There are a few different strategies for detecting IMSI catchers (though I'm not convinced that everybody working in this space has completely thought the threats through: some of the tools seem very focused on a single attribute they expect to see from the IMSI catcher). The mobile sites may conceivably still have proper encryption support, so if the feature you're looking for is "ciphering absent or downgraded", you shouldn't necessarily get false positives from them.

There's now a front page HN item submitted by alexduggleby which points to

https://www.sba-research.org/wp-content/uploads/publications...

which is a new academic paper on catching IMSI catchers. Their Table 1 (on page 5 of the paper) lists 12 possible ways of detecting IMSI catchers.

I suspect there are still others, but that list is pretty thorough! I would add "implausible service area overlap" (the basic case being seeing a tower of carrier A and a tower of carrier B simultaneously, when carrier A and B serve different countries that don't have territory within 50 km of one another). For example, there was a report that a Uganda Telecom tower was seen near the Ecuadorian embassy in London, where Julian Assange is staying. Even without a tower-by-tower location database, you could conclude that Ugandan and UK base station signals shouldn't be observed at the same location.