Fraud prevention
Catch disposable VOIP, simulated subscribers, and dead lines before they enter your funnel — or worse, your OTP queue.
HLR Lookup · Enterprise
Validate every number before you send it.
Query the Home Location Register of any operator in 200+ countries. Get live reachability, line type, the carrier that owns the number today, and roaming state — to clean lists, score fraud, and route at least cost.
200+ countries<50ms cached99.99% uptimeGDPR-aligned
BroadNet · number intelligence
POST /sms/lookup
200+
Countries
~350ms
Live dip
MNP
Aware
By the numbers
Built for production, measured every cycle.
Each lookup hits the operator HLR in real time and returns a timestamped response your application can audit later.
Latency
~350ms
p99 response
Live HLR query, not a cached guess.
Coverage
200+
countries
Every operator that publishes an HLR.
Portability
MNP
aware
Resolves ported numbers to current owner.
Compliance
GDPR
+ UAE PDPL
Lookup-only mode keeps numbers off disk.
How one lookup happens
From your MSISDN to
a live HLR answer, in five hops.
Real SS7 MAP queries (or Diameter, on 5G cores) against the destination operator's HLR. Not a stale third-party feed — the same path our own router uses to score every SMS we ship.
- 01 · QueryPOST /sms/lookup
MSISDN in E.164. Batch endpoint accepts up to 10,000 numbers per call for list-hygiene runs.
p50 < 40ms - 02 · Cache30-day cache
Cached results return in under 50ms with the same operator and port-status fidelity.
p50 < 50ms - 03 · MAP querySS7 MAP / Diameter
Live HLR query routed via our SS7 / Diameter network to the destination operator's HLR. Real MAP, not a third-party data feed.
p99 < 350ms - 04 · ResolveMCC + MNC + port
Returns the live operator (post-port), country, network status, roaming status, IMSI prefix, and reachability. All in one JSON.
p50 < 20ms - 05 · DecisionUse the result
Decide route, decide currency, skip dead numbers before they bill. The same lookup powers our own SMS routing internally.
your call - ← MCC · MNC · port-status · reachability
01 · Query
POST /sms/lookup
MSISDN in E.164. Batch endpoint accepts up to 10,000 numbers per call for list-hygiene runs.
p50 < 40ms
02 · Cache
30-day cache
Cached results return in under 50ms with the same operator and port-status fidelity.
p50 < 50ms
03 · MAP query
SS7 MAP / Diameter
Live HLR query routed via our SS7 / Diameter network to the destination operator's HLR. Real MAP, not a third-party data feed.
p99 < 350ms
04 · Resolve
MCC + MNC + port
Returns the live operator (post-port), country, network status, roaming status, IMSI prefix, and reachability. All in one JSON.
p50 < 20ms
05 · Decision
Use the result
Decide route, decide currency, skip dead numbers before they bill. The same lookup powers our own SMS routing internally.
your call
Why HLR before send
Four reasons it pays for itself
on day one.
Cost optimisation
Don't pay to send to unreachable handsets. An HLR query costs a fraction of the SMS that would have been spent and lost.
Routing intelligence
Discover the current operator (not the historical one) and pick the direct route. Ported numbers are routed correctly the first time.
Compliance audit
Timestamped lookup results prove the number was validated and consented at the moment of opt-in — defensible under GDPR and PDPL.
100%
auditable trail
Capabilities
Everything you'd ask the network,
in one HTTPS call.
Real-time HLR queries
Live SS7/SIGTRAN dip against the operator HLR. No stale data, no probabilistic guesses — the answer you get is the answer the network has right now.
~350ms live<50ms cached
MNP / portability detection
Resolves ported numbers to the operator that actually serves them today. Crucial in markets where 25–40% of mobile numbers have been ported at least once.
IMSI-awarecurrent MNC
Roaming state detection
Identify subscribers currently roaming outside their home network. Useful for fraud scoring, roaming alerts, and avoiding international surcharges.
MSC / VLR data
Batch enrichment
Submit lists of up to a million MSISDNs per request. Results stream back as NDJSON or land in your S3 bucket as Parquet — ready for the warehouse.
1M / batchS3 + NDJSON
Smart caching
Per-account TTL from 0 (always live) to 30 days. Repeat lookups within the window are served from edge cache, billed at the cache rate.
0–30d TTLedge cached
No PII stored
Lookup-only mode returns the answer and forgets the question. No MSISDN on disk, no logs containing customer numbers, GDPR right-to-erasure by design.
zero-retentionGDPR Art. 17
Customer stories
Three teams that turned HLR
into measurable savings.
Tier-1 GCC operatorTelecom · GCC
- Challenge
- An interconnect-billing engine needed authoritative number intelligence at high volume without paying full live-query rates.
- Approach
- BroadNet's HLR sits inline with a hot-subscriber cache tuned to the routing engine's access pattern.
Interconnect engineering lead (reference under NDA)
African mobile operator groupTelecom · Sub-Saharan Africa
- Challenge
- Dead numbers across several African marketing lists were dragging delivery and inflating spend.
- Approach
- A batch HLR run cleaned the lists ahead of the next campaign cycle.
CRM & loyalty lead (reference under NDA)
South Asian bankBanking · South Asia
- Challenge
- Digital signup flows were losing accounts to MSISDN-country mismatch fraud.
- Approach
- Every signup MSISDN is HLR-checked against the country declared on the form, with mismatches flagged for manual review.
Digital fraud prevention lead (reference under NDA)
Batch lookup
Scrub a million numbers
before lunch.
Submit the entire list; we chunk it into calls of 10,000 and stream the results back as NDJSON, so you can pipe straight into your data warehouse.
Up to 1,000,000 MSISDNs per batch
Streaming response — no polling, no callbacks
S3, GCS, Azure Blob, Snowflake, BigQuery sinks
node.jspythoncURL
HLR · MNPimport { Configuration, SMSSMSApi } from "@broadnet/cpaas-sdk";
const sms = new SMSSMSApi(
new Configuration({
basePath: "https://api.broadnet.me",
accessToken: process.env.BROADNET_TOKEN!,
}),
);
// HLR / MNP lookup before sending: POST /sms/lookup
for (const destinationNumber of await readNumbers("./list.csv")) {
const res = await sms.smsLookupPost({ destinationNumber });
writeToWarehouse(destinationNumber, res.data);
}Integrations
Drop it in. Anywhere.
REST API
OpenAPI 3.1, Bearer-token auth, retries with jitter.
SMPP plugin
Inline HLR dip on every MO/MT bind — no app changes.
Official TypeScript SDK
@broadnet/cpaas-sdk for Node.js; generate a client for any other language from the OpenAPI 3.1 spec.
Excel plugin
Validate a column of numbers without writing any code.
Pricing
From $0.003 per live lookup.
Volume discounts start at 100K lookups a month. Cached hits are billed at a fraction of the live rate. No setup fees, no minimums, billed in USD, EUR, or AED — rates shown are indicative.
Compliance
Engineered for regulators
you actually have to satisfy.
MENA, EU, UK — different rules, one shared need: show that you checked the number was live, and when. Every lookup returns a timestamped result you can file as the audit artifact.
GDPRUAE PDPLKSA PDPLTDRACSTNTRAISO 27001
GDPR & UAE PDPL
Lookup-only mode returns the answer and discards the number. EU traffic is isolated to EU storage; right-to-erasure is exposed via API.
Timestamped results
Every lookup returns a timestamped result you can attach to the user record as proof of validation at the moment of opt-in.
MENA regulatory awareness
TDRA, CST, NTRA and other MENA regulators push operators and senders toward clean, verified number data. An HLR lookup is the auditable hop that backs it up.
ISO-aligned operation
Run on the same infrastructure as our A2P SMS platform — ISO 27001, ISO 9001, ISO 22301. Tamper-evident logs, 7-year retention available.
Questions buyers ask
HLR Lookup,
answered for engineers.
We run live SS7 MAP and Diameter queries against the destination operator's actual HLR — not a periodic MNP database snapshot from a vendor. That means a number ported yesterday returns its new operator today, not next week. Latency is higher (350ms vs 20ms cached) but the answer is authoritative.
MCC (country code), MNC (network code), original operator, current operator (after porting), country name, network type (GSM/CDMA), roaming country if applicable, IMSI prefix, reachability status (active/dormant/disconnected), and a confidence score. All in one JSON response under 1KB.
Per lookup, with significant cache discounts. Standard tier is $0.005 per live MAP query and $0.0008 per cache hit. At 5M+ lookups/month enterprise rates drop to $0.0028 live and $0.0004 cached. Batch endpoint (up to 10K numbers per call) doesn't bill differently — same per-lookup pricing applies.
Default cache TTL is 30 days for active numbers and 7 days for unreachable. Bypass on a per-request basis with cache: false in the body, or shorten the TTL per account in settings. Cache is per-account-isolated; you never see another tenant's cached data.
Every SMS, OTP, and WhatsApp submit can pre-check HLR inline (validate: true on the send request). Dead numbers return an immediate API error instead of being billed and silently dropped. Many customers also run nightly batch lookups against their CRM to scrub the list before campaign send.
Yes — every lookup returns both the original operator (from the MSISDN prefix) and the current operator (from the live HLR). Comparing the two is a one-line MNP check. We don't charge extra for the MNP information; it's part of the standard response.
API availability is covered by the 99.99% platform SLA, with p99 < 350ms for live queries and p50 < 50ms for cache hits. If monthly uptime falls short, enterprise contracts earn a service credit against the monthly fee (10% below 99.99%, 25% below 99.0%, 50% below 95.0%). Multi-region active-active — if a region degrades, traffic re-routes within 800ms.
Coverage is 200+ countries via direct SS7 interconnects and partner relays. A handful of markets (typically restrictive regulatory regimes) only return MCC/MNC from prefix data, not live HLR. Those return a degraded: true flag in the response so your logic can fall back appropriately. The full coverage matrix is published in the dashboard.
Question not here? Ask our engineering team
Pairs well with
Validate, then deliver.
Number portability & routing
The reference behind the lookup: MNP, routing numbers, All-Call-Query and HLR dips for least-cost routing.
Learn more
A2P SMS
Once the number is validated, send the message itself through 1,000+ direct operator interconnects.
Learn more
OTP
Multi-channel one-time passwords with HLR pre-validation built in to suppress fraud.
Learn more
SMS Firewall (for operators)
If you're a mobile operator, our firewall uses the same HLR intelligence to block grey routes at line rate.
Learn more
Carrier-grade delivery
Delivered to 200+ countries, direct to the operator in 86.
No grey routes: a direct operator bind wherever one is commercially available, otherwise a labelled partner-managed route. One API to every channel, on a network built since 2003.
200+
Countries
1,000+
Operator connections
300M+
Msgs·day
Test access · reply within one business dayValidate your first
Validate your first
1,000 numbers.
Request test access and we reply within one business day. Validate a sample batch, then scrub your lists in production once your account is approved.
$ curl api.broadnet.me/sms/lookup
Resources
HLR Lookup datasheet
Related guides & answers
Go deeper on the concepts behind this product.
Also from BroadNet
MobileValidatePrivate preview
Need a number's line type, or the messaging apps it can receive on, before you send? MobileValidate, a BroadNet brand in private preview, checks carrier and line type, apps such as Telegram, Viber and RCS, and e-mail mailboxes in one API request.