It's possible that the phone system might send special characters that could "break" a query string, so you should use a scriptlet like this to create a urlencoded string instead of passing them directly to your custom page. This scriptlet generates a query string containing the caller's Social Security number and phone number.
Create a CTI navigation rule to execute a search just like usual.
Make sure your search will never return a match. The search in this screenshot searches accounts for a phonenumber that starts with "nevermatch."
In the "no matches" condition for your CTI navigation rule, set the decision to "Create Session then Do Action" or just "Do Action" and execute the action you created in step #1.
Finally, is here sample code from my HTML web resource to parse the query string and extract inbound call values. In this case I am just displaying the values to the user with jQuery, but this can be modified to address your specific use case.