Techniques, devices, and systems for receiving, from a mobile device, a request associated with a subscriber information module (SIM) are described herein. At least one of the mobile device, the SIM, or a communication identifier can be determined. A query can be transmitted, based on a difference between a first time associated with the query and a second time associated with a previous query meeting or exceeding a threshold amount of time. An action can be performed based on the query information being associated with the malicious activity information.