dodgy dealings.
Phone Lookup vs. Reverse Lookup in China
There are two main workflows in China OSINT phone investigations: phone discovery (or lookup), and reverse phone lookup. They might sound similar, but they’re actually completely different. Let’s find out how.
Phone lookup (aka phone discovery) starts with a data point that isn’t a phone number - a name, business details, or even an email address - and then tries to find the phone number linked to the same target.
Reverse phone lookup works in the opposite direction. It starts with a phone number, then uses it to find other data points. A Chinese phone number can help you map an entire identity; Chinese mobile numbers often tie to a wide network of online activity, from messaging to money.
As you can see, it’s all about what data you’re starting with - and which direction the investigation flows. Usually, you’ll use phone discovery workflows for corporate research like supply chain investigations, or due diligence. Reverse phone lookup is much more useful in China; these searches tend to reveal the richest intelligence because of the way Chinese telecom systems integrate real identity information.
How to Run Reverse OSINT Chinese Phone Number Investigations
A typical China OSINT investigation often starts with nothing more than an unfamiliar +86 number… but can lead to a whole world of data. Here’s our pro strategy for reverse phone lookup in China.
1. Start with a Google dork
Although China’s internet is locked behind the Great Firewall, many Chinese websites are still searchable through typical Western search engines. Plug the number into Google with operators and variations. For phone numbers, put your digits in quote marks (“13812345678”), or try the same query combined with keywords - in Mandarin - like 招聘 (hiring), 微信 (WeChat), or 出售 (for sale) appended.
Want to learn more about the Great Firewall? Check out Playing with Fire: OSINT and China’s Great Firewall
2. Check Chinese Apps
Messaging and social platforms are symbiotic in China. “Super-apps” offer messaging, socials, and more all wrapped up in one - and tied together with a phone number.
Phone numbers are the primary login credential for most services, from QQ to Alipay, and many may even display basic profile information when you add a user to your contacts. WeChat, in particular, is a goldmine: many users voluntarily connect their photos, nicknames, location and phone number together on their profile. Search in-app or with a service like Sogou.
3. Look for Business Registrations
Phone numbers are a big part of China’s public business registration system. Company contact lines, sales numbers, and legal rep details are often publicly published on official databases, or advertised in third-party supplier directories. If a company has a number, you can use that to monkey-branch into most other data points: registered address, industry category, corporate history, responsible parties… and more. Just check the business registries.
4. Search Data Breaches (Safely)
Chinese phone numbers are ten-a-penny in countless consumer platform leaks. E-commerce breaches and social media dumps are a hazard of real-name requirements; social sites become an easy target for identity thieves. Searching through the spoils is a legal grey area, however - China’s data security laws are tough, and carry harsh punishments. Use compliant OSINT tools to safely include this data in your search.
5. Automate Everything with a Dedicated China OSINT Tool
Rather than wasting your life manually checking each Chinese platform for your target phone number, why not make things easier with OSINT tools? A platform like OSINT Industries can safely cross-reference hundreds of sources instantly - messaging apps, business directories, social networks, breach datasets, and online listings - and give you a complete, fully sourced report in seconds. For fast-turnaround investigations, this is by far the most efficient method.
How to Discover a Chinese Phone Number with OSINT
Sometimes, you won’t be starting with a Chinese phone number. But never fear; discovery is often much easier than you expect. Many Chinese websites openly publish contact numbers for businesses. So, start by combing company pages, before expanding your search across the Chinese corporate net: supplier directories, job postings and local listing services frequently reveal mobile or landline numbers. Professional registries for lawyers, doctors, accountants, or licensed specialists could also display contact lines.
Or, you could just hop on a specialised OSINT platform. OSINT Industries can start with any identifier (from usernames to emails to real names) and return connected Chinese phone numbers. Automated cross-referencing will dramatically reduce the time your investigation takes - and bring up answers you’d never even think to look for.
Crypto scamming, stolen savings and financial slaughter - all solved with OSINT. See how Chinese OSINT made the pig butchers squeal in our Case Study:
“Aidan’s clients had lost their $50,000 to a ‘butcher’ that promised them a straightforward real estate investment, only to fill his own piggy bank with their savings … What these scammers don’t realize is that by providing contact details before they vanish, they’ve just made a pigs’ ear of their tidy profit.”
