A method performed by a network device may include receiving a mobile directory number (MDN) that has been identified as a mobile spam originator and generating a query for attributes of a mobile device registered with the MDN. The method also includes receiving a query response that include attributes of the mobile device and determining to block the mobile device from access to a network associated with the network device. The method further includes providing, by the network device and to a blacklist system, one or more of the device attributes.