Table Of Content (TOC) Intro into issue 3..........................................................By ic0n Phreak Christmas Song................................................By Strom Carlson Test Prefixes/Exchanges..............................................By PhreakBlaze HCO TTY calls.............................................................By Captain_B How to get UNLIMITED airtime on Tracfone 5125.............By DSS4Free Private Branch Exchange........................................By Fu5|0N Scan of 1-888-819-00XX................................................By Mr. Poop Exchange Scanning Part Two.......................................By Decoder Intro: 12/31/03 Yo whatup fellow phreaks and geeks. It's that time for yet another issue of phr33k4z0iD'z. There's been quite a bit of things going on in the phreak world. 1st most if all of you know that Phreaks and Geeks losted our hosting over at HHC (hackerhost) Since then i've recived the hook up on hosting and got a domain phreaksandgeeks dot com I've also started working on a few things that have been ongoing for te past few months. Hopefully i'll have a nice amont of info for the next issue of the zine. Alot of people who reading this are members of the forums over at binrev dot com If your not i suggest that you check them out. I've also decided that people whom help with the zine will get a at phreaksandgeeks dot com e-mail address. Anyways Lets get onto the zine! A Little Phreak Christmas. By: Strom Carlson url: http://www.stromcarlson.com/ To melody of jingle bells Standing at the phone On an SF carrier trunk Through the switch we go Waiting for "cheep-clunk" It's a thirteen button box Made of parts from Radio Shack Oh what joy it is to hear A 4A crossbar stack! Oh, jingle box jingle box whistle off the trunk KP-099-212-660-ST clunk clunk! The number you have reached Is not in service at ths time. We're sorry, this is a recording, 212-39. Test Prefixes/Exchanges BY: PhreakBlaze Introduction: Co codes, or nxx codes, are speacial exchnages or other 7 (or 3) digit numbers for the maintnance of trunks. Most of them are not to be asigned by NANPA for usage. They are to be saved for a central office to use as a test/special codes/exchanges. These numbers differ from CO to CO. What number's are Codes (usually)???: Most co numbers/NXX codes are universal but with difrent uses. Some are dialed useing 10 digit dialing (NPA-NXX-XXXX), 7 digit dialing (NXX-XXXX), and even 3 digit dialing (NXX). I've also heard of dialing (NPA-0XX-958), but I'm not sure what to do there. The comon numbers are all N11 codes, 990, 959, 958, 950, 555, 976, 700, and then some only used in your area. What are the numbers for???: Well, all the number's purposes differ from co to co (exept for certian numbers, I'll discuss later). Wait, actually, the N11 codes, they usually don't change. They are usually supposed to be asigned as: •211 – Community Information and Referral Services •311 – Non-Emergency Police and Other Governmental Services •411 – Local Directory Assistance •511 – Travel Information Services •611 –Repair Service •711 – Telecommunications Relay Service (TRS) •811 – Business Office •911 – Emergency (Note- They are not suposed to be asigned by the NANPA, but instead the FCC.) But this is not always true, the only ones I've seen constant are 911 (duh!), 711, and 411. (Note- Recently in my area, when I dial 611, it says that the repair service in no longer available from that number, and must be reached from an 800 number.) The only ones that have a constant use are 700, and 976. The only way to dial 700 is (NPA-700-4141) and thats the only number in that whole range. (Note- 700 is the only one that can be asigned as a NPA by the NANPA.) Then 976 is used as pay services (they usually cost 1 dollar for a call to a service, but if you want to know the services in there, then just dial a wrong number, and a recording should tell you which numbers do what). The rest do stuff. Your ANAC, Ringback, and NXX test numbers (and you): One of the things that these codes are almost always used for is the ringback and ANAC for your co/area/region (in my case, state wide). In the Garden State (New Jersey, DUH!!!) The ring back and Anac are the same for the whole state. My RingBack and my Anac are 550-xxxx(ringback), and 958(ANAC). Now, incase you didn't notice, my ring back is not one of the common codes, it is for this area/region only. Now as most of us know, these codes are free when dialed from a payphone, as are 990, 555, 959, 950, and all N11, but not 700, and 976. Now the numbers that serve as a ringback and ANAC differ from place to place (Note-place is a general term, place could be state, town, or even CO). I've even seen ring backs be on N11 numbers, so check all your N11 numbers for ringbacks and ANACs. Another thing I've heard of is a SASS unit being on a CO/Nxx code. I believe it was in Captian B's area on the N11 code 311, it would play the number your calling from like a ANAC but, it would do it twice, any time durring which, you could enter a pass code. SASS units are not always on Co/Nxx codes, the sometimes have pots lines. (Note- If your area has a SASS unit, then don't try to look for ANAC or ring back once you find your SASS, a SASS is meant to replace those CO/Nxx codes.) I can't find my ANAC(or ring back), but I found my ringback(or ANAc),any advice/help???: So, you can't find one of the two codes that does the ring back, or ANAC? No worries, I have a theroy that may work for you. ***PhreakBlaze's Theroy For Finding Ring Back Or ANAc*** -go to Telcodata.us -click on the search your npa and ring back or anac code for the nxx. It will most likely come up in a thing called "ODDBALLCODES" with no co name, just some Xs for the co name. If it gives you a company name that owns it :EX- Verizon East: click on it, if not, search you npa and your exchange, then click on the company for your region/state like the example above shows. -Go down the list (it takes a bit to load) to where it starts listing you NPA and exchanges in it. Then start going down the list till you see and exchange served from the CO XXXXXXXXXX. The first exchange you'll probably see being served by that is 211. Now all that you see with the XXXXXXXXXX you slould write down (if its not one of the regular codes). -Now go to a payphone or normal phone and dial the codes (Note- sometimes, an ANAC will need a 7 digit number dialed, and other times not.) Don't worry aabout the rest of the unused exchanges, they are most lilely just exchanges that aren't in use, not codes. ***End/PhreakBlaze's Theroy For Finding Your Ring Back Or ANAC/End*** Well, what else about these codes???: Well, we now found (hopfully) our ANAC or Ring Back (or SASS), and maybe something else fun on those codes. Well some of tghe codes I've played with have not done anything except given me an error measage that I have only heard when the code was not in service. As you may have also noticed, I said they are free to be called from a payphone. The only codes I've seemed to get working terminate at some place I don't know about. Some I've gotten to go to "A Verizon VMS," and other have gone to "network contrlers." Other times I've gotten people who answer and all they say is "Verizon," and the wait for you to answer. Any tip/resons for scanning this stuff: Yes, I do have some tips. Well, I'm not so sure of how good you would be at op diverting to it. Also, I'm not sure if there is any possibility/way to get in trouble for scanning these, but it would take the same amount of time to scan from a payphone as it would from home. When you call one that works, it will ring for a long time (never counted the rings), and then after two rings really close together, it will actually start ringing the persons desk/answering machine/ or the VMS picks up. For tips on where tgo scan, I'm not sure this will help much, but around here (so far) I've only been able to find number that work between 990-9000 to 990-9999 (Note- 990-9000 is the Verizon VMS around here.) Thanks for reading... Shouts: Y0ung Br1an, Phreak Out, Decoder, Captian B, Dual, StankDawg, Icon, Dox, and everybody else at StankDawg's forums. Captain_b talking about HCO TTY calls BTW, this month ago I tried out the concept of HCO (Hearing Carry Over) calls via the TTY machines. It works! HCO calls, which are similar to VCO (Voice Carry Over) calls, let the person talk to you on the other end, and you can hear them. And, the only thing the relay op does in HCO calls is say what you've typed. With VCO TTY calls, it works oppositely. You, as the person with the TTY talk, and the response from the other person is typed back through the relay op. I like HCO TTY calls the best now for 2 important reasons: 1st- It speeds up conversations dratically. 2nd- If you're calling an "enemy", you can now hear them on your end of the line, but they won't hear your voice. And, also, HCO calls help make things less confusing for the relay op, since he/she will now only have to type half the time as compared to standard TTY calls. Pretty kewl, huh? All you have to do is tell the relay op at the start of a call that you want to place an HCO call, or tell her to turn on HCO mode, or something to that effect. I don't know if HCO or VCO TTY calls can be place through on- line TTY services, though. Peace... How to get UNLIMITED airtime on Tracfone 5125 by DSS4Free OK, I originally posted on this a few months ago, and due to the number of people that have asked me about this, I will post it now. THIS WILL ONLY WORK ON THE 5125 TRACFONES!!! It will DISABLE the timetank. OK, you will need 3 things to do this. 5125 Tracfone, 51/61xx series MBUS data cable, and finally you need Nokia-TDMA-service-full software. Once you do all of this, then you can activate the Tracfone on the web. DO NOT PUT IN ANY OF YOUR PERSONAL INFO!!! Only enter the ESN and a zipcode from your area somewhere. Now, write down all the codes that it spits out to you and also punch them into the phone. Once you have completed the activation process via the web, you need to get into the phone to find out all the activation info. Press *3001#12345# select Nam1, and WRITE DOWN ALL THE INFO IN THERE including the system ID, SOC, and phone number. Now comes the technical part. You need to hook your phone up to the datacable and open up nokia-tdma-service full. Click on "read phone" and it will detect your phone and give you the info like ESN and all that crap. NOW, change the drop down menu nuxt to where it says reset values. Make it say FULL FACTORY then click on the reset values button. Next, your phone should power back up. Next to where it says "reset custom" and has a drop down menu, change the number 9 to number 21. Now click on the reset custom box. Now, go down and click on "set all unlock" then click "write locks" YOUR PHONE SHOULD NOW BE JUST LIKE THEY COME FROM THE FACTORY. Now, you need to do *3001#12345# on the phone again and reenter the info into the phone that you wrote down earlier. system id, SOC, and phone number. OK, NOW I JUST GAVE YOU ALL THE SECRET THAT I HAVE BEEN USING SINCE THE BEGINING OF THIS YEAR. The Tracfone timer just temporarly disables, and if you punch in the *#33248# and start punching in codes,it will reenable the timer and you will have to do the above steps again. To get the software, go to http://www.nokiafree.org and do a search for Nokia-TDMA-service-full. I forgot to mention, I have done this several times, and after 2 to 3 months, they will catch it that you have been using ALOT of airtime and it won't work anymore. Simpaly go to Wal-Mart or Target or whatever and buy another phone and take back the old one. I did a phone for an ex-girlfriend and it was one of the new phones that comes with 1 year of service. I hooked it up in January and it is still working. I suggest trying to find one of the 5125's with that packaging. This trick will not work on the CDMA Nokia phones ie. 5180 You can buy a 5125 from somewhere else and it will roam onto a TDMA carrier near you (AT&T, US Cellular, or Cingular in some areas) But who cares if it roams, the timer has been deactivated, so it will not cost any extra GOOD LUCK! Private Branch Exchange By: Fu5|0N phreak_ny@hotmail.com http://members.odinsrage.com/phreakny Overview ++++++++ What is a PBX. Well PBX stands for private branch exchange. The purpose of a PBX is to provide connections between staff at organizational sites, connections to the outside world, and a means for on-site personnel to call each other without paying telephone company usage fees. If thats still too complicated for you then think of it as a telephone with an intercom. Now some people get confused between PBXs and the Centrex system. A PBX is based in the office or residence where a Centrex is based at the telephone company's building. The advantage of PBX is that the user actually own the equipment where as with Centrex the TelCo owns the equipment and the user just rents it out. PBX Terminology +++++++++++++++ PBX - Private Branch Exchange Trunk (Path) - an outside line used to make or recieve regular calls rj21x jack - The jack most commonly used to setup a pbx (the standard one line uses a rj11c jack) Base Station - the phone base with the antenna used to add the service of a wireless phone in a PBX DID - Direct Inward Dial VM - Voice Mail ACD - Automatic Call Distributor DNIS - Dialed Number Identification Service VRU - Voice Response Unit CTI - Computer Telephony Integration ANI - Automatic Number Identification API - Application Programming Interface IVR - Integrated Voice Response Connecting Phone Lines to a PBX +++++++++++++++++++++++++++++++ Outside lines are brought into a building thru an interface. The interface used in a PBX is a rj21x jack. A rj21x jack holds up to 25 lines. This is where the TelCo's job ends. The outside lines all interface to the PBX equipment from there the PBX equipment is what decides what calls are routed where and what extension to route them to etc. Now there can be a whole bunch of features on a PBX it just depends on what its usage is and the electronics/programming it has on it. A PBX is a ground start system. What this means is that a trunk is seized by the PBX before a call is sent between the two locations. On PBX systems users often have to dial a code (usually '9') to make an outside call. A PBX responds to a lifted handset by sending a dial tone to the end-user and then requesting that a trunk to the central office be seized to make a telphone call. Wireless PBX ++++++++++++ The growing trend in telecom seems to be wireless communication and PBXs are no exception. PBXs use specialized wireless phones that operate at higher frequencies than home phones. They also have special features that are associated with PBX systems (ie. hold buttons, speed dial, LCD screens with caller id, message waiting lights to show new voice mail). The wireless phones require base stations as too make sure that the user does not go out of range. Many PBXs in larger buildings have multiple base stations which are networked together and pass the signals to each other when the user gets out of range of one of them. Some of these stations require that the user puts a call on hold to make the station switch because it doesn't do it automatically. Users don't necessarily shell out the $1400 for a PBX wireless phone they can also use a standard 900mHz cordless phone that many people use in there homes today. Then again you have to take into account that there is an upper limit to about 20 of these phones in the same building. DID and PBX +++++++++++ Direct Inward Dialing is a key feature of PBXs that is often overlooked today. Before DID PBXs depended on operators, and we all know how much of a pain in the ass that can be ;). DID allows a person dialing in to interface with the PBX electronically and punch in an extension code and go directly to that extension or voice mailbox, thus eliminating the need for a human operator. PBX Add-ons +++++++++++ A) Call Accounting ++++++++++++++++++ Call accounting allows the administrator of the PBX to track telephone calls made by each individual user or department etc. This helps to determine if there is too few trunks or if there is fraudulent activities going on. Translated this is so they can try to track down us phreakers making calls thru their PBX. B)Voice Mail ++++++++++++ This is one of the very nice features PBXs offer. Each individual extension can have a voice mail box set up for them. These can be used as a means of transferring messages when a party isnt answering. Most modernized PBXs use PC based VM services which make it very affordable. 1:Components of Voice Mail ++++++++++++++++++++++++++ Central Processing Unit (CPU) - The CPU is responsible for the performance of the unit. It executes the applications needed for the VM system. Codecs - These devices convert analog signals to digital and vice-versa. Software - Provides the key to how good of a VM system you have. C)Automated Attendants ++++++++++++++++++++++ Basically all that an Automated Attendant is a program that answers the phone and gives the incomming caller a list of options or a menu associated with a certain key on a dialpad. When that certain button is pressed the PBX translates the frequency the tone sends and routes it to the chosen option. D)ACDs ++++++ Automatic Call Distributors perform a variety of funtions within a PBX. They can route incoming calls to a user who has been idle longest, route a call based on the customers ANI information, hold a call in queue,and provide statistics on users and callers alike. The easiest and most common way to recognize an ACD is the classic "All of our representatives are busy...please hold" message. Most commonly ACDs are used for companies or users that have more calls than people to answer them. ACDs can be linked with Automated Attendant programs in order to make the PBX even more efficent. E)VRUs ++++++ Voice Response Units enable a user to make a transaction without dealing with a live person. The way this is done is by decoding DTMF tones into selections. The usage for this is giving credit card info account #s etc. This kiddies is how you can get credit card numbers if you're into that type of thing. The most common usage of VRUs is for short, simple transactions. F)CTI +++++ Computer Telephony Integration is what commonly delivers information on a caller to the ACD. This inforamation can be voluntarily given thru a VRU or involuntarily thru ANI. This my friends is how those companies know your name and account information before you even say your name. ACDs and the Internet +++++++++++++++++++++ Now with the advent of e-commerce ACDs can be used to read e-mail headers and keywords in order to pass the information along to a representatives computer. This is how they do follow up calls on orders or e-mail complaints/troubleshooting. That's all for now keep comming back for more info on Centrex and key systems. Shout outs to blackout_, Kernel|X|, superh, jayeneen and anyone else i forgot from #phreak. Scan of 1-888-819-00XX By: Mr. Poop 00: Cannot be completed as dialed 01: Fast Busy 02: Text to speech, says "Bye" 03: cannot be reached from your calling area 04: Cannot be completed as dialed 05: Switchboard Operator 06: Cannot be completed as dialed 07: Some recording 08: Voicemail 09: Switchboard Operator 10: Switchboard Operator 11: Fax Machine 12: Voicemali 13: Text to speech, says "Bye" 14: Text to speech, says "Bye" 15: Fax Machine 16: Text to speech, says "Bye" 17: some payment system 18: Fast Busy 19: Switchboard operator 20: Fast Busy 21: Cannot be completed as dialed 22: "Disconnected or is no longer in service" 23: Fast busy 24: "Please enter your pin number." 25: Not in service 26: Cannot be reached from your calling area 27: Voicemail 28: Disconnected 29: Voicemail 30: Fast busy 31: Cannot be reached from your calling area 32: cannot be reached from your calling area 33: your call did not go through 34: cannot be completed 35: Text to speech, says "Bye" 36: Disconnected 37: Just rings 38: Voicemail 39: Voicemail (Audix) 40: Switchboard operator 41: Voicemail 42: Voicemail (audix) 43: Cannot be reached from your calling area 44: Busy 45: Not in service 46: ETS Payphones 47: Not in service 48: Not in service 49: Cannot be completed as dialed 50: Hello? 51: cannot be completed as dialed 52: cannot be completed as dialed 53: cannot be completed as dialed 54: voicemail 55: cannot be completed as dialed 56: fast busy 57: cannot be completed as dialed 58: cannot be completed as dialed 59: cannot be completed as dialed 60: switchboard operator 61: cannot be completed as dialed 62: cannot be completed as dialed 63: cannot be completed as dialed 64: cannot be completed as dialed 65: cannot be completed as dialed 66: Hello? 67: cannot be completed as dialed 68: cannot be completed as dialed 69: some recording 70: dead air 71: cannot be completed as dialed 72: disconnected 73: voicemail 74: cannot be completed as dialed 75: fast busy 76: voicemail 77: cannot be completed as dialed 78: cannot be completed as dialed 79: cannot be completed as dialed 80: cannot be completed as dialed 81: cannot be completed as dialed 82: cannot be completed as dialed 83: cannot be completed as dialed 84: cannot be completed as dialed 85: cannot be completed as dialed 86 :cannot be completed as dialed 87: cannot be completed as dialed 88: Disconnected 89: cannot be completed as dialed 90: operator 91: operator 92: fast busy 93: voicemail 94: cannot be completed as dialed 95: fast busy 96: fast busy 97: fast busy 98: fast busy 99: cannot be completed as dialed Shot outs to Captain B and ic0n. Exchange Scanning Part Two by decoder at phreaksandgeeks dot com Intro: ------ In the months that have passed since my first article on exchange scanning, I have been approached by many people asking for more tips and tricks that I use while scanning. I finally have come up with enough good material to warrant a follow-up to the original article. Think of this as a supplemental release, as well as a chance for me to correct some errors I made. There are also a few things that I forgot to mention originally, as well as some important updates. Maybe one day I will compile both articles, along with some other info and numbers, and create one big definitive guide, but I'm still a lazy fuck, so don't hold your breath... anyway, enj0y! Tips & Tricks: -------------- One thing that has caused concern among people is the random callback. When you dial hundreds of phone numbers, without blocking your caller id, you are bound to have concerned citizens call you back. I read a paper once on paranoia and caller id concerning this very topic, and let me tell you, it was extremely disconcerting. There is a certain segment of the population that believes when they receive a mysterious phone call, it is part of some conspiratorial plot against them. These humans are known as "morons." My father is one of these people. I remember many years ago, he received a page. The number that was displayed on the pager was that of a payphone somewhere. He immediatley blamed me for this mysterious page he recieved in the wee hours of the morning, and he accused me of being out somewhere after curfew. When I reminded him that he was, indeed, an idiot, and I was asleep in bed at the time, he actually uttered these words to me; "How did they get my pager number?" I was completely dumbfounded as to how to react to this statement. What the fuck do you mean, how did they get YOUR phone number? They didn't know it was YOU...it's called dialing a WRONG number. This moronic, self-important way of thinking is what you must keep in mind when dialing blocks of numbers. Thses people live among us, my friends, and trust me, it is not pretty. There are two easy solutions to this problem. The first, and most obvious one, is to block your caller id when scanning. You can use Per-Call Blocking, by dialing *67 before each call, or if you wish to save some dialing time, simply subscribe to All-Call Blocking. I can't understand why everyone doesn't already have this service. After all, it's free (at least it is in Verizon Country), and it makes sense to have it, Just in case you forget to press *67. Another less practical option is to build yourself a box that will dial *67 for you each time your phone goes off-hook. The problem with this is that it will also dial *67 each time you pick up an incoming call, which might annoy your callers. Also, why build a box when you can subscribe to a free service that will do the same thing? But, for those interested in building such a device, think of the Telezapper. When you have a Telezapper on your line, whenever the phone goes off hook, it plays Special Information Tones, or SIT. Building a box on this premise, but for dialing *67 instead of playing SIT tones shouldn't be that hard, albiet relatively useless. Now, there are a few things that I feel the need to mention about exchange scanning. The first is that it is always a good idea to let a number ring at least ten times. I realize that it is quite tedious, especially when you find a block that is filled with ringouts, but it is very important. I have found that in Verizon land, many employee voicemail numbers don't pick up until the about seven rings. I have also, on rare occasion found very odd things after ten or even twelve rings! The point is, if it's ringing, be patient...there may be a cool prize waiting if you give it time. I also must stress that reorders and busy signals, as well as ringouts, are pretty useful to have, so always keep a detailed record of your scan. When I type up my scans, the only numbers I leave out are the ones that play the default error message, which is the one that you would hear on any vacant number. Everything else you find, make a note of it. Next time someone asks for your phone number and you don't want to give it to them, give them a number in your area, or any area, that is always busy, or one that rings forever. It's a better idea than just giving them a random number that you make up on the spot. Always have that fake number ready! Another way to have some creative fun when scanning exchanges is to use a prepaid phone card. If you don't have long distance on your line this can be especially useful. When scanning the 00xx or 99xx blocks of an exchange, most of the numbers in there are cool error messages, which are free to call. They do not supervise, therefore you dont pay. It's amazing how many people forget that you don't get charged to call an error message, whether it is a local or a long distance call. When you use a phone card to scan these ranges, no credit will be taken off of the card, unless you hit a number that supervises, so you can scan all day and night and not have to worry about charges ony our bill or your ANI being passed. There are a million and one different phone cards, so you must choose one specifically for this purpose. The most important thing being a card with NO connection fees! When you scan these ranges, you are going to run into some milliwatts, carriers and employee numbers...all of which supervise. You don't want a buck taken off your card because you got deafened by a milliwatt. It's also very convenient if you can find a card that will let you make unlimited non-connecting calls in one session. Most cards only allow three to six failed calling attempts before forcing you to disconnect and redial the access number and PIN. Scanning with a phone cards is also a good idea for those worried about the legalities of scanning. If you're worried about the telco seeing that you like to dial hundreds of sequential numbers, by diverting through the phone card, you are giving yourself a bit of extra, added protection. Toll-Free Telco Exchanges: -------------------------- On the topic of things that I neglected to mention in the original article, one subject immediatly comes to mind... Verizons 890 exchange here in New York. This is a toll-free exchange (not NPA), in which there are various offices such as repair, and a few other interesting things. You can dial this exchange from outside of the area by preceding it with any New York area code. While, according to the Verizon Directory, this is a toll-free exchange, if you are calling from outside of New York, you may get charged for the call at your normal long distance rates, but I'm not quite sure. It may still be free, who the hell knows? Here are some 890 numbers for your phreaking enjoyment! 890-1590 Residential Service (English) 890-2005 Residential Service (Spanish) 890-1776 Residential service (Korean) 890-1755 Residential Service (Russian) 890-6611 Repair 890-0200 Business Service (orders & product info.) 890-1400 Business Service (billing questions) 890-7711 Business Repair 890-0550 Center for Customers with Disabilities (V/TTY) 890-1900 Verizon Call Block Test Line (to test caller id blocking) 890-8248 Bell Atlantic Call Block Test Line BellSouth also has a similar exchange, 780. It can be reached from any state in BellSouth territory, but not from anywhere else. I also believe that you must have BellSouth service in order to reach it, unlike Verizon's 890, which be reached from any phone, anywhere. This lack of accessability has left me with little knowledge pertaining to the 780 exchange. I encourage everyone in BellSouth territory to scan out this exchange and see what lies hidden. There may be some very interesting numbers, although us Northerners wont be able to call them. And, of course, everyone should play around in the New York's 890 exchange, just remember, it's Verizon... they are probably logging your ANI. While on the topic of telco exchanges... in the original article I briefly touched on the 959 exchange. I had stated that it was owned by AT&T, but this is not the case. What led me to belive that it was operated or owned by AT&T, is that weird things happen when you dial numbers in the 959 exchange through AT&T's network. Usually you hear milliwatts and other tones in the 959-1xx0 range. You can reach these numbers by using an AT&T PICC, such as 10-10-288. Most of the numbers in the 1xx0 range are constant across NPA's, for example, 1000 and 1500 are usually milliwatts, no matter what NPA you choose. One new trick I have been informed of is that the 69xx range, specifically up to 6920, is very interesting, indeed. There are all sorts of cool AT&T 4ESS error messages in this range, and they are different depending on what NPA you choose to scan. At the end of the error massage, you will hear the office code. My area is 104t (White Plains, NY). I also had stated that these 959 numbers did not exist in New York. It turns out that they do, although for some reason, you cannot reach the 4ESS error recordings in your own area, so I can't dial them in my own area code, but I can reach the recordings in 212. Just remember, in order to reach these numbers you must use AT&T's network, and, as I have stated earlier, these are error recordings... you cannot be charged for calling them, so don't be hesitant to use AT&T's PICC to dial them, it's free. Info on Your Exchange: ---------------------- When I wrote the first article, the most popular website where you could obtain information about your exchange was telcodata.us. I had included that site as an indispensable source, but unfortunatly, telcodata is no more. It was a sad day, indeed, when the news of telcodata's demise first hit, but there is no need to worry about it anymore. There is a brand to site where one can obtain info about their exchange and switch. It was created by ntheory and the URL is ( http://entanglement.net/~ntheory/phreaking/NPA.php ). Not only does this site have all the information from NANPA and DSLreports, but it will soon to become a database for everyones exchange scans! What is being planned is a database of exchange scans, submitted by anyone who wants to help out. So everyone who reads this article and does some scanning, submit your work to ntheory, (ntheory@binrev.com) and your scans can be added to the NPA.php site. Anytime someone looks up the exchange that you scanned, they will know what lies hidden in there. I, for one, think this is the most elite idea ever! This site should bring exchang scanning to an entirely new level... a central database which acts as a telephone directory... not for customers phone numbers, but for all the numbers that are important to phreakers. Some Numbers: ------------- This article would't be complete without a few numbers. Once again, I have some numbers from scans I have done around the country, and if you look around in these exchanges, you are sure to find a bunch of cool stuff. 609-729-9928 [sit] we're sorry, the long distance company you have selected is unable to complete your call at this time. please try your call again later, thank you. 856-767-9975 the person you are calling is busy, please try your call again later. 206-343-0011 [sit] this call requires a coin deposit. please hang up momentarilly, then redial your call by first depositing the local rate posted on the instruction card, or dial zero for the operator. 516-378-9932 milliwatt (1004 hz. tone) 845-735-9988 if you need to report a police, fire or medical emergency, hang up, regain dial tone and dial 911. all other calls from this line are restricted. if you wish to discuss your telephone bill, please call your local telephone provider. If you wish to establish telephone service, call the provider of your choice. 541-967-0010 the business telephone number you have dialed is experiencing a temporary service problem. it has been reported to us west communications who is checking into the cause of the touble. we are sorry for the inconvenience, please try your call again later. 631-473-9902 DATU (default system passcode) 914-664-9958 [sit] we're sorry, when you dial zero for calls within your area code, you now must dial zero plus your area code, then the telephone number. please hang up and try your call again. sh0uts: dual for always putting my texts up on OSP, Strom Carlson for hooking me up with all the 959 and 4ESS info, and ntheory for giving us all npa.php.