Yes, it is partly based on Imsi. The imsi contains the MCC & MNC of the network. The VLR derives the CC-NDC from this MCC-MNC pair and replaces it with the CC, NDC.
So only the first few digits of the imsi is replaced, and the message gets routed to the GMSC of the home network, with the SSN as the HLR.
I guess this is how it takes place.
Am i right celcom?
Thanks,
R….