• Content count

  • Joined

  • Last visited

  • Days Won


ThoughtPhreaker last won the day on June 20

ThoughtPhreaker had the most liked content!

Community Reputation

111 Expert


About ThoughtPhreaker

  • Rank
    Dangerous free thinker
  • Birthday 11/02/1991

Profile Information

  • Gender

Contact Methods

  • Website URL
  • ICQ

Recent Profile Visitors

30,011 profile views
  1. My point was though, you always get 602-9L from that switch no matter what you're using; if you call the number over Sprint or MCI out of DC, you'll get that. Presumably the office is just spitting the call out on the first AT&T toll trunk it can grab, but for it to be homing on a switch on the other side of the country is just so weird. Speaking of MCI, though, 248-270-9999 - *57 fail recording via MCI local switch. It has the same voice (and hum) as the error recordings on their DMS-250s. It sounds weird, hearing her say that after so many years of that generic CBCAD. 404-592-9998 - Another week, another Global Crossing DMS-500 dialtone
  2. So I've been messing around with some of the CBS PBXes (and centrexes) in the Los Angeles and New York areas. That's for the most part, a subject for another post. But I called the Los Angeles PBX, and sure enough, it's a Definity. 323-575-2xxx if you'd like to drop in on it. Surprisingly though, they had some kind of third party voicemail system. It's definitely some sort of Dialogic-based system (you can tell by the sound of the voicemail beep; up until the very latest software releases, that was a hardcoded sample), and from the sound of it, a bit on the old side. But then as it started reading back digits, something about them seemed a little familiar. numbers_station_vmcount.wav So as a curiosity, I pulled up a recording of the numbers station in Virginia. If you want to cut right to the chase, it starts counting sequentially around 25 seconds in. Sound familiar? If you ignore the dynamic range compression, they're only off by a hair from the originals. Not the same recording (though the seven and nine make me wonder), but I'd be willing to bet money they're the same person. This would make for a really good hoax. You could probably doctor the voicemail takes (and I might do that, actually. At first look, it seems like just a few minor corrections) to match the ones from the shortwave station exactly. So does anybody know what voicemail system this is, or when it was made? From what I understand, the numbers station thing was gradually phased in starting in 1987. For it to be using the same voiceover talent, the VMS would probably have to be developed around the same time period.
  3. I have to be honest - this was sort of a frustrating experience for me. There were big plans for that switch, and I'd set up almost everything to get some rather detailed recordings and a massive wardial underway; I understand people are busy, but I couldn't do it alone, so I tried to make it as much of a "hit start when ready" situation as possible. So I asked a few people about it. They seemed down with the idea, but they'd be busy for a few days. A week went by. They seemed a bit swamped with personal matters, so while I waited for them, I asked a few other people if they'd like to get things going. Things seemed like they were on the right track, but then we hit a snag, so we'd have to call it another night. Another week passed. At the tail end of it, sure enough, boom - no more 1AESS. I spoke to someone else with an affinity for 1As about four months before; we knew this was going to be it, so I gave them an easy means to make some rather unique recordings of the switch. A few messages later, it became apparent they didn't record anything. And so what can I say? Maybe there's something I'm missing here. Maybe I'm just pushing the more boring side of stuff, and most people are just too polite to say no. But the bottom line is I'd really, really like it if people just showed some more initiative. By all means, if you need some help, that's part of why this forum is here. But as someone who's had to juggle full time schooling, part time work, and three hours on the bus every weekday for a year and still found time to carve out, just please don't tell yourself you're too busy.
  4. 206-345-7420 - Weird thingie on analog line, picks up and waits for DTMF 941-349-9929 - GTD-5 dialtone of some sort
  5. NTS

    Hee, oh yeah! These guys! I've stumbled upon a few of their sex lines. I know COCOT operators are sleazy, but they don't strike me as the same kind. COCOT operators seem more like the "creepy guy who runs a combination pawn shop/locksmith store/private investigation firm" sort of sleazy. Maybe throw in a bunch of chest hair and gold medallions for good measure. . There's another NTS in Texas that runs as a CLEC with a combination of 5ESSes and Meatwitches. If you ever feel like trying your luck with them (I never had much), I think they hide at least some of their interesting numbers in 01xx. Also, their not in service recording is mildly amusing. . Long story short though, I kinda doubt they're the same company. EDIT: It looks like the NTS payphone company survived until at least the tail end of the eighties:
  6. It seems like everyone ends up with a story just like this . I really, really wish people would just suck it up, read the "Emergencies - Dial 9+911" printed on every hotel phone ever, and that would just be the end of it.
  7. Are you sure you're not thinking of the test codes on a toll switch? I tried this from a few places, but it never worked.
  8. Yup. There's an account of several people using it in the book Exploding the Phone. Some of the older phreaks like Joybubbles also personally talked about using trunks like these before. The modern TSPS equivalent, TOPS, still has - or at least had when interrupt service was available, a trunk group that works just like it. Given the general inaccessibility of tandem exchanges, they're pretty much under lock and key, though. The incorporation of release guard (the thing that stops you from hanging up on an operator) into the trunk definitely invites the possibility that you could fool the switch into letting you on there while it's waiting for digits, though. As well, a lot of DMS family switches (like TOPS) have a very easily provisioned function that allows a user to get a dialtone from the switch remotely. Because of this ease, they tend to be assigned by operating companies quite frequently, especially when testing special dialplans for use in things like centrex. More to the point though, either would probably be a valid way of gaining access. There's other ways of doing this, though. In the early nineties, some people discovered a bug in the 5ESS. It's probably long since fixed, but some people with switch access would occasionally create a directory number that went to notest (basically, a function that let you monitor subscribers. Y'know, for...testing), and forwarded it to their victim.
  9. Here's a short recording from the electromechanical switches at the Seattle Museum of Communications. In retrospect, I could've done a way better job at this; as you might pick up from what I chose to call, I was a little overwhelmed by all the variety, and couldn't really make up my mind about what to record. It ended up being a little scattered. That being said however, I was using a completely new patch circuit to make these recordings; it was the second time I'd ever used it, and certainly the first time I'd ever stuck my recorder on an electromechanical switch. This is the one thing I did account for; usually when I record stuff, loud clicks, like a battery drop are extremely loud - enough so that it'll cause clipping unless you set your levels really, really low. Normally this isn't a big issue since that's basically the only click you'll ever get locally from the modern network. That's something I really didn't want on this recording though, so I added a couple of DC filtering caps and current limiting diodes. Thanks to that, I got a far cleaner recording of a lot of things than I probably would've otherwise. So one thing you'll probably notice right away is I don't have any (interesting) recordings of the panel switch. The reason for that is simple: a lot of the phones in the museum are from the period the switch was made. For example, you have lots of candlestick-era phones on the Panel, 302 sets on the Crossbar 1 and so forth. This is a great aesthetic choice, but unfortunately, it also means not only are there no modular jacks, a lot of these phones don't have varistors in the earpieces either. This is the thing in the earpiece that makes really loud, sudden noises (like a battery drop or a cut-through click) stick to a reasonable volume. When they're not on a phone, I can't stress enough that you do *not* want your ear near it when something clicks. Needless to say, I felt bad - the panel switch is the pride and joy of some of the volunteers, but there wasn't anything I could use to call from it. Finally, I'm flashing everything by hand here. This is because the best place to record was from a 1A2 key phone with lines from all the different switches in the museum (except the panel), but for whatever reason, the voltage dipped too low by the time it hit the DTMF IC to power it. For that reason, well, I don't dial a lot of numbers with zeroes in them. This is probably just as well for the step switch; it has tone to pulse converters, but they cut back too late to let you hear the cut-in noises. That being said, if you ever go, it's really easy to underestimate the step switch in a big room filled with some seriously incredible switching equipment. But don't. If you familiarize yourself with all the noises they make when they cut in and such from the Evan Doorbell recordings, it becomes clear that everything is laid out nice and neatly on the switch like an open FTP directory or a PBX; not a whole lot of things can be hidden. Also, much like in the recordings, a short flash can reset a trunk instead of hang up on a call. Anyway, enough crap. Here's a list of calls on the recording: Call 1: Crossbar 5 - 844-1111 (time, on panel) Call 2: Step - 844-1111 (time, on panel) Call 3: Crossbar 1 - 232-0027 (line on Crossbar 5) Call 4: Crossbar 1 - 232-8811 (vacant number on Crossbar 5) Call 5: Crossbar 1 - Permanent signal trunk, resets back to dialtone Call 6: Crossbar 5 - 231-1111 (vacant code; crybaby tone) Call 7: Step - 232-9911 (3-slot payphone on crossbar 5. I answer and screw around for a bit. Notice after I hang up, the trunk never releases) Call 8: CX-100 - 9 (it ignores this) Call 9: CX-100 - 1,1 (it ignores this too) Call 10: CX-100 - 0 (the switch tries to pick up a line from the crossbar 1, but it was disconnected. This was fixed later, but I never recorded it) Call 11: Step - 7,845-2 (the seven level of the first selector is vacant. The step drops me back to dialtone, I dial 845-2 and get a reorder from it) Call 12: Step - 1-22 (the 1 is absorbed on the first selector. Notice the dialtone comes back under the pulses of the next digit. The next 2 gets a reorder) Call 13: Step - 1-231-11 (the first 1 is absorbed like before. I have some trouble with the button messing around with the sound. After 23, the step cuts into a trunk to presumably the crossbar 5, and it makes a strange sound. After the next few digits, I abandon the call; 231 is vacant and I misdialed. Call 14: Crossbar 5 - 311 (it waits for me to finish before deciding I belong on the crybaby. It wasn't working when I made this) Call 15: Crossbar 5 - 232-9314 (intraoffice call to a ringing number. This was right before everyone left; normally, intra-office sounds as great as all the rest. Chronomex turns off all the switches after the second ring) museumcalls.flac
  10. Hmm, what tandem do you home on? I tried 303-959-1020 from the Denver DMS, and I just got the not in service recording.
  11. So I've been doing a lot of traveling recently, and found something a bit interesting. From most US West 5ESSes, if you're in, say, the 206 area code and you dial 206-959-anything, your switch will give you a vacant number recording. Just 959-xxxx normally sends you to CBCAD. This didn't really raise my eyebrows too much (I haven't found anything yet. I'm looking though, and encourage everybody else to) until i tried the same thing from a DMS-100 in Denver. From there, it spits you out onto a recording from the tandem switch (DNVRCOMA03T - the trailer code even says 03T). My guess is the rest probably just fire back a cause code saying the number is vacant, but it still gives a good idea of what might be lurking in that prefix.
  12. Wow. Well, that was a surprise. Augusta and Lafayette Main are both gone. Odessa, however, lives on. I had my bets on Augusta being the last. Why this is I have no idea, but get it while it's hot. It was supposed to be cut over a few months ago.
  13. 206-723-0045 - Modem 0046,0047 - DATU 206-721-0008 - rec, "The number you have called is temporarily out of service and has been referred to US West Communications repair. Thank you for your patience. Please try your call later." 206-727-0066 - rec, "We're sorry, due to Pacific Northwest Bell network difficulties, all circuits are busy now. Please try your call again later."
  14. This might be the last time I get to hear a US West TOPS switch hassling me for money, so I thought I might record it. I didn't have a pickup coil with me at the time - still don't actually, I should probably find my way to one. But anyway, sorry about the automatic gain control. Next time I do this, I'm going to use something a little cleaner. All I had at the time was my Dialogic box, though. In case you were wondering, this switch is indeed the sort of thing you can redbox, but it typically doesn't ask you for money retroactively. It's doing this (it actually never cut me off if you're wondering; I sat there for like twenty minutes. The tops_2.wav stuff is the last thing it said) because Qwest doesn't use TOPS for operator services anymore. It's not programmed to automatically cut you off and there's no person it can call to intervene, so, well, it just lets the call go on forever. And probably raised an alarm on the console. I've never heard it myself, but the TOPS manual says it can actually get pretty aggressive; it'll call you back to try and get you to pay if you let it. I was really disappointed when it didn't. If you listen to the way it says "past", you can hear this subtle looping sound on the end of the T syllable. This is a characteristic thing the Nortel EDRAM card does - the closest we'll get to proof here that the tandem is a DMS. Funny enough, we actually do have the original files the switch is playing back; it's some form of 32k ADPCM. It's all in some sort of strange container format that nobody could ever figure out, though. If you'd like to try your luck with it though, this is the archive with all the stock EDRAM stuff. eacts0ae.bin44 has all the ACTS stuff in it: . I'll post a manual for the card at some point. The .bin44 extension implies that it's binary as per usual, but the 44 after indicates the logical record length of the file is, well, 44 bytes. tops_1.wav tops_2.wav
  15. That's a fair example of where this sort of thing might make sense. For whatever it's worth, I made a program for my Dialogic box to three-way stuff in when I was living in the hotel. It's been a huge help for places where toll calls cost actual money, but as sort of a compromise like the one you describe, I made a command that makes it increment the destination by 100 numbers, hang up on the existing call, and three-way the next number in. Like for example, 432-332-0000, 0100, 0200, etcetera. It'll be a few days before I'm home. Lemme know if you want to use it for investigating the 1AESS. Also, fuck Texas/Georgia and their confusing test numbers .