Leaderboard


Popular Content

Showing content with the highest reputation since 09/20/2017 in all areas

  1. 6 points
    Here's the complete collection of recordings I grabbed of the Odessa 1AESS switch before the cutover. The recordings were made during late may, with the last batch (A-D recordings) made on June 2, 2017 -- days before the cutover. The most interesting recordings I found during the calls to the switch: 1AESS-A.wav - Highest quality recording/best example I have of what a normal call to the 1AESS intercept sounded like. Allows you to hear the background SIT-tone noise before recordings. 1AESS-D.wav - Highest quality recording/best example I have of what a normal call to the 1AESS supervision test sounded like. 1AESS-3.wav - Bizarre because the switch cut to busy after intercept, instead of cutting over to reorder like normal. 1AESS-11.wav - Bizarre because the call, without ring, goes to the 1AESS intercept recording for one cycle, then stops for 20 seconds, and returns the Hillsboro 4ESS '121-T!' recording. 1AESS-14.wav - Bizarre because the call, rings once, goes silent for 30 seconds, then returns the Hillsboro 4ESS '121-T!' recording. 1AESS-15.wav - Bizarre because the call, rings once, goes silent for 40 seconds, then returns a reorder. More descriptions on the other calls are available on the 1A_desc.txt file on the dropbox drive. https://www.dropbox.com/sh/xca3wwskn1mzwzt/AABJMpTS0XDL9NQQgiz4LVI4a?dl=0 Enjoy.
  2. 3 points
    If you dial extension 8411-8414 it will make the automated voice say "Lane ""1-4"" Most pharmacies dont have more than two lanes. So if youre there waiting for a script, dial ext 8413 to hear the voice on the loudspeaker say "lane 3" and watch the employees confusion. its hilarious.
  3. 3 points
    Long time lurker.... registered recently..... first post... I know this thread is a bit old, figured I could be of some assistance here: Auto-scanned the 630713XXXX exchange (Took about ~15 hours), then did some manual checking: Number Auto-Scan Result Manual Scan, Comments 6307130025 VOICE Voicemail 6307130027 VOICE Subscriber 6307130107 VOICE Voicemail 6307130138 VOICE Voicemail (Nokia) 6307130460 VOICE UMTS Operations Support Group (Nokia -- "Please try again in 15 minutes") 6307130484 VOICE "We're sorry, but the blackout period for the transtition of the 401k record keeper is in effect on January 6th, please call back on January 7th." Repeats, then hangs up. 6307130563 VOICE Subscriber 6307130760 VOICE "Thank you for calling the Nokia workplace resources call center." 6307130869 VOICE Voicemail 6307130990 VOICE Voicemail Access Number, with working directory. 6307130996 VOICE Voicemail Access Number, with working directory. 6307131006 VOICE Subscriber 6307131229 VOICE Subscriber 6307131265 VOICE "Sorry, this automated attendant number is not available at the moment, goodbye." 6307131292 VOICE Subscriber 6307131304 VOICE "The called extension is busy" >> Voicemail 6307131329 VOICE Subscriber 6307131335 VOICE Ring >> Reorder 6307131553 VOICE Voicemail 6307131984 FAX Fax tones 6307132349 FAX Fax tones 6307133200 VOICE Voicemail Access Number, with working directory. 6307133678 FAX Possibly a modem. 6307134150 VOICE Subscriber 6307134389 VOICE Subscriber 6307134433 VOICE Voicemail 6307134484 VOICE Subscriber 6307134633 VOICE Voicemail 6307134967 VOICE Voicemail 6307135012 VOICE Voicemail 6307135163 VOICE Voicemail (reads back extension number) 6307135305 FAX Possibly a modem. 6307135353 VOICE Voicemail 6307135400 VOICE Voicemail 6307136056 FAX Fax tones 6307136081 FAX Fax tones 6307136082 FAX Fax tones 6307136091 VOICE Possibly an elevator?? Buzzing/Static on line. Hangs up with #. 6307136153 VOICE Another elevator phone? Hangs up with # again. 6307137073 VOICE Subscriber 6307137163 VOICE Voicemail 6307137180 VOICE Voicemail 6307137339 VOICE Subscriber 6307138416 VOICE Subscriber 6307138507 VOICE Voicemail 6307138668 VOICE Voicemail 6307138761 VOICE Voicemail 6307139039 VOICE Voicemail 6307139328 VOICE Voicemail 6307139379 VOICE Subscriber 6307139650 VOICE Voicemail 6307139764 VOICE Voicemail 6307139885 VOICE Subscriber 6307139988 VOICE Voicemail If there's any interest I can run a scan on 630979XXXX.
  4. 2 points
    at various points in my life i've written little handscanner assistant utilities.. yes, i know there are some already out there - whatever.. i like to code. i've been working on a new project called cons0le (and cons0le-web). i restarted this project because i recently obtained a dialogic diva card and wanted to play with some of the features of the card. at this point i am reaching out to see what realistic features any of you might want to see added to such an app... It is a windows based app written in vb.net and also a javascript counterpart web based app. current working or to be worked on items are: - random/sequential dialing of multiple npa/pre/suff - extreme scheduling/timing of scan jobs - dtmf detection - dtmf send either via dial string or live during call via mouse clicks - outgoing .wav either on outgoing calls or incoming calls - tone detection in general - definable call documentation as well as presets (vmb, ringout, etc..) - sync with a master web app which will provide a "phone book" type interface - master web app will also be able to generate npa/pre/suff and log calls via presets/user definable buttons - f2f syncing of results files. (encryption type is still up in the air on this..) All of the above is already set in stone.. I would love to hear any suggestions for other features though.. doc
  5. 2 points
    There's few things in this world that remain shrouded in secrecy for twenty years, but 711 numbers and their foundation have done an excellent job of exactly that. That all changed though, with a post in the some numbers thread. More specifically, with two numbers: (800) 860 0169 and (800) 860 0867. Don't bother checking, they're both the same. When you call either, crunchy, 20 year old ADPCM crackles to life with "This is the West Interactive audio system. Enter your access code now." The access codes as it turns out, are pretty easy to guess. The passwords, equally so. I'll share a list at the end of this. But assuming you're not lazy or intimidated by phones and actually called, give it 7278 and password 7278. Then, push 3 to test the program. Sound familiar? So what, you may ask, is this thing exactly? The program itself is just a placeholder for unassigned numbers. Nothing special. The rest of the system is something else, though. Explore what I've found, and help continue the hunt if you like it. 0 - Reads back 811-000-0000 + invalid entry recording 1 - Doesn't allow call counter, allows blocked caller list, invalid, but works with password 0, 2 (plays announcement asking you to call 800-366-5588 with password 0) 2 - Invalid 3 - Invalid 4 - Doesn't allow call counter, invalid 5 - Reads back unit ID, line number, ACD test application 6 - Doesn't allow call counter, invalid 7 - Invalid 8 - Invalid? 9 - Reads back unit ID, line number, call time (local), plays fake busy signal 10 - <unassigned or new passcode> 11 - Invalid 12 - Doesn't allow call counter, invalid 13 - Hangs up 14 - Invalid 15 - <unassigned or new passcode> 16 - <unassigned or new passcode> 17 - Invalid 18 - <unassigned or new passcode> 19 - Doesn't allow prompt recording, ShopNBC IVR 20 - Invalid 21 - Invalid 22 - <unassigned or new passcode> 23 - <unassigned or new passcode> 24 - <unassigned or new passcode> 25 - <unassigned or new passcode> 26 - <unassigned or new passcode> 30 - Invalid (old psychic line) 96 - <unassigned or new passcode> 97 - <unassigned or new passcode> 98 - <unassigned or new passcode> 99 - Recorded beeps (x3) 00 - Reads back ? 01 - <unassigned or new passcode> 02 - <unassigned or new passcode> 000 - <unassigned or new passcode> 099 - <unassigned or new passcode> 100 - Doesn't allow prompt recording, invalid 101 - ShopNBC IVR 102 - Invalid 103 - <unassigned or new passcode> 104 - Prompts for APN number 105 - <unassigned or new passcode> 106 - <unassigned or new passcode> 107 - <unassigned or new passcode> 108 - <unassigned or new passcode> 109 - <unassigned or new passcode> 110 - <unassigned or new passcode> 111 - Doesn't allow call counter, invalid 112 - <unassigned or new passcode> 113 - <unassigned or new passcode> 114 - Allows blocked caller updating, Invalid 115 - <unassigned or new passcode> 116 - <unassigned or new passcode> 117 - <unassigned or new passcode> 122 - <unassigned or new passcode> 123 - Invalid 124 - No menu, hangs up promptly 125 - <unassigned or new passcode> 150 - <unassigned or new passcode> 166 - <unassigned or new passcode> 170 - <unassigned or new passcode> 180 - <unassigned or new passcode> 190 - <unassigned or new passcode> 200 - <unassigned or new passcode> 202 - <unassigned or new passcode> 211 - <unassigned or new passcode> 222 - Invalid 300 - <unassigned or new passcode> 303 - <unassigned or new passcode> 311 - <unassigned or new passcode> 322 - <unassigned or new passcode> 333 - No menu, Call accounts facility temporarily unavailable recording 400 - <unassigned or new passcode> 444 - Invalid 499 - <unassigned or new passcode> 500 - No options, immediately reads back 800-404-4890 and transfers 501 - <unassigned or new passcode> 502 - <unassigned or new passcode> 555 - Allows blocked caller update, invalid 599 - <unassigned or new passcode> 600 - <unassigned or new passcode> 611 - <unassigned or new passcode> 666 - Invalid 699 - <unassigned or new passcode> 700 - <unassigned or new passcode> 711 - <unassigned or new passcode> 777 - <unassigned or new passcode> 799 - <unassigned or new passcode> 800 - <unassigned or new passcode> 809 - <unassigned or new passcode> 810 - <unassigned or new passcode> 811 - Allows blocked caller update, <recorded beep tone> 812 - <unassigned or new passcode> 813 - <unassigned or new passcode> 888 - Allows blocked caller update, invalid 899 - <unassigned or new passcode> 900 - Invalid 901 - <unassigned or new passcode> 902 - <unassigned or new passcode> 958 - <unassigned or new passcode> 998 - <unassigned or new passcode> 999 - Same as main IVR on toll-free 000 - <unassigned or new passcode> 080 - <unassigned or new passcode> 0000 - Doesn't allow prompt recording, invalid 0001 - Invalid 0002 - Invalid 0003 - Reads back unit/line #, invalid call time + hangup 0005 - Invalid 0006 - Reads back 3547-179, phone number, caller #, "sorry, you did not ring" 0007 - Gives unit ID, line number, call time, xfers to operator 0008 - <invalid application> 0009 - Taco poll 0010 - <unassigned or new passcode> 0011 - Gives unit ID, line number, call time (local + epoch?), hangs up 0012 - Invalid 0013 - Voice capture thingie 0014 - <unassigned or new passcode> 0015 - <unassigned or new passcode> 0016 - <unassigned or new passcode> 0017 - <unassigned or new passcode> 0018 - <unassigned or new passcode> 0019 - <unassigned or new passcode> 0020 - <unassigned or new passcode> 0022 - <unassigned or new passcode> 0030 - <unassigned or new passcode> 0033 - <unassigned or new passcode> 0044 - <unassigned or new passcode> 0053 - <unassigned or new passcode> 0054 - <unassigned or new passcode> 0055 - Gives unit ID, line number, call time (local), billing test? Astro line, talks about charging $3.99/min 0056 - Invalid 0057 - <unassigned or new passcode> 0065 - <unassigned or new passcode> 0066 - Invalid 0067 - <unassigned or new passcode> 0077 - <unassigned or new passcode> 0087 - <unassigned or new passcode> 0088 - Invalid 0089 - <unassigned or new passcode> 0097 - <unassigned or new passcode> 0098 - <unassigned or new passcode> 0099 - Invalid 0100 - <unassigned or new passcode> 0101 - Invalid 0102 - <unassigned or new passcode> 0103 - <unassigned or new passcode> 0123 - <unassigned or new passcode> 0111 - <unassigned or new passcode> 0200 - <unassigned or new passcode> 0211 - <unassigned or new passcode> 0222 - Reads back unit ID, line number, 12345, hangs up 0298 - <unassigned or new passcode> 0299 - <unassigned or new passcode> 0300 - Invalid 0301 - Runs program w/o options, reads unit/line # and disconnects 0302 - Runs program w/o options, invalid, loops 0303 - No menu, cardholder services survey line, does voice capture for some reason near end of call 0304 - No menu, reads back unit ID, line number, "To start the program, press one. To change the date and time, press two. To change the ANI, press three. To change the APN, press four. To change the CSG box, press five. To change the ICOMS box, press six. To change the informix box, press seven. To change the CLASS database, press eight." 0305 - Doesn't allow call counts option, hangs up quickly 0306 - Hangs up quickly 0307 - <unassigned or new passcode> 0308 - <unassigned or new passcode> 0309 - Doesn't allow prompt recording, hangs up quickly 0310 - "Welcome to the <something> line", hangs up 0311 - "Hello world", hangs up 0312 - Invalid 0313 - Invalid 0314 - Invalid 0315 - Invalid 0316 - Invalid 0317 - <unassigned or new passcode> 0318 - <unassigned or new passcode> 0319 - <unassigned or new passcode> 0320 - <unassigned or new passcode> 0321 - <unassigned or new passcode> 0325 - <unassigned or new passcode> 0326 - <unassigned or new passcode> 0327 - Invalid 0328 - Invalid 0329 - Invalid 0330 - Invalid 0331 - <unassigned or new passcode> 0332 - <unassigned or new passcode> 0333 - Reads ten zeroes and disconnects 0334 - <unassigned or new passcode> 0340 - <unassigned or new passcode> 0400 - <unassigned or new passcode> 0403 - <unassigned or new passcode> 0404 - Call counts menu not available, invalid 0405 - Doesn't allow prompt recording, invalid 0406 - <unassigned or new passcode> 0407 - <unassigned or new passcode> 0408 - <unassigned or new passcode> 0409 - Invalid 0410 - Invalid 0411 - Invalid 0412 - Reads back unit number, line number, prompts for test DNIS, credit card number (client is Commdata) 0413 - Invalid 0414 - <unassigned or new passcode> 0415 - <unassigned or new passcode> 0444 - <unassigned or new passcode> 0500 - <unassigned or new passcode> 0501 - <unassigned or new passcode> 0502 - <unassigned or new passcode> 0503 - No call counts menu, invalid 0504 - No menu, hangs? 0505 - Hangs? 0506 - No menu, invalid, loops 0507 - <unassigned or new passcode> 0508 - <unassigned or new passcode> 0509 - <unassigned or new passcode> 0510 - Invalid 0511 - <unassigned or new passcode> 0512 - Doesn't allow prompt recording, invalid 0513 - No call counts menu, hangs? 0514 - No recording menu, hangs? 0515 - <unassigned or new passcode> 0516 - <unassigned or new passcode> 0517 - <unassigned or new passcode> 0519 - <unassigned or new passcode> 0520 - Invalid 0521 - Hangs? 0522 - <unassigned or new passcode> 0523 - <unassigned or new passcode> 0528 - <unassigned or new passcode> 0529 - <unassigned or new passcode> 0530 - Call counts option not available, does silent voice capture, plays back 0531 - <unassigned or new passcode> 0532 - <unassigned or new passcode> 0540 - <unassigned or new passcode> 0550 - <unassigned or new passcode> 0555 - <unassigned or new passcode> 0603 - <unassigned or new passcode> 0604 - <unassigned or new passcode> 0605 - <unassigned or new passcode> 0606 - Invalid 0607 - Reads back unit ID, line number, call time (020855), disconnects 0608 - Reads back unit ID, line number, call time (1529128930), Spanish order line, 4919 0609 - Invalid 0610 - <unassigned or new passcode> 0611 - Test recording of mic scuffling? Or invalid. 0612 - Invalid 0613 - <unassigned or new passcode> 0614 - Invalid 0615 - Invalid 0616 - <unassigned or new passcode> 0617 - <unassigned or new passcode> 0618 - Doesn't allow prompt recording, invalid 0619 - Invalid 0620 - <unassigned or new passcode> 0621 - Doesn't allow prompt recording, TTS voice, "Sorry, all of our agents are currently busy. Please try again later." 0622 - Invalid 0623 - <unassigned or new passcode> 0624 - Invalid 0625 - <unassigned or new passcode> 0626 - <unassigned or new passcode> 0627 - Recorded beeps x2, hangs? 0628 - Comcast Digital Phone IVR 0629 - <unassigned or new passcode> 0630 - Invalid 0631 - <unassigned or new passcode> 0632 - <unassigned or new passcode> 0633 - <unassigned or new passcode> 0634 - <unassigned or new passcode> 0635 - <unassigned or new passcode> 0636 - <unassigned or new passcode> 0637 - <unassigned or new passcode> 0638 - <unassigned or new passcode> 0700 - <unassigned or new passcode> 0705 - <unassigned or new passcode> 0706 - <unassigned or new passcode> 0707 - Invalid 0708 - Doesn't allow prompt recording, invalid 0709 - Invalid 0710 - <unassigned or new passcode> 0711 - Reads back unit ID, line number 0712 - Doesn't allow call counter, invalid 0713 - <unassigned or new passcode> 0714 - Invalid 0715 - <unassigned or new passcode> 0716 - <unassigned or new passcode> 0717 - Invalid 0718 - Doesn't allow running program 0719 - Doesn't allow prompt recording, Invalid 0720 - Invalid 0721 - <unassigned or new passcode> 0722 - Doesn't allow prompt recording, invalid 0723 - Invalid 0724 - Invalid 0725 - Invalid 0726 - Reads back unit ID, line number, call time, other time?, hangs up 0727 - Long silence, transfers to after hours rec 0728 - <unassigned or new passcode> 0729 - No menu, West hotline 0730 - <unassigned or new passcode> 0731 - <unassigned or new passcode> 0800 - <unassigned or new passcode> 0805 - <unassigned or new passcode> 0806 - <unassigned or new passcode> 0807 - <unassigned or new passcode> 0808 - Doesn't allow prompt recording, hangs up 0809 - <invalid application> 0810 - Reads back 358-596, 0811 - Reads back 3547-181 (unit ID, line number), starts recording audio samples 0812 - <unassigned or new passcode> 0813 - <unassigned or new passcode> 0900 - <unassigned or new passcode> 0907 - <unassigned or new passcode> 0908 - <unassigned or new passcode> 0909 - No menu, invalid, loops 0910 - <unassigned or new passcode> 0999 - <unassigned or new passcode> 1000 - Doesn't allow call counter, reads back strange numbers (398-399-99-11,111 222-2:52 AM) 1001 - Invalid 1002 - Invalid 1003 - <unassigned or new passcode> 1004 - Reads back unit ID, line number, prompts for date, hour, APN, ten digit MDN (Cricket phone number) 1005 - Allows blacklist updating, invalid 1006 - <unassigned or new passcode> 1007 - Doesn't allow prompt updating, invalid 1008 - Invalid 1009 - Invalid 1010 - <unassigned or new passcode> 1011 - <unassigned or new passcode> 1012 - <unassigned or new passcode> 1013 - Invalid 1014 - <unassigned or new passcode> 1015 - Invalid 1016 - Invalid 1017 - Record beep x2 1018 - Reads back unit number, line number, prompts for default/different scenario, test ANI. Scenarios read back four digit + two digit number, hang up 1019 - Same as 1018? 1020 - Doesn't allow prompt updating, gives 711 number-esque response (minus DTMF) 1021 - Only allows program testing/blacklist updating, reads off numbers and hangs up 1022 - <unassigned or new passcode> 1023 - Invalid 1024 - No menu, reads back unit ID, line number, routes to old Comcast IVR 1025 - <unassigned or new passcode> 1026 - <unassigned or new passcode> 1027 - "To start the program, press one. To change the date and time, press two. To change the ANI, press three. To change the APN, press four. To change the data rate, press five. To choose the program, press six, to change the host library, press seven." <default program number is eSecuritel customer service IVR> 1028 - Same as 1027? 1029 - Credit report ordering IVR, pulls docs from phone numbers, but may want street number/apartment/ZIP verification to read last name 1030 - Same as 1029? 1031 - "I'm sorry, due to heavy call volume, all our representatives are currently busy. Please try your call again later." 1032 - <unassigned or new passcode> 1033 - <unassigned or new passcode> 1034 - <unassigned or new passcode> 1035 - <unassigned or new passcode> 1036 - <unassigned or new passcode> 1037 - <unassigned or new passcode> 1038 - <unassigned or new passcode> 1039 - <unassigned or new passcode> 1040 - Allows voice prompt updating, reads back unit/line number, call time, drug info line IVR. Lots of voice prompts. 1041 - <unassigned or new passcode> 1042 - <unassigned or new passcode> 1043 - <unassigned or new passcode> 1044 - <unassigned or new passcode> 1045 - <unassigned or new passcode> 1046 - <unassigned or new passcode> 1047 - <unassigned or new passcode> 1050 - <unassigned or new passcode> 1060 - <unassigned or new passcode> 1068 - <unassigned or new passcode> 1069 - <unassigned or new passcode> 1070 - Invalid 1071 - Doesn't allow prompt recording, invalid 1072 - Doesn't allow prompt recording, invalid 1073 - <unassigned or new passcode> 1074 - <unassigned or new passcode> 1079 - <unassigned or new passcode> 1080 - <unassigned or new passcode> 1084 - <unassigned or new passcode> 1085 - <unassigned or new passcode> 1086 - <unassigned or new passcode> 1087 - Doesn't allow call recording, invalid 1088 - "I'm sorry, but that is an invalid entry. Please try again." 1089 - <unassigned or new passcode> 1090 - Doesn't allow prompt recording, DHL Express technical difficulties rec 1091 - <unassigned or new passcode> 1092 - <unassigned or new passcode> 1093 - <unassigned or new passcode> 1094 - <unassigned or new passcode> 1095 - Invalid 1096 - <unassigned or new passcode> 1097 - <unassigned or new passcode> 1098 - Reads back unit ID/line number, makes weird beep, hangs up 1099 - Invalid 1100 - Doesn't allow prompt recording, reads back unit ID/line number, call time, hangs 1101 - Disconnects 1102 - <unassigned or new passcode> 1103 - <unassigned or new passcode> 1104 - <unassigned or new passcode> 1108 - <unassigned or new passcode> 1109 - <unassigned or new passcode> 1110 - Doesn't allow prompt recording, invalid 1111 - Indian woman, "Hello world" 1112 - Doesn't allow prompt recording, hangs up? 1113 - Doesn't allow prompt recording, reads back unit ID, line number, recorded beeps (x2) 1114 - Reads back unit ID, line number, call time (local), prompts for 0 for live op 1115 - <unassigned or new passcode> 1116 - Invalid 1117 - <unassigned or new passcode> 1118 - <unassigned or new passcode> 1119 - <unassigned or new passcode> 1120 - <unassigned or new passcode> 1130 - <unassigned or new passcode> 1140 - <unassigned or new passcode> 1180 - <unassigned or new passcode> 1195 - <unassigned or new passcode> 1196 - <unassigned or new passcode> 1197 - <unassigned or new passcode> 1198 - Invalid 1199 - Call counts menu not available, invalid 1200 - Doesn't allow prompt recording, Invalid 1201 - Invalid 1202 - <unassigned or new passcode> 1203 - <unassigned or new passcode> 1210 - <unassigned or new passcode> 1211 - "Hello world... <digits voice> 2" 1212 - Invalid 1213 - Reads back unit ID/line number, prompts for APN, "We're sorry, there are currently no available calls (powells?). Please use the chat function within Gateway if you are scheduled to work. Or send an email via the support site for assistance. Thank you, goodbye." 1214 - <unassigned or new passcode> 1215 - No menu, reads back unit ID/line number, "Please enter your test ANI", Centralink outage reporting line 1216 - <unassigned or new passcode> 1217 - <unassigned or new passcode> 1218 - Test line, calling card delivery line, "Your calling card will be delivered to you in three to four years. Thank you for calling." 1219 - <unassigned or new passcode> 1220 - <unassigned or new passcode> 1221 - <unassigned or new passcode> 1222 - Invalid 1223 - Reads back unit ID, line number, "To test Spanish open, press one. To test Spanish closed, press two." 1224 - <unassigned or new passcode> 1225 - Invalid 1226 - <unassigned or new passcode> 1227 - <unassigned or new passcode> 1228 - Doesn't allow prompt recording, invalid 1229 - Allows blocked caller updating, invalid 1230 - Reads back unit ID, line number, "Welcome <# key>. "Enter the 10-digit mobile number <# key>" 1231 - <unassigned or new passcode> 1232 - <unassigned or new passcode> 1233 - Invalid 1234 - <unassigned or new passcode> 1235 - Invalid 1236 - No menu, hangs up 1237 - <unassigned or new passcode> 1238 - <unassigned or new passcode> 1239 - <unassigned or new passcode> 1240 - Invalid 1241 - <unassigned or new passcode> 1242 - No call counts menu, "Welcome to the final application. The unit ? and line is...", hangs up 1243 - <unassigned or new passcode> 1244 - <unassigned or new passcode> 1245 - <unassigned or new passcode> 1246 - Invalid 1247 - <unassigned or new passcode> 1248 - Allows blocked caller list updating, reads back unit ID, line number, call time (Unix epoch?), Asmanex order line 1249 - Reads back unit ID, line number, prompts for date, APN, says "Welcome" x3, goes to technical difficulties rec 1250 - <unassigned or new passcode> 1251 - <unassigned or new passcode> 1252 - No call counts feature, reads back unit ID/line number, test survey line 1253 - <unassigned or new passcode> 1254 - No call counts feature, invalid 1255 - <unassigned or new passcode> 1256 - Reads back unit ID/line number, "This is a test. Goodbye." 1257 - <unassigned or new passcode> 1258 - <unassigned or new passcode> 1259 - <unassigned or new passcode> 1260 - <unassigned or new passcode> 1261 - <unassigned or new passcode> 1262 - <unassigned or new passcode> 1263 - <unassigned or new passcode> 1264 - <unassigned or new passcode> 1265 - <unassigned or new passcode> 1266 - <unassigned or new passcode> 1298 - <unassigned or new passcode> 1299 - <unassigned or new passcode> 1300 - Doesn't allow prompt recording, invalid 1301 - <unassigned or new passcode> 1302 - <unassigned or new passcode> 1307 - <unassigned or new passcode> 1308 - <unassigned or new passcode> 1309 - <unassigned or new passcode> 1310 - <unassigned or new passcode> 1311 - Invalid 1312 - <unassigned or new passcode> 1313 - Doesn't allow prompt recording, allows caller blacklists, rings several times and disconnects 1314 - <unassigned or new passcode> 1315 - Doesn't allow call counting, reads back unit ID/line number, call time, "Hi, this is a test message!" + MOH, forwards to 402-517-6591 1316 - <unassigned or new passcode> 1317 - Reads back unit ID/line number, call time, prompts for date/time, day of week, test APN, # of calls, agents, goes to test GE queue 1318 - <unassigned or new passcode> 1319 - <unassigned or new passcode> 1320 - <unassigned or new passcode> 1321 - <unassigned or new passcode> 1322 - Reads back unit ID/line number, prompts for 10-digit APN 1323 - <unassigned or new passcode> 1324 - <unassigned or new passcode> 1325 - <unassigned or new passcode> 1326 - <unassigned or new passcode> 1327 - <unassigned or new passcode> 1328 - <unassigned or new passcode> 1400 - <unassigned or new passcode> 1411 - <unassigned or new passcode> 1444 - <unassigned or new passcode> 1497 - <unassigned or new passcode> 1498 - <unassigned or new passcode> 1499 - Call counter disabled, reads back unit ID, line number? Weird guessing game program? 1500 - Reads back unit ID, line number, call time (local time), "Press one for baseline application, press two for Chase Leisure application, press three for Chase Extras application, press four for national city application, press five for new PNC application" 1501 - Reads back unit ID, line number, University of Vermont smoking call-in study, wants five-digit ID 1502 - Reads back unit ID, line number, "To start the program, press one. To change the date and time, press two. To change the ANI, press three. To change the APN, press four. To change the Informix box, press five." 1503 - "Please enter your ID" 1504 - <unassigned or new passcode>? 1505 - Reads back unit ID, call time, "On this test call, press one to use the system date, or press two to change the date 1506 - <unassigned or new passcode> 1507 - <unassigned or new passcode> 1508 - <unassigned or new passcode> 1509 - <unassigned or new passcode> 1510 - <unassigned or new passcode> 1511 - <unassigned or new passcode> 1512 - <unassigned or new passcode> 1550 - <unassigned or new passcode> 1554 - <unassigned or new passcode> 1555 - Allows updating blocked callers, test survey line? Disconnects after greeting 2 1556 - <unassigned or new passcode> 1600 - <unassigned or new passcode> 1611 - <unassigned or new passcode> 1650 - <unassigned or new passcode> 1666 - <unassigned or new passcode> 1699 - <unassigned or new passcode> 1700 - Invalid 1701 - <unassigned or new passcode> 1702 - <unassigned or new passcode> 1711 - <unassigned or new passcode> 1740 - <unassigned or new passcode> 1747 - <unassigned or new passcode> 1748 - <unassigned or new passcode> 1749 - Reads back unit ID/line number, 402-555-3010 w/weird digits, call #, Office Depot IVR 1750 - Invalid 1751 - <unassigned or new passcode> 1752 - <unassigned or new passcode> 1800 - <unassigned or new passcode> 1811 - <unassigned or new passcode> 1850 - <unassigned or new passcode> 1900 - <unassigned or new passcode> 1989 - <unassigned or new passcode> 1990 - <unassigned or new passcode> 1991 - <unassigned or new passcode> 1992 - Has caller blacklist, invalid 1993 - <unassigned or new passcode> 1994 - Invalid 1995 - Invalid 1996 - <unassigned or new passcode> 1997 - Invalid 1998 - No call counts menu, reads back unit ID, line number, hangs? 1999 - Invalid 2000 - Invalid 2001 - Invalid 2002 - Invalid 2003 - Immediately starts recording (x2), makes weird beep, hangs up 2004 - Invalid 2005 - Invalid 2006 - <unassigned or new passcode> 2007 - Forwards to AT&T Wireless call queue 2008 - No menu, invalid, loops 2009 - Invalid 2010 - Call counts menu disabled, Community Care Rx member IVR 2011 - Reads back unit ID, line number, prompts for date, APN, 10-digit MDN (Cricket phone number), xfers to Cricket prepaid activation IVR 2012 - Reads back unit ID, line number, prompts for date, APN, 10-digit MDN (Cricket phone number), immediately tries to look up account info 2013 - <unassigned or new passcode> 2014 - No menu, AT&T Wireless IVR 2015 - <unassigned or new passcode> 2016 - <unassigned or new passcode> 2017 - Call counts menu disabled, reads unlabeled numbers and disconnects 2018 - <unassigned or new passcode> 2019 - Call counts menu disabled, "Hello, thank you for calling this test message. Goodbye." 2020 - Allows blocked caller update, weird beep x2 + hangup 2021 - <unassigned or new passcode> 2022 - <unassigned or new passcode> 2023 - <unassigned or new passcode> 2024 - <unassigned or new passcode> 2025 - <unassigned or new passcode> 2026 - <unassigned or new passcode> 2027 - <unassigned or new passcode> 2050 - <unassigned or new passcode> 2098 - <unassigned or new passcode> 2099 - <unassigned or new passcode> 2100 - Doesn't allow prompt recording, silence? 2101 - <unassigned or new passcode> 2102 - <unassigned or new passcode> 2103 - <unassigned or new passcode> 2111 - <unassigned or new passcode> 2150 - <unassigned or new passcode> 2210 - <unassigned or new passcode> 2211 - No menu, "Hello, this is a test call. Hello hello." 2212 - <unassigned or new passcode> 2221 - <unassigned or new passcode> 2222 - No menu, reads back 0166-052 + invalid prompt 2223 - <unassigned or new passcode> 2250 - <unassigned or new passcode> 2300 - <unassigned or new passcode> 2310 - <unassigned or new passcode> 2311 - <unassigned or new passcode> 2320 - <unassigned or new passcode> 2330 - <unassigned or new passcode> 2340 - <unassigned or new passcode> 2349 - <unassigned or new passcode> 2350 - *8 + xfer to Liberty Mutual IVR 2351 - <unassigned or new passcode> 2450 - <unassigned or new passcode> 2550 - <unassigned or new passcode> 2555 - <unassigned or new passcode> 2650 - <unassigned or new passcode> 2750 - <unassigned or new passcode> 2811 - <unassigned or new passcode> 2850 - <unassigned or new passcode> 2899 - <unassigned or new passcode> 2950 - <unassigned or new passcode> 2996 - <unassigned or new passcode> 2997 - <unassigned or new passcode> 2998 - Invalid 2999 - Invalid 3000 - Reads off unit/line #, disconnects call 3001 - Reads off unit/line #, poll line (billing test?) 3002 - <unassigned or new passcode> 3003 - Invalid 3004 - <unassigned or new passcode> 3005 - <unassigned or new passcode> 3006 - <unassigned or new passcode> 3007 - <unassigned or new passcode> 3008 - <unassigned or new passcode> 3010 - <unassigned or new passcode> 3022 - <unassigned or new passcode> 3031 - <unassigned or new passcode> 3032 - <unassigned or new passcode> 3033 - Invalid 3034 - Invalid 3035 - <unassigned or new passcode> 3044 - <unassigned or new passcode> 3050 - <unassigned or new passcode> 3100 - <unassigned or new passcode> 3133 - <unassigned or new passcode> 3150 - <unassigned or new passcode> 3310 - <unassigned or new passcode> 3311 - Hangs? 3312 - <unassigned or new passcode> 3333 - <unassigned or new passcode> 3433 - <unassigned or new passcode> 3999 - <unassigned or new passcode> 4000 - Test application w/indistinguishable speech 4001 - <unassigned or new passcode> 4002 - <unassigned or new passcode> 4003 - <unassigned or new passcode> 4004 - <unassigned or new passcode> 4044 - <unassigned or new passcode> 4096 - <unassigned or new passcode> 4097 - <unassigned or new passcode> 4098 - <unassigned or new passcode> 4099 - "Welcome to Centermaine power's administrative program. Enter your password during the six second silent interval." 4100 - "You are returning a call to an AT&T calling card network system, and the party that called you cannot be reached at this number." 4101 - <unassigned or new passcode> 4102 - Invalid 4103 - <unassigned or new passcode> 4104 - <unassigned or new passcode> 4105 - <unassigned or new passcode> 4111 - <unassigned or new passcode> 4200 - <unassigned or new passcode> 4300 - <unassigned or new passcode> 4321 - <unassigned or new passcode> 4411 - <unassigned or new passcode> 4444 - <unassigned or new passcode> 5000 - <unassigned or new passcode> 5100 - <unassigned or new passcode> 5200 - <unassigned or new passcode> 5250 - <unassigned or new passcode> 5299 - <unassigned or new passcode> 5300 - Doesn't allow prompt recording, allows blacklist updating, invalid 5301 - <unassigned or new passcode> 5302 - <unassigned or new passcode> 5303 - <unassigned or new passcode> 5330 - <unassigned or new passcode> 5340 - <unassigned or new passcode> 5348 - <unassigned or new passcode> 5349 - <unassigned or new passcode> 5350 - Invalid 5351 - <unassigned or new passcode> 5352 - <unassigned or new passcode> 5360 - <unassigned or new passcode> 5370 - <unassigned or new passcode> 5400 - <unassigned or new passcode> 5450 - <unassigned or new passcode> 5511 - <unassigned or new passcode> 5555 - Allows blocked caller list to be updated, won't allow prompt recording, invalid 6000 - <unassigned or new passcode> 6611 - <unassigned or new passcode> 6665 - <unassigned or new passcode> 6666 - Won't allow prompt recording, reads back unit ID, line number, 0317, prompts for test ANI + DNIS (Pepco outage reporting system) 6667 - <unassigned or new passcode> 6999 - <unassigned or new passcode> 7000 - <unassigned or new passcode> 7100 - <unassigned or new passcode> 7200 - <unassigned or new passcode> 7260 - <unassigned or new passcode> 7275 - <unassigned or new passcode> 7276 - <unassigned or new passcode> 7277 - Sends *8, transfers to Charles Schwabb queue 7278 - Reads back unit ID/line number, 711 number script 7279 - <unassigned or new passcode> 7280 - <unassigned or new passcode> 7300 - <unassigned or new passcode> 7400 - <unassigned or new passcode> 7500 - <unassigned or new passcode> 7600 - <unassigned or new passcode> 7700 - <unassigned or new passcode> 7777 - Invalid 7800 - <unassigned or new passcode> 7900 - <unassigned or new passcode> 8000 - <unassigned or new passcode> 8086 - <unassigned or new passcode> 8087 - <unassigned or new passcode> 8088 - Insurance IVR 8089 - <unassigned or new passcode> 8090 - <unassigned or new passcode> 8100 - <unassigned or new passcode> 8188 - <unassigned or new passcode> 8288 - <unassigned or new passcode> 8388 - <unassigned or new passcode> 8488 - <unassigned or new passcode> 8500 - <unassigned or new passcode> 8855 - <unassigned or new passcode> 8888 - <unassigned or new passcode> 9000 - <unassigned or new passcode> 9099 - <unassigned or new passcode> 9100 - Reads back unit number/line ID, psychic line 9101 - <unassigned or new passcode> 9102 - <unassigned or new passcode> 9103 - <unassigned or new passcode> 9104 - <unassigned or new passcode> 9105 - Card services IVR, refers to 888-998-3587 9106 - <unassigned or new passcode> 9107 - <unassigned or new passcode> 9108 - <unassigned or new passcode> 9109 - <unassigned or new passcode> 9110 - <unassigned or new passcode> 9117 - <unassigned or new passcode> 9118 - <unassigned or new passcode> 9119 - Doesn't allow prompt recording, reads back unit ID/line number, disconnects 9120 - Invalid 9121 - No menu, invalid, loops 9122 - <unassigned or new passcode> 9123 - <unassigned or new passcode> 9124 - <unassigned or new passcode> 9125 - <unassigned or new passcode> 9126 - <unassigned or new passcode> 9130 - <unassigned or new passcode> 9150 - <unassigned or new passcode> 9199 - <unassigned or new passcode> 9200 - <unassigned or new passcode> 9300 - <unassigned or new passcode> 9378 - <unassigned or new passcode> 9400 - <unassigned or new passcode> 9500 - <unassigned or new passcode> 9600 - <unassigned or new passcode> 9700 - <unassigned or new passcode> 9800 - <unassigned or new passcode> 9996 - <unassigned or new passcode> 9997 - <unassigned or new passcode> 9998 - Invalid 9999 - "Enter message number" 00000 - "Please enter your six digit password" 00001 - <unassigned or new passcode> 00002 - <unassigned or new passcode> 00010 - <unassigned or new passcode> 01990 - <unassigned or new passcode> 10000 - <unassigned or new passcode> 11000 - <unassigned or new passcode> 11100 - <unassigned or new passcode> 11110 - <unassigned or new passcode> 11111 - Doesn't allow call counter, "I'm sorry, you aren't allowed to use this service" 12345 - Invalid 20000 - <unassigned or new passcode> 22222 - Doesn't allow prompt recording, invalid 30000 - <unassigned or new passcode> 33333 - <unassigned or new passcode> 40000 - <unassigned or new passcode> 43210 - <unassigned or new passcode> 44444 - Doesn't allow call counter, invalid 50000 - <unassigned or new passcode> 51111 - <unassigned or new passcode> 55555 - Allows caller blocking, Invalid 60000 - <unassigned or new passcode> 66666 - <unassigned or new passcode> 70000 - <unassigned or new passcode> 77777 - Invalid 80000 - <unassigned or new passcode> 88888 - Informants practice program? 90000 - <unassigned or new passcode> 99997 - <unassigned or new passcode> 99998 - <unassigned or new passcode> 99999 - Does not allow running test program 000000 - Invalid 100000 - Does not allow prompt recording, reads unit/line number, call time, forwards to rep 100001 - Invalid 100002 - <unassigned or new passcode> 100003 - <unassigned or new passcode> 100004 - <unassigned or new passcode> 111111 - Invalid 222222 - Does not allow running test program 300000 - <unassigned or new passcode> 333333 - Immediately records prompt, 123456 - Does not allow prompt recording, invalid 999999 - <unassigned or new passcode>
  6. 2 points
    Seems to stop the tone when hitting 0 on MF, then hangs up. I will investigate more and edit. EDIT: Actually stops the tone upon any MF digits being pressed. Then hangs up.
  7. 2 points
    Great to see some new faces! Especially in this thread. 0051 is a DATU. 0037 is a 105-type test as I think it's officially called. I think the idea is they do trunk testing. In any case, press 2, #, etc to make it produce tones and noise. 0 commonly hangs up on those things. 407-238-6209,6238 - Elevators on hotel PBX (Nortel Meridian) 407-238-6214 - Modem on hotel PBX: CONNECT CentOS release 6.5 (Final) Kernel 2.6.32-431.29.2.el6.x86_64 on an x86_64 XetaCAS_22832_MarriottRoyalPalms login: 843-414-0052 - rec, "We're sorry, your telephone is temporarily out of order. There may be a receiver off the hook. Please check your main telephone and extensions. Charleston, South Carolina. 843-1. CHTN." 502-753-0021 - 17A announcement machine 502-753-0059 - IVR, "Please enter your home phone number" 504-648-0010 - 17A announcement machine
  8. 2 points
    970-350-00xx scan by Mountain Hell, 5/1/2018 A rather boring 5ESS in Greeley, Colorado. CLLI code GRELCOMADS0. 0000: fax 0001: ringout 0002: reorder 0003: ringout 0004: ring to disco/nis 0005: tone 0006: ring to disco/nis 0007: disco/nis 0008: busy 0009: milliwatt 0010: acb 0011: tone 0012: reorder 0013: reorder 0014: disco/nis 0015: ringout 0016: the number 9703500016 has been disconnected. (x2) no further information is avialable about this number. (off-hook tone x2) 0017: the number 9703500017 has been disconnected. (x2) no further information is avialable about this number. (off-hook tone x2) 0018: the number 9703500018 has been disconnected. (x2) no further information is avialable about this number. (off-hook tone x2) 0019: ringout 0020: carrier 0021: ringout 0022: ringout 0023: ring to disco/nis 0024: ring to disco/nis 0025: disco/nis 0026: busy 0027: busy 0028: dialtone 0029: carrier 0030: reorder 0031: the number 9703500031 is in service. please try your call again. (x2) (off-hook tone x2) 0032: ringout 0033: ringout 0034: ringout 0035: you have reached greeley main ds0 970-350. (x2) 0036: (pat fleet) this local call has changed to 10 digits. it is not necessary to dial a 1 when calling this number. please redial using area code 303. (x2) 0037: ring to disco/nis 0038: ring ro disco/nis 0039: disco/nis 0040: (old lady) we're sorry, it is not necessary to dial the digits 950 before dialing your carrier access code. please hang up and try your call again. (x2) 0041: (old lady) we're sorry, it is not necessary to dial a carrier access code for the number you have dialed. please hang up and try your call aga-- (x2) 0042: (m) we're sorry, the number you dialed cannot be reached with the access code you dialed. please check the code and try again or call your carrier for assistance. (x2) 0043: (pat fleet) we're sorry, due to network difficulties your long distance call cannot be completed at this time. please try your call again later. (x2) 0044: (old lady) we're sorry, due to network difficulties your long distance call cannot be completed at this time. please try your call later. (x2) 0045: (old lady) we're sorry, due to network difficulties your long distance call cannot be completed at this time. please try your call later. (x2) 0046: (old lady) we're sorry, in order to complete this call, you must first dial a 1-0 and the three digit carrier access code. please try your call again or call your long distance carrier for assistance. (x2) 0047: disco/nis 0048: ring to disco/nis 0049: ring to disco/nis 0050: milliwatt (5 sec) 0051: ring to disco/nis 0052: ring to disco/nis 0053: disco/nis 0054: disco/nis 0055: disco/nis 0056: (f) please do not hang up. the voicemail system temporarily needs you to re-enter the number you are calling. please re-enter the number you are calling then press pound. 0057: 105-type test 0058: reorder 0059: disco/nis 0060: disco/nis 0061: disco/nis 0062: disco/nis 0063: ring to acb 0064: acb 0065: disco/nis 0066: (pat fleet) we're sorry, it is not necessary to dial a 1 or 0 when calling this number, will you please hang up and try your call again. (x2) 0067: (old lady) we're sorry, you must first dial a 1 when calling this number, will you please hang up and try your call again. (x2) 0068: disco/nis 0069: the number you are calling was blocked and cannot be called back using your last call return service. (x2) 0070: (deeper pat fleet) your long distance call cannot be completed because your service has been restricted. please contact your centurylink business office. 0071: (deeper pat fleet) the number cannot be reached now. please hang up and try again later. 0072: (pat fleet) we're sorry, you have dialed a number which cannot be reached from your calling area. 0073: disco/nis 0074: (some lady) telephone service has not been installed at this location. please dial 811 when you are ready to establish your home telephone service. a service representative will describe the options available to you and take your order. thank you. 0075: (pat fleet, bad) we're sorry, your call did not go through, will you please try your call again. (x2) 0076: (pat fleet) we're sorry, your call cannot be completed as dialed. please check the number and dial again. remember, colorado now has two area codes. 0077: (old lady) we're sorry, your call cannot be completed as dialed. please check your instruction manual or call repair service for assistaance. (x2) 0078: (pat fleet) the number called is busy. a special ringing will tell you when the line is free. please hang up now. (x2) 0079: (pat fleet) the number called cannot be reached. please hang up now. (x2) 0080: (pat fleet) you have canceled your request. please hang up now. (x2) 0081: (pat fleet) if you'd like to make a call, please hang up and try again. if you need help, hang up and then dial your operator. (x2) 0082: (pat fleet) this call requires a coin deposit. please hang up momentarily then redial your call by first depositing the local rate posted on the instruction card. (x2) 0083: one ring then silence 0084: ringout 0085: (deeper pat fleet) the last call to your telephone cannot be traced and no charge will be added to your bill. please hang up and call the centurylink call identification center at 18005820655 if you need further assistance. once again, that number is 1800582-- (x2) 0086: (pat fleet) the number was free but it has just become busy again. please hang up. you may reactivate if you wish by redialing the original code. (x2) 0087: (pat fleet) your call has been completed however the party you are calling is not receiving calls at this time. (x2) 0088: silent switchman test 0089: rings once then silence 0090: (pat fleet) call trace cannot be activated at this time. please try again in a few minutes if you have not received another call. (x2) 0091: ring to disco/nis 0092: disco/nis 0093: ring to disco/nis 0094: ring to disco/nis 0095: disco/nis 0096: ring to disco/nis 0097: ring to disco/nis 0098: ring to disco/nis 0099: ring to disco/nis
  9. 2 points
    I found something kinda funny yet possibly intentional and thought you guys might appreciate it. So assuming it's after hours or the weekend where you are, give a Morgan Stanley office a call. Pretty much any of them will work. If you don't have one, here: 800-488-0181. Pretty much all of them have toll-frees if you look at the branch's website - http://www.morganstanleyfa.com/locator/ . Anyway, when the IVR picks up, press 2 and it'll ask you for an "eleven digit extension". Give it a toll-free, and it'll connect you. While it will pass ANI, it does accept calls from payphones and will hide class of service digits. Interesting, it does add an RDNIS field to the call to indicate it was forwarded. Try calling 800-330-8829 from it to get the number it's claiming to forward from.
  10. 2 points
    Some recordings came to me from a source that I trust of phone calls from Russia and around the Baltic area in general, taken 2 or so months ago and in a few of the recordings you'll sometimes hear tones before people answer the phone. I'll put a compilation together soon-ish and upload here for people to hear. The audio can be tinny in places, nothing I can do about that unfortunately.
  11. 2 points
    904-266-9604 - Nortel key system owned by MCI/Verizon; Mister Rogers works here. +800-6669-5588 - China Telecom NIS rec, mildly weird stuff happens afterwards 416-591-0105 - One of many numbers that goes to a Octel VMS owned by Bell Canada, tells you you don't have access to the advanced intelligent network 800-483-0015 - Verizon office with Rolm PBX 603-746-0125 - Weird thingie on analog line, picks up with square wave beep 603-746-9911 - IVR, "Thank you for calling. Enter your user ID and press pound to continue." 480-792-3996 - PCAnywhere modem on Nortel PBX 307-782-9997 - "The number you have dialed is not authorized to receive incoming calls." <Nortel EDRAM digits> "085501" 307-782-0000 - <480 hertz beep in background> "Union Telephone operator, how can I help you?" - TOPS position, will dial local numbers for you. 360-985-1902 - Weird sounding dialtone
  12. 2 points
    "I spent three hours last year convincing the AT&T call center that they needed to get their line back on a replaced pole. They refused to believe that a line labeled Western Electric was theirs. Kept saying it was the electric company's line." (jackalope48; http://www.city-data.com/forum/texas/2772893-end-era.html#post48383373)
  13. 2 points
    I picked this up in a heap of old computer, radio, and telephone equipment, from a guy who had been an engineer in the Navy, then an engineer/lineman/programmer at Bell Labs in NJ: It's an *actual* milliwatt! I can't find the BSP for it online, but I did find a hardcopy on eBay, so I'll scan that in when I get it. Battery test points, this is the battery (well, the top of an old one): 45V "B batteries" were common in old radios and other higher-than-we're-used-to voltages were common in other types of test gear. For instance, a kick meter uses a different 45V battery (looks like a giant 9V and is still made). Top of the internal circuit subassembly, the battery goes in the space seen at the top of the picture: Here's the circuit: Typical Western Electric, potted networks, switchboard jacks, and expensive resistors and capacitors. Not yet sure if the pot varies pitch or level. You can see there's a single very old GE transistor in a metal can package clipped to the side of the uppermost (4002A) network, presumably the only active component in the circuit.
  14. 2 points
    Just found this photo and article, figured I'd leave it here. https://www.rcrwireless.com/20171109/network-infrastructure/switching-it-up-bidding-farewell-to-the-1aess-switch-tag6
  15. 2 points
    I go all over the US for work and vacation, and when I do I like to see how the local network homes on various tandems (AT&T, MCI, Sprint) when I can. I like to do it from landlines and cellphones since both route differently. I also do this with VOIP carriers since often times they dump you on the POTS network at various places, and this can either be static or dynamic. (Can you say Tandem round robin?) Often times calls from landline, cellular or VOIP go to the newer "edge switches" that are in the format of NPA-xL (like 412-9L). I believe most of these are 5ESS based. But most of the time you can reach a 4ESS in the format of xxx-T. Anyhow, I was in a very rural place in Wyoming in May while on vacation. It was a rest stop in the middle of nowhere. The rest stop used to have a pay phone (you can tell it was there and removed), but they did have a microcell for Verizon Wireless (obviously fed by DSL). Doing my test for AT&T, it did the round robin as I suspected (some sort of VOIP backhaul) and I came up on 088-T a few times. That *used* to be the AT&T tandem for San Diego. They retired the 4ESS a few years ago, but now it comes up in the "new" voice that AT&T is using for the new generation "N4E" system.The N4E uses the old 4ESS software hosted in a virtual environment in newer hardware (lot smaller footprint and more in tune with modern packet switching). Sure enough, I was in San Diego last week and tried it from a COCOT. Yup, they do have a new N4E and has the new voice on the trailer. So I'm wondering how many of the existing 4ESS systems will be replaced by N4E systems? I also wonder how many 4ESS and N4E systems are out there. I found a N4E in Scottsdale, AZ (NPA 480) not too long ago. Haven't explored what else is new out there recently.
  16. 2 points
    So today, I was thinking about a few people I'd talked to recently - they told me they were into the idea of scanning, but because of their lack of free time/direction, it was hard to find space in their lives for this sort of thing. So I was thinking; should I build a thing with my Dialogic box that automatically dials ranges that look potentially fun, and let people review the recordings/manually make a description of what's actually on the line? There could be a rough level of signal detection using the DSP; enough to let you search by what you'd like to see most; whether it be recordings, VMBs, modems or dialtones or whatever, and let you select by region or operating company. Maybe some more powerful signal detection could be tacked on at a later point that could recognize certain manufacturers or switch types. This would be a pretty significant undertaking, so I'd like to know if anybody is interested before I actually do this. If you don't actively scan and would like to, would this help turn the tide for you a little?
  17. 2 points
  18. 2 points
    I just googled that and guess what: https://int3.cc/products/usbcondoms haha It doesn't say in the description that it prevents your phone from frying, but logically that's the first device to fry...
  19. 2 points
    I still use flash drives to take stuff to untrusted computers -- for example, when I take something to the print shop to be run off in large format. These types of places (print/copy shops, library, et c.) don't run a primary business of having safe, secure computers, and they let you plug in and run pretty much anything, so I will typically use a flash drive to take files, then nuke it when I get home. I don't log into anything on those computers, I've seen people at the print shop logged in with their cloud storage, email, whatever. Seems like a great way to get keylogged or your session cookie swiped or something. For moving stuff around between computers I trust, yeah, I don't really use flash drives anymore. Ironically I do still use floppies -- but that's only because part of my business is legacy systems repair/maintenance.
  20. 2 points
    Yeah, if you're looking at old scan textfiles then a carrier is a modem carrier. You can identify them by their metal screeching though you should find recordings to differentiate between a fax carrier and a modem carrier signal. You could connect to them over voip, I think, using a terminal program like Term90 or HyperTerminal. Okay, okay, I don't know offhand of any modern dial-up terminal programs. Guess I should research that. Might be a ton of BBSes under my nose and me without a trusty US Robotics.
  21. 2 points
    Sure! I had to go through this myself, only without the benefit of an account on the translations card to work with. Depending on what software release you have (if you're trying to install a C-LAN card, I assume it's a fairly late release. I don't think it'll work with anything below release 7) you have a few different options here. 1) The easiest is to just boot the system with no translations card installed. Once you've got it running, log into it with the username inads and the password indspw. Go ahead and insert the memory card into the reader. Or just skip all this crap and if you have something that accepts linear flash (ATA flash for the later systems) PCMCIA cards, just stick it in that. Anyway, assuming you're doing the Definity method, type 'upload translation'. Or maybe it's download; I think they made it to be upload from the Definity instead of to the terminal emulator. On one, it'll copy the flash card's contents into RAM and say "Prepare to receive file". Use xmodem to receive the file, and you'll have a copy of the passwords (albeit XORed or something; it's not anything particularly sophisticated. I don't know the algorithm, but I can give you as many plaintexts as you want if you need them. It doesn't seem to be anything standard, but it looks like Base64 at first glance) from the switch. 2) If you have a release 6 or lower processor, you can boot with no translations card again, and overwrite the bytes for the init (superuser; the one that lets you activate any feature you feel like having) password with the ones of a password you know (there's no RAM protection; the rva command should let you do this. I'll attach a ramdump of the pam process to this post). For added shits and giggles, there's even a byte you can change to make a password expire. In some situations, that might be the only way you have to change it. I dunno a lot about the way the header works, but in release 6 and 8, there's a byte that indicates what type of account the username is - or maybe it's an account ID. By default, It's 0x00 for init, 0x01 for inads, 0x02 for craft, and I think the rest are in descending order of account privileges. It might be possible to have two init or inads accounts. However, if the init account is set to prompt for an ASG login (which in release 8/+, it is by default), it'll try and give you a challenge/response for the init account. If you do have a release 8/+ translations card, one thing I've found you can do is change the account ID for the init account to 0x01 (so it doesn't prompt for an ASG challenge/response), write the password to one you know, and then write it back to 0x00 when you're logged in. Though you'll get slightly higher privileges than the inads account, it seems to know what you're doing, and disables the option to change purchased features. Or activate the switch to begin with >.< . For release 8/+, I think there's really only one course of action that can be done at the moment; log in as inads (or init with the above method; the only difference is under inads, it'll try to hide this, but it'll still accept it) and type 'go debugger local'. The switch has a lot of nice things in here, including a simple disassembler. If you speak R3000 assembly, you can probably figure out why/how the switch knows you've been screwing around with the accounts. Judging by how it complains about my *cough* modded release 6 card, I assume the init password is derived from something specific to the software version, and newer releases, knowing that, will complain if you've changed it. If you decide to take this route, lemme know. There's a bit more detail I can go into about the debugger and general Oryx/Pecos operation. 3) You can boot it with no translations card, and upload a fully unlocked release 6 translations backup I made to your card. On newer releases, this'll still work, but you'll be relegated to release 6 features, and it won't let you save; the newer processor releases seem to know something is up, and will claim the card is corrupted. Normally I'd just upload it, but there's some stuff I'd rather not have public on the translations backup I made. Lemme know if you want it. pam.bin pam_r8.bin
  22. 2 points
    T-Mobile? That doesn't make too much sense, T-Mobile (and its predecessors VoiceStream and Omnipoint) never operated analog networks. Matter of fact, neither did Sprint. T-Mo and Sprint were all digital from their inceptions. my first cell phone was an omnipoint "flip" phone... the flip was just a small plastic piece that covered the numbers when flipped closed... around 1996 or so....
  23. 2 points
    Once you are in a call, they can decode TTY-text, so they should be able to also decode DTMF. That is correct - it is fake. That is correct, too. Between you punching in the number and the phone dialing, a lot can actually happen: For example the phone making a modem-connection to the NCC to get the rate, etc. You can programm the phones to do pretty much every thing you want... Besides 0, almost all N11-numbers for (except 911) are just "aliases" to local phone numbers... And sometimes, they even alias local phone numbers (think of 411 -> 555-1212 -> XXX-555-1212 to treat every "request for information"-call at the same point of contact).
  24. 2 points
    It's basically what C.N.N. tells sheeple a "hacker" is. The average person doesn't know anything about technology, so they look at what Kim Komando (or other "technology experts") write on CNN and USA Today. Total rubbish! I mean, she says, "a hacker broke into Home Depot and stole peoples' credit card numbers. Bad hackers!". So... that's what people think; architects, mail carriers, police officers, and judges. Doesn't matter what they do for a living, if Kim Komando says its true, its gotta be true. However, if someone kept breaking into a bank's vault and stealing money that way.... They'd say, "crap my banks sucks. It needs a new vault and better security. Of course a burglar will sneak in and rob a bank if they leave the doors and vault unlocked or insecure".
  25. 2 points
    http://www.digitalbond.com/blog/2013/10/22/call-yourself-a-hacker-lose-your-4th-amendment-rights/ Apparently saying that you like hacking on things without specifying "things" means you're automatically assumed to be compromising systems and that you're going to destroy evidence so they might as well take all of your equipment preemptively. So I guess hacking together a high water sensor for the basement, since I'm calling it "hacking," means I'll destroy evidence in legal investigations and that I like to break into systems I don't own all the time. Bullshit.
  26. 1 point
    Awesome! Thanks very much. I didn't realize it was turned into an ezine after a physical run of 10 issues. This helps a lot. If anyone is getting rid of hard copies, I'm still interested.
  27. 1 point
    I've been working a little bit with the Definity today, and thought an update would be warranted: So through some quick trial and error and comparing to older releases, I was able to find the 2560 byte blob that is the license file in the translations, an identical copy stored in RAM by the fg_mapa process. Strangely enough, there seems to be some sort of redundant copy of this around somewhere; if you start manipulating the copy in fg_mapa and tell the switch to test the license, it'll very quickly change it back to what it should be. Thankfully, the switch comes with some very nice debugging utilities that should make figuring out where it's getting another copy to fix this (it isn't the translations card; I tried pulling that out. Though obviously, if you corrupt the copy on the translations card, it's going to have a much harder time getting another copy from RAM when you reboot. This helped verify a lot of this) a lot easier. There's going to be a few things to consider here, like how an actual license file differs from what the Definity stores (you're supposed to be able to paste it in using the ossi interface on the switch. The Definity won't accept the license you pull from RAM, however), but all in all, this should make the rest of the process a lot less painful.
  28. 1 point
  29. 1 point
    Hello everyone, I recently had a good friend move to the Cook Islands, and internet data is VERY expensive over there, so a traditional VoIP app like WhatsApp or Skype is still going to cost her a lot of data. My question: is there a way to initiate a call on my end in the United States via some type of VoIP app or something similar and make the call to her mobile phone or landline in the Cook Islands without incurring a charge on my end or her needing data on her end. I have found in my research a few such options for calling lines in larger countries, but nothing for a country as small as the Cook Islands. I figure you guys are probably the most knowledgeable bunch on the planet when it comes to phones so I thought it couldn't hurt to ask here. Thanks in advance for any help!
  30. 1 point
    Hello, my name is Zio, Im new as hell and dont know shit. Looking forward to figuring things out. \../
  31. 1 point
    :I thought it'd be a good idea to keep a thread open for small, marginally interesting tricks that can be applied in the network. Especially since they can sometimes turn into larger things when they're explored. So, well, I'll start: In lots of ex-SBC areas, you can dial your home NPA + 700-4141 and get a recording from one of the local tandems (as in, a non-toll switch that handles calls between you and an exchange down the road or to a toll carrier) thanking you for choosing SBC as your intra-LATA toll carrier. Sometimes the switch blocks it or redirects it to your toll carrier, so you might have to use 101-0110 or 101-9017 to circumvent this. Also, HPNA-958/959-xxxx will try to complete from the operator IVR on these same switches, but seems to get a cause code or something back quite quickly. I dunno what this is supposed to reach or if some areas treat it differently than others, but usually you get a recording from the TOPS tandem when you hit something invalid.
  32. 1 point
    Sorry I've been so hard to get ahold of! It's been a busy month (though in about a week, that'll change). I've still been scanning and confing and stuff - and occasionally helping Technotite with the Eastern European switches, but I've been farming a lot of the former out to my computers. If nothing else, I've found a way to make scanning way more efficient without having to deal with automatic signal processing. EDIT: This isn't C5, but I found it interesting and still relevant to the thread. 18677709599.wav Sorry about the automatic gain control. If you're curious what it was outpulsing, it's KP+867-920-3660+(KP2)<pause>KP+0-770-9599-ST. Try pressing 0 when the queue system bumps you to voicemail; you'll wind up at the main auto-attendant, and given the run of the PBX. Also, that PBX appears to have a hundred block dedicated to it.
  33. 1 point
    I believe pc-coholic is still working on it, last I heard he was working on a user interface for the fake Millennium Manager
  34. 1 point
    So some years ago, someone pointed out to me that Tracfone billing is done on the actual phone itself; not the network. So with that in mind, I gave something a try, had some decent luck with it, and figured I'd pass it on. At least on phones using AT&T's UMTS network (though I assume this applies to the CDMA phones too), general call forwarding is blocked as it should be, but call forward unavailable/busy/no answer has to be active for voicemail to properly work. So sure enough, using standard GSM call forward codes, you can send those calls elsewhere, and it won't deduct any minutes on the account. At this point, you can ditch the phone in a suitably shady manner, like sliding it under a vending machine at the airport. One caveat with this is that the AT&T mobile network's toll trunks _suck_ (you may have better luck with some of the other carriers. I'd try Verizon if it's convenient/CDMA turns out to work). Compared to just straight 1+, these trunks are ridden with discomfort noise and latency. If you're willing to deal with this, at the very least, it will not be transcoded like normal cell calls are. I don't know for sure, but both of these may very well be avoidable anyway if you choose to forward to a number local to, or otherwise within range of direct trunks to the mobile switching center you're assigned a number on. Keep that in mind when you give Tracfone your zip code.
  35. 1 point
  36. 1 point
    Welp, I was met with failure tonight. I'm trying to use CDBurnerXP to make burn a bootable cd for the install. Unfortunately, the program doesn't want to convert the .nrg file to ISO for me to boot. I tried a different method in the program to create an ISO disc, but the machine won't boot from it. I know that an .nrg is a Nero file, and before I go spending $50 to buy Nero, I wanted confirmation that I need to burn an ISO disc through that particular program for this to work. Or maybe there's something else I'm doing wrong that I just don't know about... but I'm a successful failure. Any suggestions? EDIT: never mind! I found a free nrg to ISO converter. Then burned the converted ISO to disc and now it’s installing. False alarm!
  37. 1 point
    I dunno. To be honest, I've mostly stopped associating the age of equipment with any sort of relative interest; it's more about uniqueness. Superficially speaking, I guess the DMS-10 and the 4E are the oldest switches in the network when you think about design age. But the hardware has gone through a lot of revisions since it was first put in; a DMS-10 from 1977 isn't going to use PowerPC processors, SDRAM, or DSPs. The trunk cards are bound to be a lot smaller, larger capacity, and all that. One of my current theories is that DMS-10s with an Expanded Network configuration (if I understand correctly, Nortel underwent a project to revise the DMS-10's internal TDM network in the nineties, and significantly expand it's capacity in the process) may generate it's tones in a different way from the classic configuration, so for example the offhook tone won't have that characteristic weird modulation, and the ring will be a bit different. At some point, I'd like to make an up close and personal visit to a phone line served off two switches I know for sure are/aren't using this new configuration; I've seen some DMS-10s do some weird things, like bring you right to reorder if you flash from a payphone (and then to permanent signal if you do it again) that I'd like to compare side by side. Getting back to my point though, there's some stuff like older code (albeit maybe ported to a more recent OS depending on the switch) you're probably never going to get away from, but it's a bit superficial to say a switch is more or less old just because it's a certain model. That's a good question; there's a guy in IRC who was looking into C5 trunking not too long ago. I haven't been making that many international calls recently to be honest. But IRC and the conference are where most of the goings on are these days. At least judging by the regulars we get there, that's partly why the forums have been a bit empty. To be honest, I feel like I've been stretched thin for content at the moment between the rising numbers in the other two and some sudden shifts in real life circumstances. Anyway, I'd be surprised if everybody there wouldn't be down to help you with this. I definitely would be . I'm not exactly sure what you mean by old fashioned here, but I'm going to take a wild guess and throw this your way: ais_xtalk.flac This came as a complete surprise to me calling the Onancock, Virginia 5ESS a while ago. I'm going to go out on a limb here, and guess the recording I'm trying to dial is one you've heard about a million times if you've called any place Verizon hasn't sold off to another company yet. But more importantly, it shows that wherever there's robbed bit trunking, some circuit switches, and a situation where you really don't need more than just a destination and possibly ANI associated with a call, some switch engineer not wanting to chew up STP resources will throw everything up over a trunk with MF. At one point, I talked to someone who worked at a tiny, middle of nowhere telco about this particular scenario. From what he said, it sounds like it's common to reuse older T-carrier equipment occasionally that breaks channels out to 4-wire E&M instead of offering any sort of digital interface. They had some really old Lenkurt carrier system for 911 that did just this. Anyway, at some point, he thought the transmit and receive leads on one of the channels must've shorted. If you're looking to play with trunks, a lot of this stuff is hiding in plain view; for example, I learned from a reliable source that a certain large company's private T-carrier network (hint: it's one with lots of Rolms, and it isn't Macys) uses DTMF for inter-office signaling. I know this is possibly getting away from the premise of being oldschool, but getting back to the whole thing about DMS-10s, someone I know is served out of one from an independent telco. Being the good sport that they are, they were nice enough to let me play with the dialout feature on their APMax voicemail, (why almost literally every independent DMS-10 has one of these boxes, I may never know. Though aside from that ridiculous voice they have, they're not bad) since they noticed it was a bit...off. Sure enough, there's a bunch of six digit codes that terminate straight to a 5ESS tandem - I think an operator service one a long ways away from the switch. Several seven digit codes leave you stuck on a completely different tandem switch - I think for local stuff. Anyway, one of my pseudo-long term projects has been trying to figure out what exactly this is going to, why, and if it can be used to make some odd things happen. I'm optimistic to say the least. I'm not going to tell you the phone network is extremely relevant to every part of everyone's life. With the FCC stuff going on right now (long story short, same culprits as the net neutrality mess, same characteristic 180 on previous policies/ignoring of all objecting input, even from the industry. PM me if you want more info on what's going on/who is challenging the decision; the forum really isn't the place for this), it could potentially be in problematic shape down the road. But what I will say is when you explain what phreaking is all about to anybody in any technical circle - even when you get into tiny dry details, people listen. You wouldn't necessarily know it by the forums, but the community is growing too; I routinely hear new voices on the conference, something we could barely pitch up for two hours with four people when it started. Now we're entering territory where five hours isn't unusual, and it occasionally gets too crowded to get a word in. Here's my personal take on it: as the decade progresses, we've been sliding into a period where the internet is increasingly compulsory for things like work, but also the platform for an increasingly narrow set of companies, an increasingly politicized medium, and increasingly less anonymous. When you tell people there's a worldwide network that's can still be anonymous, as challenging as it is detailed and unique, and free of much of the drama from current events, the ideas behind being an 31337 phr34kz0r start to make some sense. The more creating, the more exploring and above all, the more inspiring that can be done... well, it can't hurt.
  38. 1 point
    7zip (in WINE, makes it basically a Linux program all the same) Firefox GFTP Konsole Konversation Kwrite Open Office ssh Pcmanfm Wireshark (duh) WINSCP (because fuck GFTP and all its 10-year old bugs) VLC I use it as mainly a desktop system, don't have much use for development/programming tools since I'm mainly a hardware hacker. ...and sol.exe (NT 5.1.2600) in WINE, can't live without sol, right?
  39. 1 point
    Thank you Simple Note! For making a native Linux app with markdown you are AWESOME! Good bye Evernote! Your web-app just sucks as do your mobile apps! Here is a hint: functionality over JavaScript blinking and sliding widgets!
  40. 1 point
    No need for an apology at all, these numbers are outside of the general new "Some Numbers" post... Please consider my time on these a personal thank you to the many posts which I have enjoyed... and the fun numbers i've called (my favorite number being the "AM Transmitter" one). This scan gave me a bunch more interesting items than the previous scan... I've bolded the items I found the most interesting (modems are always interesting, so they haven't been bolded). Number Auto-Scan result Manual scan, comments 6309790003 VOICE Unassigned Extension / Unassigned Voicemail? 6309790051 VOICE …. seemed to be an auto-answer extension at the security desk? 6309790395 VOICE Subscriber 6309790752 VOICE Subscriber 6309790766 VOICE I'm pretty sure this is their "telemarketer torture" voicemail. Scared me at first, I was like "I swore I had the mute on here!". [note, I tried again and got a subscriber, so I'd try this one after hours] 6309791120 VOICE Unassigned Extension / Unassigned Voicemail? 6309791616 VOICE IVR providing different numbers to call, then an inband reorder. 6309792000 VOICE Nokia Main IVR 6309792458 VOICE Subscriber 6309792496 VOICE Subscriber 6309793151 VOICE Subscriber (Security Desk!) 6309794040 VOICE Subscriber (Security Desk!) 6309794732 VOICE RNA -> Reorder 6309795550 VOICE Subscriber 6309796216 VOICE Answers, Dials DTMF. If you send DTMF, it seems to dial the same series again. 6309796322 MODEM Modem tones. 6309796487 VOICE Garage Elevator. Wow. This is the most sophisticated elevator phone I've ever encountered. 6309796515 VOICE Subscriber Voicemail 6309796800 VOICE Subscriber (Security Desk!) 6309796945 VOICE Unassigned Extension / Unassigned Voicemail? 6309796946 VOICE Subscriber 6309796947 VOICE Subscriber 6309796948 VOICE Subscriber 6309796950 VOICE Unassigned Extension / Unassigned Voicemail? 6309796951 VOICE Unassigned Extension / Unassigned Voicemail? 6309796952 VOICE Unassigned Extension / Unassigned Voicemail? 6309796953 VOICE Unassigned Extension / Unassigned Voicemail? 6309796954 VOICE Unassigned Extension / Unassigned Voicemail? 6309796957 VOICE Subscriber 6309796959 VOICE Unassigned Extension / Unassigned Voicemail? 6309796960 VOICE Unassigned Extension / Unassigned Voicemail? 6309796961 VOICE Unassigned Extension / Unassigned Voicemail? 6309796962 VOICE Unassigned Extension / Unassigned Voicemail? 6309797079 VOICE Answered, gave euro ringback tone, subscriber answered? 6309797659 VOICE Subscriber 6309797890 VOICE Subscriber 6309797997 VOICE A weird one. Answers, give an 'elevator phone' like ringback, then provides a very odd tone… Seems to wait for something, then hangs up. 6309798335 MODEM Modem tones. 6309798510 VOICE Subscriber Voicemail 6309799038 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799447 VOICE Subscriber 6309799519 MODEM Modem tones. 6309799564 VOICE Subscriber (Security Desk!) 6309799572 VOICE Subscriber (Security Desk!) 6309799608 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799622 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799624 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799627 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799635 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799649 VOICE Seems to answer, dial DTMF, and wait for something…. Also, if you dial in to this same # on another phone, you can hear a 'call waiting' beep from the FAR side… # ends the call. 6309799713 VOICE Answers, Dials DTMF. If you dial back, it seems to dial the same series again.
  41. 1 point
    No dice . Maybe! I wonder if a slow sweep tone or something would be in order. The pause/repeat thing sounds like it may be your long distance carrier changing routes. If you're okay with casual dialing (should be safe; I'd be sure, but I don't think it supes), try seeing if AT&T or MCI do the same. I'd be really disappointed if it was the case, but I was thinking this might just be the Nortel announcement card making that tone; they sometimes end calls with that same (or at least a similar) cause code. 706-219-0002 - Windstream NOC 434-223-6399 - Newer Otis elevator at university, on Meridian. 7200 is a Siemens elevator. 706-865 1112 - Ringout bridge 1113 - rec, "The number you have dialed is a party on your own line. Please hang up and allow the phone to ring several times before lifting the handset to talk." 1117 - Ringout 1118 - Ringout to Meatwitch VMB, Windstream Cleveland CO 1119 - Business 1120 - Ringout to Meatwitch VMB (CNAM: WINDSTREAM) 1121 - Loud, 20 hertz ringing x1 + hang up 1122 - Mitel PBX ringout to Express Messenger VMB, answers with **93604 1123 - Ringout 1124 - Ringout 1125 - Ringout 1126 - Ringout 1127 - Ringout 1128 - Ringout 1129 - Ringout 1130 - Modem 1131 - Ringout 1133 - Ringout 1134 - Ringout 1135 - Ringout 1136 - Ringout 1137 - Ringout to Meatwitch VMS 1138 - Ringout to Meatwitch VMS 1139 - Ringout 1140 - Ringout 1141 - Rings x1, hangs up quickly 1142 - Ringout 1143 - Ringout 1144 - Ringout 1145 - Ringout 1146 - Ringout 1147 - Modem 1148 - Modem 1149 - Ringout 1150 - Ringout 1151 - Ringout 1152 - Ringout 1153 - Ringout 1154 - Ringout 1155 - Ringout 1156 - Modem 1157 - Ringout 1158 - Ringout 1159 - Ringout 1160 - Ringout 1161 - Modem 1162 - Ringout 1163 - Ringout 1164 - Ringout to Meatwitch VMB 1166 - Ringout to Meatwitch VMB 1170 - Ringout 1171 - Ringout to Meatwitch VMB 1180 - Meatwitch VMB 1183 - Meatwitch VMB 1184 - Meatwitch VMB 1186 - Meatwitch VMB 1187 - Ringout 1190 - Really old AIS. Cognitronics? NIS report. 1191 - Same as 1190 1192 - Same as 1190 1193 - Same as 1190 1194 - Same as 1190 1195 - Same as 1190 1196 - Ringout 1197 - Ringout 1198 - Same as 1190
  42. 1 point
    Anybody caught spamming for "dumps", "fullz", "CVV", credit card lists, phone number lists, pay proxies, password lists or anything of that sort, for free or for profit, will meet their creator in /dev/null if they are found anywhere on this site! Such services are not only 100% illegal but they have absolutely nothing to do with hacking. This site is not the place to be advertising for-profit illicit services. If you post these you can expect to have your sorry ass permabanned without discussion. I really hope we're clear on this. Note that this warning does NOT extend to the legitimate research exchange scans/"jans" posted in Old Skool Phreaking. Here is an example of the type of material that will get you in deep shit if you post it here (typos left unedited, for perspective): And if one does get through and they have provided contact information, and I haven't removed the post yet, I encourage everybody able to do so to mailbomb them in the mean time with "hi, hello, how r u, dude, man etc etc etc". Why not, they're wasting our time and disk space, it's your duty to waste theirs. Turnabout is fair play.
  43. 1 point
    Looks like you were right; the number is going to a Singtel not in service announcement now. I guess now is our golden opportunity to try and figure out what it's routing over. The carrier tromboning their way over to what's probably Singapore (actually, does Singtel have any end offices in Malaysia? The C5 circuits were always on specifically Malaysian conference numbers. For whatever it's worth, I tried routing to them explicitly over the Singtel direct service and it never gave me any C5 cheeps) will cycle through several routes before eventually giving up. I guess after Intercall and Genesys merged, the old Genesys stuff was considered redundant. It was always really hard to find conference numbers on this thing. I always chalked it up to non-Americans not feeling the impulse to share everything; US conferences are disproportionately easier to find than, say, Canadian or Mexican ones. But shut down plans probably make more sense.
  44. 1 point
    I think it's all stored in the place you described. There's a PIN if I'm not mistaken, that brings it up to 20 hex bytes right next to the key in question. You'll see that particular set of bytes change every time you change your key. It's less big than you might think . Some people with Avaya PBXes are less than responsible, and put development packages on the internet: ftp://ftp2.veracomp.pl/net/avaya/Software/SES_5_1_2/Releases/rpms/asgtools-1-0.AV10.i386.rpm ftp://ftp2.veracomp.pl/net/avaya/Software/SES_5_1_2/Releases/rpms/asgtools-devel-1-0.AV10.i386.rpm While you can't get the source, you can get some header and object files used for ASG functions in their x86 platforms. They're relatively readable with a trip through a decompiler and some deducing which variables are which ( http://pastebin.com/c6znKRUF ), but more importantly, it shows that the earlier ASG stuff is a one time password algorithm based on DES. At some point - probably in the mid 2000s, they got enough sense in their head to switch to AES. This is important not just because the one time passwords are annoying/used to lock down the switch, but because release 10 and up, where all the really fancy features come into play, want you to upload a license key based on ASG. Yeah, I think the IP media processor won't work without a relatively recent release; ftp://ftp.avaya.com/incoming/Up1cku9/tsoweb/media/minhardwarevintages.pdf . If your release is 7.1 or something though, allegedly you can put this crazy thing in your switch and get IP trunks. Though it's sorta like adding a car to your pool because you don't like getting rained on while you swim. http://www.ebay.com/itm/Avaya-Lucent-Definity-TN802-V2-MAPD-Board-w-8MB-Card-HDD-/391312141904?hash=item5b1c056e50:g:atcAAOSw5VFWOpHM That depends on what you can get to work. You absolutely do need to use that software with a Dialogic card, but they make T1 cards too. I'd be surprised if Avaya didn't put support for that into their software. I think there's something to differentiate between analog and digital interfaces in the software. But then again, I tried it with my Dialogic T1 card and it didn't want to cooperate. Though I think that was probably a good thing in the long run. It wound up being used for...better things. http://thoughtphreaker.omghax.ca/audio/ligatt_megaphone.mp3
  45. 1 point
    rva is pretty straightforward to use; type rva process [whatever process you want to look at. For example, pam] a [address you want to dump. Though it's hex, it doesn't want a preceeding 0x before it] c [number of bytes you want printed out in hex format; for the maximum, 255, you'd tell it FF] The virtual memory addresses we want to look at always start at 0x400000. In the case of release 6, the init password is stored in a couple of places. The first is 0x423487, and since the password data is 12 bytes long, which is the value C in hex, you'd want to type: rva process pam a 423487 c c . There's also another address it's stored at; 0x435537. This one, I think (though I could be wrong. You could definitely try both if you're interested, but you can just log in and change it anyway) is the one it actually checks when you log in. As usual it's C bytes, but wva wants an extra argument; v/value. If you want to write different bytes, you'll have to do it one at a time, like wva process pam a 435537 c 1 v 00. If you want to overwrite everything, you could increase the count, and give it something like wva process pam a 435537 c c v 00 . Anyway, there's also a debugger command that lets you dump RAM. This is best for dumping the whole process. While you can use a script or something to spit everything out with the rva command, it takes a painfully long time to cough out even the smallest things. This, by contrast, should get pam (220 kb) in about ten minutes or so. Not exactly amazing, but it's more what you'd expect from a 9600 baud serial link. So just type, for example, rd -f (number of bytes you want)x pam 0x400000 , and it'll do the rest. The x indicates we want the bytes in hex format, rather than something horrible like octal numbers. The count can be as high as you want; it'll just keep going until the end of the file before throwing an error at the end. Just for the sake of completeness, here's a valid example command: rd -f 2000000x pam 0x400000
  46. 1 point
    At this point, you could probably just log in using the craft account; the password is "y0urthe1". I'm surprised; it actually only took a few hours to figure out. Let me explain how it works; it's actually pretty funny. So go ahead and boot your Definity without a translations card, and we can get started. As before, log in with inads, but this time type 'go tcm'. From here, you'll see a new, and from the looks of it, very, very nifty shell once you've gotten you're switch running with no restrictions. If you type klog, you can see a printout like this; support your local Oryx (Oryx g4.34)$ support your local Pecos$ Boot image vintage: G3V8i.02.0.034.5$ Boot image build information: 03/21/00-21:39:28;gaz;fld;alawint;G3V8.pj$ If you're not familiar with Oryx/Pecos, Oryx is the kernel, and Pecos is a series of processes that runs on top of it. But back to the password thing, if you're looking to do a lot of comprehensive work with the password file on the switch, you should do a full dump of the RAM allocated to the pam process. But that's kind of a big pain in the ass. If you're just looking to get the passwords, the switch actually makes it relatively easy. At the TCM shell, type this; prec pr_login nread_prec 0 And it should come back with something like this; PR_LOGIN 696e 6164 7300 006c 756a 6521 7376 6a2e 'inads luje!svj.' PR_LOGIN 0000 006c 756a 6521 7376 6a2e 0000 0001 ' luje!svj. ' PR_LOGIN 0101 0101 0001 0101 0101 0101 0101 0100 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0100 0000 0000 0000 0101 0101 ' ' PR_LOGIN 0101 0100 0000 b21a 22c3 69b8 786c 0000 ' " i xl ' PR_LOGIN 0000 0000 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff ' ' See? It even gave us a little ASCII printout! Wasn't that nice of it? It'll ask you to press enter a few times before giving you the passwords for all users. So once you've got it, you'll probably notice a few things. For one, there's a lot of exclamations in the password file. Secondly, the dadmin account will probably read something like this; PR_LOGIN 6461 646d 696e 0021 214b 5621 5953 2121 'dadmin !!KV!YS!!' PR_LOGIN 2121 2121 214b 5621 5953 2121 2121 2101 '!!!!!KV!YS!!!!! ' PR_LOGIN 0101 0101 0101 0101 0101 0101 0101 0100 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0200 0000 0000 0000 0201 0101 ' ' PR_LOGIN 0101 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff ' ' So why so many exclamation points? The exclamation point is a null character as far as the passwords are concerned. The byte I highlighted in bold is the one responsible for the user ID. So I'm going to change the password for craft from crftpw to crftpw1 and re-run the TCM shell command. There's a byte you can change in the RAM to make it force you to change your password. It's good in a situation like this where the switch won't let you change your password normally. It's sort of a pain in the ass to find, but let me know if you want me to point it out. Anyway, you'll notice the first two lines just changed to this; PR_LOGIN 6372 6166 7400 006c 7577 7231 636e 2121 'craft luwr1cn!!' <-- crftpw1 PR_LOGIN 2121 216c 7577 7221 636e 2121 2121 0001 '!!!luwr!cn!!!! ' <-- note old password stays the same (crftpw) This would be a good time to mention the Definity has two copies of your password, as you've no doubt noticed. But the old one stayed the same in this case, as far as I can tell, to enforce the password policy. Namely so that when your password expires, you can't just change it back to the old one. So what changed? Just one character - the 1 at the end. And sure enough, one of the null characters changed to a 1. Obviously though, it's not just as simple as scrambled characters. So next, let's change the password to aaaaaa1. PR_LOGIN 6372 6166 7400 007a 7a7a 7a31 7a7a 2121 'craft zzzz1zz!!' <-- aaaaaa1 PR_LOGIN 2121 216c 6977 7237 636e 2121 2121 2101 '!!!liwr7cn!!!!! ' <- crftpx2; I did a little trial and error before doing this. Notice the position of the 1 stayed the same. So at this point, it's obvious they're just substituting one letter (or number) for another. I'll save you some time here, and just say since a translates to z, b is x, c is c, d = v, e = b, and f = n. So with that in mind, let's figure out how this stupid byte swapping trick they're doing works. 5624713 efbd6ac PR_LOGIN 6372 6166 7400 0062 6e78 7639 7a63 2121 'craft bnxv9zc!!' <-- abcdef6 PR_LOGIN 2121 216e 6e6e 6e39 6e6e 2121 2121 2101 '!!!nnnn9nn!!!!! ' So there you go. First is the fifth password character, then the sixth, second, etcetera. Cute. So when encoding... a = z, b = x, c = c, d = v, e = b, f = n, g = m, h = a, i = s, j = d, k = f, l = g, m = h, n = j, o = k, p = l, q = q, r = w, s = e, t = r, u = t, v = y, w = u, x = i, y = o, z = p, 1 = 1, 2 = 7, 3 = 2, 4 = 8, 5 = 3, 6 = 9, 7 = 4, 8 = 0, 9 = 5, 0 = 6 For uppercase characters, the same concept applies; A= Z, B = X, and so on. So here's something I've been waiting to see for a long time. Let's pull up the record for the init password. PR_LOGIN 696e 6974 0000 0065 3132 3265 6a68 2121 'init e122ejh!!' PR_LOGIN 2121 2165 3132 3265 6a68 2121 2121 2101 '!!!e122ejh!!!!! ' PR_LOGIN 0101 0101 0101 0101 0101 0101 0101 0100 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0000 0000 ' ' PR_LOGIN 0000 0000 0000 0000 0000 0000 0001 0101 ' ' PR_LOGIN 0101 0100 0000 7de9 d15e 9ce8 a068 0001 ' } ^ h ' PR_LOGIN 0000 041b 0000 000c 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff 0000 0000 0000 0000 ffff ffff ' ' PR_LOGIN ffff ffff ' ' Using the concept we just talked about, we can infer that the default init password is n3m3s1s. So just to check, I changed the craft password to n3m3s1s; PR_LOGIN 6372 6166 7400 0065 3132 3265 6a68 2121 'craft e122ejh!!' <-- n3m3s1s; same as init password. Lulz. PR_LOGIN 2121 2143 5670 5836 6f5a 2121 2121 2101 '!!!CVpX6oZ!!!!! ' Can you say insecure? The Definity can! Or as it'd say, ctjbwse12b2! . If you'd care to learn the order of the remaining bytes (that's the maximum length of 11 characters), that's "insecure133". EDIT: I talked with Chronomex earlier, and she pointed out that the characters map to the keys on a Qwerty keyboard backwards. Somehow Nortel got the idea this substitution cipher/byte swapping thing was a good idea too, so you'll see the something like it on Meridians. There's actually an NES game that did a better job at this. https://www.reddit.com/r/TreasureMaster/comments/9iyaf/we_have_our_first_breakthrough_courtesy_rj45_and/
  47. 1 point
    What... the... hell...     Very bizarre... Seems to 'scan' for conversations, because I heard a few different rings before it locked into something.   Also seems like an international sort of company?    http://www.npanxxsource.com reports the whole 4xxx block as being established in early 2014, as part of Bandwidth.com, so it's some sort of virtual... Conference? PBX? Not sure. But interesting nonetheless!
  48. 1 point
    One thing I've taken to doing is using a Dialogic program I made to take my calls. One of the great advantages, aside from having a copy of the message you can stick anywhere, is getting real uLaw. Makes it nice for situations where you're at a distant phone, and want to record something unique on three-way. Last I checked, the Panasonic machines used some sort of CELP and some of the cheaper ones go as far as using some sort of vocoderized thing like AMBE. Recently, I've been debating whether I have the time/willpower to turn it into something that does a George routine like in the Evan Doorbell recordings. Sometimes I'll change it up though, and have my calls go out to a Laser voicemail box. A while ago, I heard on good authority that the system runs on not one, but two Windows 95 machines. Woo cloud!
  49. 1 point
    Kinda bizarre one I found on my old college's exchange... Tried the "add one to the MW test" trick. 216-397-0833 - This starts out with one ring, then a single run of the standard "number disconnected" recording. It then goes to reorder... Which trips after about a half-second into a standard ring, a total of 5 of them. At that point, the line sounds like it supes, then nothing but silence (with faint background hiss) for about 45 seconds before going to reorder again. I didn't try talking on it or anything of the sort because my little guy and wife were around. Migth be worth a revisit.
  50. 1 point
    Bear in mind that a lot of area codes, mine included, are in the form of 01xxx xxxxxx, or in some places (one in my area code for example) 01xxx xxxxx. the 01xxx xxxxxx is something like 999999 numbers, but 0xxxxx and 1xxxxx are probably reserved because service codes exist on it. In my area, 5xxxx 6xxxx 7xxxx are the local town, 8xxxxx are the outlying villages, the town again, and VOIP, 9xxxxx doesn't exist because of 999. I doubt you could dial into a switch nowadays, (there are probably people who could prove me wrong on this, Fone Ranger probably), as BT would have them connected to some internal network not accessible by the PSTN where they can configure their switches. Engineers could use a GSM/GPRS card in a laptop whereby they could access BT's network and configure that way if they needed to (again, I don't know enough about the BT network today to tell you fact). There was a page detailing the BT network from phone to exchange, and BT wholesale has a good section on how its PSTN, ADSL, SDSL networks operate.