If you find someone posting Signal safety numbers publicly. Such as on Twitter you can do a search like from:Sc00bzT 05. This will find their public key if posted because the fingerprints look like:
05 06 86 3b c6 6d 02 b4 0d 27 b8 d4 9c a7 c0 9e 92 39 23 6f 9d 7d 25 d6 fc ca 5c e1 3c 70 64 d8 68
Then you can guess the phone number. This is slow and you'll want to use a GPU like the GTX 1080 which can check all US numbers in 3.5 hours.