21 replies to this topic

[Captain B]

My fave way to scan an exchange is to hit the high and low ends of an exchange. In other words, the low end, or "bottom" is between Nxx-Nxx-xx00 to Nxx-Nxx-xx99. And, the high end, or "top" of an exchange is between Nxx-Nxx-9900 to Nxx-Nxx-9999. These ends of an exchange seem like they don't usually get assigned to standard land lines. It has more of a tendecy to be assigned to things like modem lines, fax backs, voice mail boxes, and special telco assigned stuff like DATUs (Direct Access Test Units), internal numbers for companies or the telco, and sometimes an entire range in an exchange will be for test purposes. For instance, on some exchanges in my area, 000x-002x will be assigned a different telco error message on each seperate number. Sometimes, there's also a way to listen to all the given error messages recorded for that given CO, but I won't go into that here. Now, there are cases where this "hit the high and low ends" method doesn't work. For instance, it never seems to work with wireless exchanges. (A wireless exchange is an entire exchange set up to handle a given provider's cell phone or pager service). And, even with standard telco land line exchanges, it doesn't always work. But, let me also say that between hitting the high and low ends, It's been my experience that hitting the low end has yielded more interesting results more often. Some things however, you know to usually expect to find only in the high end, such as DATUs, which are typically assigned 9935 or 9985 as the last 4 digits. However, this apparently doesn't always hold true, as I've found a DATU in my area down near the bottom of an exchange. BTW, DATUs usually are assigned 1111 as the default passcode, if you find one. You'll know if you found one by the tone it puts out after only 1 brief ring. And, while this high/low method has worked for me on local and long distance numbers, it hasn't worked yet on toll free numbers. But, give it a shot, if you like. Happy scanning.

[Captain B]

BTW... another thing to try is to hit Nxx-Nxx-1212 and Nxx-Nxx-1111. Every once in a while on some exchanges, you may find something there. Also, I've heard that 1118/1119 used to be used as local loop numbers. Perhaps even 1234 might be worth checking. And also, I've heard that decades ago, 0000 used to be used for "exchange operators". In other words, supposedly, you could reach an op handling calls for that particualr exchange through 0000. Now, that doesn't seem to be the case. But, considering how much more automated everything in telecom is nowadays, It's no wonder. As a final note, there actually is a place of business that was assigned 0000 for the last 4 digits of their number. It even happens to be a place served by my CO. So, yeah, sometimes numbers down near the bottom of an exchange get assigned for standard land line service.

[phreakblaze]

Hey captin B!!! i was woundering about a while back when you told me my daru number(thank you a bunch) how did you know it was 732 477-9935. Just woundering and thanks again for that help.

[Y0ungBra1n]

i thought that was briskattivo, but i could be wrong...

[phreakblaze]

Maybe it was, well thanks to both of them.

[decoder]

I just finished writing a text file on exchange scanning. It's kind of an updated version of that 'BIOC guide to phreaking' section on exchange scanning. If anyone knows where I should submit it, let me know, because It has some good info about test messages, DATU's, central office #'s, ANAC's and all the other "goodies". Whose site is oldskoolphreak? I liked that one and wouldn't mind having it there. Anyway, I would elaborate on more of my tricks on the topic, but It's all in the file...who wants it?

[dual]

That'd be me - dual [at] oldskoolphreak [dot] com. I'd love that file for oldskoolphreak.

[decoder]

alright man, cool. I'm typing it up now. When I originally wrote it, It mostly focused on exchange scanning here in NY, but I'll re-write it a little and throw on some scans I did of exchanges in Texas, Illinois, Pennsylvania and California. The extra scans might make it a little long, but they show the difference between the way it works, and what you can find in different places.

I also have a little thing that I wrote about DATU's. It has some info that I haven't seen mentioned before concerning the permanent signal release option. Maybe I'll type up taht one, too. Anyway, try to get on the PLA conf. tonight, dual....hope to hear you there...

[ic0n]

you could always send me a copy and i'll post it on your site.

ic0n at oldskoolphreak dot com <thanks dual for the addy again>

[phreakblaze]

sounds like it will be a good read.

[decoder]

I'm still in the process of updating it. I'm rescanning the numbers in the file to keep it up to 100% accurate, and rewriting it for a general audience. (I originally wrote it for myself when I was bored one day) But in the meantime, here's a few numbers from my archives:

1(213) 928-9999-LA 911 test recording (it says all 911 ops are busy in english, spanish and even tty tones! BTW, scan down from it..I think it's an LA police exchange.
1(845) 354-9912-Verizon lady on speed (call it, and you'll see what I mean)
1(570) 387-0020-Bell Atlantic is presently closed (someone tell me when they open, I miss them)
1(206) 222-0385-my *edited* voicemail (my other one is kind of hot, this one is legal and it has a cooler error message) drop me a line *edited 9-19-03*

[decoder]

yeah i love that one..it always gets a laugh on confs

[phreakblaze]

fun with recordings

[phreakblaze]

that just reminded me, i have a meridian pbx sitting in a storage shed in manhattan with like three phones. i wish i could set it up and let people practice on it. it would cost to much for me though and i don't want to pay for any calls that people would make from it. oh well i guess it will have to sit in storage for a few years.