This is likely done with something called an HLR lookup via SS7. I believe it was explained to me that HLR lookups are meant for call setup and SMS routing, NOT

This is likely done with something called an HLR lookup via SS7. I believe it was explained to me that HLR lookups are meant for call setup and SMS routing, NOT for exposing network information via web services, but that doesn't stop companies with SS7 access from doing it anyway since there are plenty of people willing to pay for that information.