u/Shoddy_Spot_2884

Hey everyone. I’m currently on a Red Team engagement where we need to test a client’s MFA implementation (specifically their rate-limiting and fraud detection on the SMS gateway).

I need to trigger about 50-100 verification attempts from "clean" unique numbers to see at what point their WAF or carrier-level filtering kicks in. Using my own team's SIMs is a huge OpSec fail and obviously doesn't scale. Most 'disposable' number sites I've tried are already in the client's WAF blacklist. How do you guys source high-quality mobile lines for testing MFA logic without being blocked instantly?