Rayhunter is a great tool, but unfortunately, it is only a passive monitor for cellular state changes and not an active defense.

Modern Stingrays / IMSI catchers support all standards up to 5G. They easily exploit 4G networks and 5G Non-Standalone (NSA) deployments. The only effective active defenses include (a) using a device locked strictly to 5G Standalone (SA) mode with SUCI (Subscription Concealed Identifier) enabled, preventing fallback to 4G/3G/2G where identity spoofing is trivial, (b) keeping the device in airplane mode most of the time, only going online briefly from unpredictable, shifting locations, and (c) using custom cellular baseband firmware that can reject anomalies (like a tower suddenly appearing too close or lacking neighbor cell lists), though this requires custom building your own solution as ready-made consumer solutions are hard to find. The last one can be achieved with Rayhunter, of course, but it would require some patching to Rayhunter and always carrying a mobile phone connected to the Rayhunter-supported Wi-Fi hotspot device.

Finally, intelligence mercenaries (and therefore LE agencies that contract them) use warrantless network-side exploits like SS7/Diameter attacks to remotely query the core telecom routing system and harvest the location of the tower target's phone is currently using¹ ². This doesn't even require sending legal DD requests to telcos to get target's cell tower.

[1] https://www.researchgate.net/publication/370809133_Attacks_t...

[2] https://www.lighthousereports.com/methodology/surveillance-s...