Low-cost commercial SIMCom LTE Cat-4 modem (Qualcomm MDM-based). Reports serving- and neighbour-cell information through its own AT command set, AT+CPSI? returns the system mode, operator (MCC-MNC), LAC, Cell ID, band and EARFCN, a no-SDR way to read which cell a target is on and identify it. Because the baseband is Qualcomm and exposes a /dev/diag port, the same module can also feed QCSuper to capture raw cellular signalling.
Lifecycle not assessed: nobody has checked yet whether this tool is still maintained, sold or working. Check the project's own page before relying on it.