// Exchange Scanning // // by decoder // // http://www.oldskoolphreak.com August 7th, 2003 This is not a complete guide to exchange scanning. There are plenty of files on the topic of scanning the full 10,000 block. I will be focusing on the 'test' areas, most commonly found on the 'high end' (99xx) and 'low end'(00xx) of an exchange, as well as 'special' exchanges. This should be a useful guide for the beginner, but also interesting and informative for even the most seasoned phreak. Note: Many people say that the telco has equipment in every central office to detect sequential dialing and excessive calls to toll- free numbers. I do all of my scanning from home, by hand. I encourage everyone to use their own discretion. Introduction. ------------- I happen to live in New York, where exchange scanning is pretty easy. All of the test numbers can usually be found without too much time and effort, which is good because I am lazy. My regional calling area consists of the following NPA's: 212 Manhattan 917 originally NYC wireless, now also includes land lines in Manhattan 646 new Manhattan land lines and wireless 718 Brooklyn, Queens, the Bronx and Staten Island 347 overlap for 718 516 Nassau County (Long Island) 631 Suffolk County (Long Island) *(home of 2600) 914 Westchester County *(where the X-Men are from) 845 Rockland & Putnam Counties (and the southern part of Orange County) 203 Greenwich & Byram Connecticut *[phreak phact: three of these NPA's (212, 914, & 203) are original area codes from 1947. back then, customers didn't use the area codes, they were only for operators.] The most commonly know test number in these area codes is the 'verification' number, which can be found on (NPA)NXX-9901. Keep in mind that this format only applies to Verizon owned, land-line exchanges. (although there are a few exceptions) These verification numbers give you the location of the central office, and usually list most of the exchanges handled by that particular c.o. Many people know of the 'Elvis' verification number (718 238-9901). If you've never heard it, give it a call, it's always good for a laugh. There is also a verification number that lists an exchange that begins with a one (914 375-9901), which is apparently some kind of 'inward' exchange. (when you call it, the first exchange listed is 146!) Most of these recordings are pretty old so some exchanges listed may not work anymore and, of course there are some new ones as well. Sometimes, in places where there has been an area code change, the verification message will still give the old one. When the exchanges are listed in non-sequential order, the first ones listed are usually the oldest. This is what should be of interest. I have noticed that in my area that the oldest exchanges in a c.o. are where you will find most of the test messages, tones, payphone recordings, DATU's, etc. In New York, these are found in the 'high end' (99xx) of an exchange, although sometimes they hide the good stuff. There is a list of DATU's in NPA 718 making its way around the net, and they are not located in the 'high end', they're all on random numbers. The list has been out for a while and all of the numbers and codes still work. (most codes in 718 are NOT default, but the codes are kind of simple anyway) This information originated on the PLA (phonelosers) forums, and was posted by an ex-employee of Verizon. But finding a DATU shouldn't be the main objective of exchange scanning. There are many other cool things you can find. Other areas. ------------ New York isn't the only place where the test numbers are in the 'high end' of the exchange. Michigan, D.C., Maryland and many other places work the same way. There are also areas where you should scan the 'low end'(00xx). This seems to be the format in California and Pennsylvania. In Illinois, a good place to look is in 12xx, and I've even found an exchange in Texas where the tests are in 31xx. Although the 'high end' and 'low end' are the most common, don't hesitate to check other sections. If you find a 1000 hz. tone on NXX-6715, then scan out 67xx. If you want to know all the exchanges in your central office, I'm sure that there are websites where you can find such information. If you can't find one, read a file on how to use a search engine. Sometimes you can just open up your local phone book, and if you're lucky, the information will be in there. One trick I use to find out which exchanges are the oldest is to check what the Government numbers are. (police station, court house, library, etc.) It stands to reason that these places will have their numbers on the oldest exchange. After all, the police station has obviously been there for a while, and I'm sure they wouldn't ever need to change their phone number. If you live in a small town and your central office only has one or two exchanges, then you don't have much work to do at all. The Scan. --------- I was inspired to do this scan when reading an old text file on exchange scanning. (it can be found in 'BIOC's Guide to Basic Telecommunications vol. one', as well as many other places) First of all, the area code has changed since the file was written.(1980's?) Also, some of the numbers worked, but most didn't, so I decided to scan the 100 numbers myself. I found that a few of the original recordings were still there, but on different numbers. I also found a few other cool things, so here is the updated and expanded version of that old text-file. (find the old scan, you'll see it's not much different than mine) This should prove that 15 or 20 year old text files are still worth reading, not only to know your history, but they can also be semi-useful. The old skool is alive and well. 1(845)268-99xx: 9901 welcome to the Congers DMS-100 central office, using codes 268, 267, 261 and 979. (261 and 979 don't seem to work anymore) 9903 rings once, then plays six DTMF tones 9909 we're sorry, your call did not go through. will you please hang up and try your call again? this is a recording. (repeats, then rings again...) please hang up and try your call again. if you need assistance, dial your operator. please hang up now. this is a recording. *this is the most common recording on this number, but if you call it a few times, you'll get a few different things. try it out. 9910 DATU (default user code) 9911 DATU (default user code) 9922 excuse me, please deposit five cents for the next two minutes or your call will be terminated. this is a recording. 9926 (914) 268, 267, 261 Congers DMS-100 verification. (also will play the message on 9901 sometimes) *note the old NPA 9933 {sit tones} we're sorry, the long distance company access code you dialed must be preceded by the digits 950. please hang up and try your call again. (I don't think they even use 950 anymore) 9940 {sit tones} we're sorry. private calls are not accepted by this number. to complete your call, hang up, pick up again, dial *82 or on rotary phones 1182, then dial the number. if call id or call id with name are in use, your name and number may be displayed. this message is free. (this one was very informative. I'm surprised that they didn't tell me which end of the phone I should speak into) 9947 {sit tones} we're sorry, you call cannot be completed as dialed. please check the number and dial again, or call your operator to help you. (also plays a similar message in a different voice) 9960 loud tone (1000? hz.) 9963 loud tone (1000? hz.) 9967 rings once, then silence 9977 {sit tones} we're sorry, your call cannot be completed as dialed from the phone you are using. please read the instruction card and dial again. 9978 the call you have made requires a coin deposit. check the instructions on the payphone for the appropriate rate, and dial your call again. 9999 rings, then low hum (weird) Comments. --------- Now lets see what I've found. Two different verification numbers, a number that plays DTMF tones, a few of payphone recordings, some old error messages, tones, and two DATU's. Don't ask me why there are two DATU's, I'm assuming that they don't do anything different. I usually find twice as many test recordings in a New York 'high end' scan, but that old 'call id' message was something I haven't encountered before. Even when you don't find much, you find something. All numbers not listed either ring out, are a fast busy, or play the regular disconnect message. (we're sorry,...268-99xx has been disconnected or is no longer in service...) I usually do my scans at night, well after business hours, but I have reason to believe that 9900 is the direct number to the central office. Sometimes when I scan during the day, someone will answer at 9900 and say the name of the central office (as in where it is located, 268=Congers, NY) I've only encountered this a few times. I never talked to them because I'm usually about to scan out the next 99 numbers, and I'm not looking for trouble. Maybe one day when I'm bored, I'll try to social them. Special Exchanges. ------------------ Most of the time, numbers such as the ANAC, time and weather, ringback and various other things are kept on special exchanges. Almost all special exchanges can only be reached from that particular area, except for time and weather numbers, which can usually be reached from anywhere. In New York, 958-xxxx and 990-xxxx are ANAC's and 660+ your 7-digit phone number is the ringback. In New Jersey, the ringback is 550. Many states use 200 for the ANAC, from what I have heard. In California, you can get the time by dialing 767-xxxx (which most people call 'popcorn', 767-2676 spells popcorn), or 853-xxxx. The 767 exchange is used in Northern California NPA's, and the 853 is for Southern Cali. There are a lot of places, like Boston and D.C., that still use 936 for time and weather. 976, 540, and 550 are also special exchanges, but they are all premium pay services, kind of like 900 numbers, so I wouldn't suggest scanning them unless you are beige boxing. You're probably not going to find anything that interesting, but you never know. The time and weather numbers in NY are on the 976 exchange, so If I want to know the current weather conditions, it'll cost me 99 cents. What a bargain! There is also the little known 959 exchange, which is very different from other special exchanges. It is owned by AT&T, and it is accessible from almost any area code. (except NY for some reason) If you get lucky, you might hear things like test messages and different tones, just like you would when scanning the high and low end of any other exchange. Try common numbers such as 1000, 1111, 1234, etc. Sometimes the test numbers will be different in different area codes and sometimes they're the same. I think that 959-1000 is the same everywhere. Because these are AT&T's numbers, they can only be reached through AT&T. The way to do this is to use AT&T's dial-around, 10-10-288. (another one is 10-16-111, which also works the same for op-diverting, by the way) Simply dial 10-10-288+ 1(NPA)959-xxxx. You will not be charged for this call because it is a test exchange. I can personally attest to the fact that it is free, but I can also personally attest to the fact that AT&T might get pissed off if you do it too much because they blocked my use of 10-10-288. Don't feel too bad for me. I can still use 10-10-288-0 to op-divert to toll-free numbers, I just can't use it to make long distance calls or to call 959 numbers. Oh well. Conclusion. ----------- Exchange scanning is fun and most of the time, it's free! The telco doesn't charge you when you reach an error message, so you can call these numbers from a payphone without paying for it. If you're scanning your exchange from home, then it's either free or just the price of a local call,(if you get the odd business or residence here and there). I do strongly suggest getting an unlimited long distance plan so you can scan exchanges all over the country. (not to mention call up all the 'l33t phreaker confs) It's always cool to be able to tell your friend who lives 1000 miles from you what his DATU and ANAC numbers are. Appendix. --------- I was planning on adding a few scans to this file, but I thought it would be a better idea to give people the chance to do some scanning for themselves. To give you guys a starting point, I've added some numbers from scans I have done in the past. If you take a look around in these exchanges, you will find many interesting things. (313)849-9906 due to weather conditions, all Ameritech circuits are busy. please try your call again later. (313)324-9901 you have reached AT&T local services. DT RT MI BA DS0 (570)387-0000 thank you for calling Bell Atlantic. due to an emergency condition, we are operating with a reduced staff, and if you stay on the line you may experience a delay. you may find it more convenient to call us back at another time for assistance. (570)387-0083 DATU (default codes) *(this one has a different voice, so far it's the only one I have found like it) (202)965-9970 you have just de-activated this feature (916)440-0017 we're sorry, your service has been interrupted. for fire, medical and police emergencies, dial 911. to discuss your account, please contact you local service provider. thank you. (916)440-0031 {sit tones) we're sorry. due to telephone company facility trouble, your call cannot be completed at this time. will you try your call again later. (212)967-9999 this is a test announcement. this is a test announcement for use at anytime in emergency cases. thank you. (this will also play a citibank message sometimes) (646)674-9901 you have reached Bell Atlantic office of west 36th st., serving codes (646)674, (212)594, (917) 339. (914)345-9935 excuse me, please deposit 5 cents for the next two minutes or your call will be terminated. thank you for using Nynex. this is a recording. (415)499-0091 DATU (default user code) (618)654-1206 ANAC (this can be reached from anywhere, but it only reads back your 7-digit number) (409)724-3137 {sit tones} the call you have made requires an initial deposit. please hang up momentarily, listen for dialtone, deposit the amount specified on the instruction card, and dial your call again. (215)979-0045 (AT 629) welcome to the ATX long distance network. please contact customer service at 1(800)220-4900 to activate service. (215)979-0028 -(hold music)- thank you for calling Bell Atlantic. all of our lines are busy right now, but your call is important to us. please hold on, our next available representative will be with you shortly. -(more horrible hold music with singing!)-