

Table Of Content (TOC)

Intro into issue 3..........................................................By ic0n
Phreak Christmas Song................................................By Strom Carlson
Test Prefixes/Exchanges..............................................By PhreakBlaze
HCO TTY calls.............................................................By Captain_B
How to get UNLIMITED airtime on Tracfone 5125.............By DSS4Free
Private    Branch    Exchange........................................By Fu5|0N 
Scan of 1-888-819-00XX................................................By Mr. Poop
Exchange Scanning Part Two.......................................By Decoder

Intro:

12/31/03

	Yo whatup fellow phreaks and geeks. It's that time for yet another issue of 
    phr33k4z0iD'z. There's been quite a bit of things going on in the phreak world. 1st
    most if all of you know that Phreaks and Geeks losted our hosting over at HHC    
    (hackerhost) Since then i've recived the hook up on hosting and got a domain     
    phreaksandgeeks dot com I've also started working on a few things that have been
    ongoing for te past few months. Hopefully i'll have a nice amont of info for the next 
    issue of the zine. Alot of people who reading this are members of the forums over at 
    binrev dot com If your not i suggest that you check them out. I've also decided that 
    people whom help with the zine will get a  at phreaksandgeeks dot com e-mail address.
    Anyways Lets get onto the zine!

 A Little Phreak Christmas. 
 By: Strom Carlson
 url: http://www.stromcarlson.com/

   To melody of jingle bells 

 Standing at the phone
 On an SF carrier trunk
 Through the switch we go
 Waiting for "cheep-clunk"

 It's a thirteen button box
 Made of parts from Radio Shack
 Oh what joy it is to hear
 A 4A crossbar stack!

 Oh, jingle box
 jingle box
 whistle off the trunk
 KP-099-212-660-ST clunk clunk!
 The number you have reached
 Is not in service at ths time.
 We're sorry, this is a recording, 212-39. 



    Test Prefixes/Exchanges
     BY: PhreakBlaze



Introduction:

 Co codes, or nxx codes, are speacial exchnages or other 7 (or 3) digit numbers
for the maintnance of trunks. Most of them are not to be asigned by NANPA for
usage. They are to be saved for a central office to use as a test/special
codes/exchanges. These numbers differ from CO to CO. 



What number's are Codes (usually)???:

 Most co numbers/NXX codes are universal but with difrent uses. Some are dialed
useing 10 digit dialing (NPA-NXX-XXXX), 7 digit dialing (NXX-XXXX), and even 3
digit dialing (NXX). I've also heard of dialing (NPA-0XX-958), but I'm not sure
what to do there. The comon numbers are all N11 codes, 990, 959, 958, 950, 555,
976, 700, and then some only used in your area. 



What are the numbers for???: 

Well, all the number's purposes differ from co to co (exept for certian numbers,
I'll discuss later). Wait, actually, the N11 codes, they usually don't change.
They are usually supposed to be asigned as:


 211  Community Information and Referral Services
 311  Non-Emergency Police and Other Governmental Services
 411  Local Directory Assistance
 511  Travel Information Services
 611 Repair Service
 711  Telecommunications Relay Service (TRS)
 811  Business Office
 911  Emergency
 (Note- They are not suposed to be asigned by the NANPA, but instead the FCC.)

  But this is not always true, the only ones I've seen constant are 911 (duh!),
711, and 411. (Note- Recently in my area, when I dial 611, it says that the
repair service in no longer available from that number, and must be reached from
an 800 number.) The only ones that have a constant use are 700, and 976. The
only way to dial 700 is (NPA-700-4141) and thats the only number in that whole
range. (Note- 700 is the only one that can be asigned as a NPA by the NANPA.)
Then 976 is used as pay services (they usually cost 1 dollar for a call to a
service, but if you want to know the services in there, then just dial a wrong
number, and a recording should tell you which numbers do what). The rest do
stuff.


Your ANAC, Ringback, and NXX test numbers (and you):

 One of the things that these codes are almost always used for is the ringback
and ANAC for your co/area/region (in my case, state wide). In the Garden State
(New Jersey, DUH!!!) The ring back and Anac are the same for the whole state. My
RingBack and my Anac are 550-xxxx(ringback), and 958(ANAC). Now, incase you
didn't notice, my ring back is not one of the common codes, it is for this
area/region only. Now as most of us know, these codes are free when dialed from
a payphone, as are 990, 555, 959, 950, and all N11, but not 700, and 976. Now
the numbers that serve as a ringback and ANAC differ from place to place
(Note-place is a general term, place could be state, town, or even CO). I've
even seen ring backs be on N11 numbers, so check all your N11 numbers for
ringbacks and ANACs. Another thing I've heard of is a SASS unit being on a
CO/Nxx code. I believe it was in Captian B's area on the N11 code 311, it would
play the number your calling from like a ANAC but, it would do 
 it twice, any time durring which, you could enter a pass code. SASS units are
not always on Co/Nxx codes, the sometimes have pots lines. (Note- If your area
has a SASS unit, then don't try to look for ANAC or ring back once you find your
SASS, a SASS is meant to replace those CO/Nxx codes.)



I can't find my ANAC(or ring back), but I found my ringback(or ANAc),any
advice/help???:

 So, you can't find one of the two codes that does the ring back, or ANAC? No
worries, I have a theroy that may work for you.

***PhreakBlaze's Theroy For Finding Ring Back Or ANAc***
-go to Telcodata.us

-click on the search your npa and ring back or anac code for the nxx. It will
most likely come up in a thing called "ODDBALLCODES" with no co name, just some
Xs for the co name. If it gives you a company name that owns it :EX- Verizon
East: click on it, if not, search you npa and your exchange, then click on the
company for your region/state like the example above shows.

-Go down the list (it takes a bit to load) to where it starts listing you NPA
and exchanges in it. Then start going down the list till you see and exchange
served from the CO XXXXXXXXXX. The first exchange you'll probably see being
served by that is 211. Now all that you see with the XXXXXXXXXX you slould write
down (if its not one of the regular codes). 

-Now go to a payphone or normal phone and dial the codes (Note- sometimes, an
ANAC will need a 7 digit number dialed, and other times not.)

Don't worry aabout the rest of the unused exchanges, they are most lilely just
exchanges that aren't in use, not codes.

***End/PhreakBlaze's Theroy For Finding Your Ring Back Or ANAC/End***



Well, what else about these codes???:

 Well, we now found (hopfully) our ANAC or Ring Back (or SASS), and maybe
something else fun on those codes. Well some of tghe codes I've played with have
not done anything except given me an error measage that I have only heard when
the code was not in service. As you may have also noticed, I said they are free
to be called from a payphone. The only codes I've seemed to get working
terminate at some place I don't know about. Some I've gotten to go to "A Verizon
VMS," and other have gone to "network contrlers." Other times I've gotten people
who answer and all they say is "Verizon," and the wait for you to answer.




Any tip/resons for scanning this stuff:

 Yes, I do have some tips. Well, I'm not so sure of how good you would be at op
diverting to it. Also, I'm not sure if there is any possibility/way to get in
trouble for scanning these, but it would take the same amount of time to scan
from a payphone as it would from home. When you call one that works, it will
ring for a long time (never counted the rings), and then after two rings really
close together, it will actually start ringing the persons desk/answering
machine/ or the VMS picks up. 

 For tips on where tgo scan, I'm not sure this will help much, but around here
(so far) I've only been able to find number that work between 990-9000 to
990-9999 (Note- 990-9000 is the Verizon VMS around here.)





Thanks for reading...


Shouts: Y0ung Br1an, Phreak Out, Decoder, Captian B, Dual, StankDawg, Icon, Dox,
and everybody else at StankDawg's forums.


Captain_b  talking about HCO TTY calls

BTW, this month ago I tried out the concept of HCO (Hearing Carry Over) 
calls via the TTY machines. It works! HCO calls, which are similar to 
VCO (Voice Carry Over) calls, let the person talk to you on the other 
end, and you can hear them. And, the only thing the relay op does in 
HCO calls is say what you've typed. With VCO TTY calls, it works 
oppositely. You, as the person with the TTY talk, and the response 
 from the other person is typed back through the relay op. I like HCO 
TTY calls the best now for 2 important reasons: 1st- It speeds up 
conversations dratically. 2nd- If you're calling an "enemy", you can 
now hear them on your end of the line, but they won't hear your 
voice. And, also, HCO calls help make things less confusing for the 
relay op, since he/she will now only have to type half the time as 
compared to standard TTY calls. Pretty kewl, huh? All you have to do 
is tell the relay op at the start of a call that you want to place an 
HCO call, or tell her to turn on HCO mode, or something to that 
effect. I don't know if HCO or VCO TTY calls can be place through on-
line TTY services, though. 

Peace...

 How to get UNLIMITED airtime on Tracfone 5125
              by DSS4Free


OK, I originally posted on this a few months ago, and due to the number of people that 
have asked me about this, I will post it now. THIS WILL ONLY WORK ON THE 5125 
TRACFONES!!! It will DISABLE the timetank. OK, you will need 3 things to do this. 5125
Tracfone, 51/61xx series MBUS data cable, and finally you need Nokia-TDMA-service-full
software. Once you do all of this, then you can activate the Tracfone on the web. DO NOT 
PUT IN ANY OF YOUR PERSONAL INFO!!! Only enter the ESN and a zipcode from your 
area somewhere. Now, write down all the codes that it spits out to you and also punch them
into the phone. Once you have completed the activation process via the web, you need to get
into the phone to find out all the activation info. 

Press *3001#12345# select Nam1, and WRITE DOWN ALL THE INFO IN THERE including the 
system ID, SOC, and phone number. 

Now comes the technical part. You need to hook your phone up to the datacable and open up 
nokia-tdma-service full. 

Click on "read phone" and it will detect your phone and give you the info like ESN and all that crap.
NOW, change the drop down menu nuxt to where it says reset values. Make it say FULL FACTORY
then click on the reset values button. 

Next, your phone should power back up. Next to where it says "reset custom" and has a drop down
menu, change the number 9 to number 21. Now click on the reset custom box. 

Now, go down and click on "set all unlock" then click "write locks" 

YOUR PHONE SHOULD NOW BE JUST LIKE THEY COME FROM THE FACTORY. 

Now, you need to do *3001#12345# on the phone again and reenter the info into the phone that you
wrote down earlier. system id, SOC, and phone number. 

OK, NOW I JUST GAVE YOU ALL THE SECRET THAT I HAVE BEEN USING SINCE THE BEGINING
OF THIS YEAR.  

The Tracfone timer just temporarly disables, and if you punch in the *#33248# and start punching in codes,
it will reenable the timer and you will have to do the above steps again. 

To get the software, go to http://www.nokiafree.org and do a search for Nokia-TDMA-service-full. 

I forgot to mention, I have done this several times, and after 2 to 3 months, they will catch it that you have
been using ALOT of airtime and it won't work anymore. Simpaly go to Wal-Mart or Target or whatever 
and buy another phone and take back the old one. I did a phone for an ex-girlfriend and it was one of the
new phones that comes with 1 year of service. I hooked it up in January and it is still working. I suggest 
trying to find one of the 5125's with that packaging. 

This trick will not work on the CDMA Nokia phones ie. 5180 You can buy a 5125 from somewhere else and
it will roam onto a TDMA carrier near you (AT&T, US Cellular, or Cingular in some areas) But who cares if it
roams, the timer has been deactivated, so it will not cost any extra

GOOD LUCK!




                                         Private    Branch    Exchange  
                                         By: Fu5|0N 
                                               phreak_ny@hotmail.com
                            http://members.odinsrage.com/phreakny



Overview
++++++++

 What is a PBX. Well PBX stands for private branch exchange. The purpose of
 a PBX is to provide connections between staff at organizational sites, 
 connections to the outside world, and a means for on-site personnel to call 
 each other without paying telephone company usage fees. If thats still too 
 complicated for you then think of it as a telephone with an intercom. Now some
 people get confused between PBXs and the Centrex system. A PBX is based
 in the office or residence where a Centrex is based at the telephone 
 company's building. The advantage of PBX is that the user actually own the 
 equipment where as with Centrex the TelCo owns the equipment and the user
 just rents it out.

PBX Terminology
+++++++++++++++

PBX - Private Branch Exchange

Trunk (Path) - an outside line used to make or recieve regular calls

rj21x jack - The jack most commonly used to setup a pbx (the standard
                     one line uses a rj11c jack)

Base Station - the phone base with the antenna used to add the service of a
                          wireless phone in a  PBX

DID - Direct Inward Dial

VM - Voice Mail

ACD - Automatic Call Distributor

DNIS - Dialed Number Identification Service

VRU - Voice Response Unit

CTI - Computer Telephony Integration

ANI - Automatic Number Identification

API - Application Programming Interface

IVR - Integrated Voice Response


Connecting Phone Lines to a PBX
+++++++++++++++++++++++++++++++

Outside lines are brought into a building thru an interface. The interface used 
in a PBX is a rj21x jack. A rj21x jack holds up to 25 lines. This is where the 
TelCo's job ends. The outside lines all interface to the PBX equipment from
there the PBX equipment is what decides what calls are routed where and 
what extension to route them to etc. Now there can be a whole bunch of 
features on a PBX it just depends on what its usage is and the 
electronics/programming it has on it. A PBX is a ground start system. What 
this means is that a trunk is seized by the PBX before a call is sent between
the two locations. On PBX systems users often have to dial a code (usually '9')
to make an outside call. A PBX responds to a lifted handset by sending a dial 
tone to the end-user and then requesting that a trunk to the central office be 
seized to make a telphone call. 

Wireless PBX
++++++++++++
The growing trend in telecom seems to be wireless communication and PBXs
are no exception. PBXs use specialized wireless phones that operate at 
higher frequencies than home phones. They also have special features that 
are associated with PBX systems (ie. hold buttons, speed dial, LCD screens
with caller id, message waiting lights to show new voice mail). The wireless 
phones require base stations as too make sure that the user does not go out
of range. Many PBXs in larger buildings have multiple base stations which are
networked together and pass the signals to each other when the user gets out 
of range of one of them. Some of these stations require that the user puts a 
call on hold to make the station switch because it doesn't do it automatically. 
Users don't necessarily shell out the $1400 for a PBX wireless phone they 
can also use a standard 900mHz cordless phone that many people use in 
there homes today. Then again you have to take into account that there is an
upper limit to about 20 of these phones in the same building.

DID and PBX
+++++++++++
Direct Inward Dialing is a key feature of PBXs that is often overlooked today. 
Before DID PBXs depended on operators, and we all know how much of a 
pain in the ass that can be ;). DID allows a person dialing in to interface with
the PBX electronically and punch in an extension code and go directly to that
extension or voice mailbox, thus eliminating the need for a human operator.

PBX Add-ons
+++++++++++

A) Call Accounting
++++++++++++++++++
Call accounting allows the administrator of the PBX to track telephone calls 
made by each individual user or department etc. This helps to determine if 
there is too few trunks or if there is fraudulent activities going on. Translated
this is so they can try to track down us phreakers making calls thru their PBX. 

B)Voice Mail
++++++++++++
This is one of the very nice features PBXs offer. Each individual extension can
have a voice mail box set up for them. These can be used as a means of 
transferring messages when a party isnt answering. Most modernized PBXs 
use PC based VM services which make it very affordable.

 1:Components of Voice Mail
 ++++++++++++++++++++++++++
 Central Processing Unit (CPU) - The CPU is responsible for the performance
 of the unit. It executes the applications needed for the VM system.
 
 Codecs - These devices convert analog signals to digital and vice-versa.

 Software - Provides the key to how good of a VM system you have.


C)Automated Attendants
++++++++++++++++++++++
Basically all that an Automated Attendant is a program that answers the phone
and gives the incomming caller a list of options or a menu associated with a 
certain key on a dialpad. When that certain button is pressed the PBX translates
the frequency the tone sends and routes it to the chosen option.

D)ACDs
++++++
Automatic Call Distributors perform a variety of funtions within a PBX. They can 
route incoming calls to a user who has been idle longest, route a call based on
the customers ANI information, hold a call in queue,and provide statistics on 
users and callers alike. The easiest and most common way to recognize an 
ACD is the classic "All of our representatives are busy...please hold" 
message. Most commonly ACDs are used for companies or users that have 
more calls than people to answer them. ACDs can be linked with Automated 
Attendant programs in order to make the PBX even more efficent.

E)VRUs
++++++
Voice Response Units enable a user to make a transaction without dealing 
with a live person. The way this is done is by decoding DTMF tones into 
selections. The usage for this is giving credit card info account #s etc. This
kiddies is how you can get credit card numbers if you're into that type of thing.
The most common usage of VRUs is for short, simple transactions.

F)CTI
+++++
Computer Telephony Integration is what commonly delivers information on a 
caller to the ACD. This inforamation can be voluntarily given thru a VRU or 
involuntarily thru ANI. This my friends is how those companies know your 
name and account information before you even say your name.

ACDs and the Internet
+++++++++++++++++++++
Now with the advent of e-commerce ACDs can be used to read e-mail 
headers and keywords in order to pass the information along to a 
representatives computer. This is how they do follow up calls on orders or 
e-mail complaints/troubleshooting.


That's all for now keep comming back for more info on Centrex and key 
systems. 

Shout outs to  blackout_, Kernel|X|, superh, jayeneen and anyone else i forgot from #phreak.


Scan of 1-888-819-00XX
By: Mr. Poop

00: Cannot be completed as dialed
01: Fast Busy
02: Text to speech, says "Bye"
03: cannot be reached from your calling area
04: Cannot be completed as dialed
05: Switchboard Operator
06: Cannot be completed as dialed
07: Some recording
08: Voicemail
09: Switchboard Operator
10: Switchboard Operator
11: Fax Machine
12: Voicemali
13: Text to speech, says "Bye"
14: Text to speech, says "Bye"
15: Fax Machine
16: Text to speech, says "Bye"
17: some payment system
18: Fast Busy
19: Switchboard operator
20: Fast Busy
21: Cannot be completed as dialed
22: "Disconnected or is no longer in service"
23: Fast busy
24: "Please enter your pin number."
25: Not in service
26: Cannot be reached from your calling area
27: Voicemail
28: Disconnected
29: Voicemail
30: Fast busy
31: Cannot be reached from your calling area
32: cannot be reached from your calling area
33: your call did not go through
34: cannot be completed
35: Text to speech, says "Bye"
36: Disconnected
37: Just rings
38: Voicemail
39: Voicemail (Audix)
40: Switchboard operator
41: Voicemail
42: Voicemail (audix)
43: Cannot be reached from your calling area
44: Busy
45: Not in service
46: ETS Payphones
47: Not in service
48: Not in service
49: Cannot be completed as dialed
50: Hello?
51: cannot be completed as dialed
52: cannot be completed as dialed
53: cannot be completed as dialed
54: voicemail
55: cannot be completed as dialed
56: fast busy
57: cannot be completed as dialed
58: cannot be completed as dialed
59: cannot be completed as dialed
60: switchboard operator
61: cannot be completed as dialed
62: cannot be completed as dialed
63: cannot be completed as dialed
64: cannot be completed as dialed
65: cannot be completed as dialed
66: Hello?
67: cannot be completed as dialed
68: cannot be completed as dialed
69: some recording
70: dead air
71: cannot be completed as dialed
72: disconnected
73: voicemail
74: cannot be completed as dialed
75: fast busy
76: voicemail
77: cannot be completed as dialed
78: cannot be completed as dialed
79: cannot be completed as dialed
80: cannot be completed as dialed
81: cannot be completed as dialed
82: cannot be completed as dialed
83: cannot be completed as dialed
84: cannot be completed as dialed
85: cannot be completed as dialed
86 :cannot be completed as dialed
87: cannot be completed as dialed
88: Disconnected
89: cannot be completed as dialed
90: operator
91: operator
92: fast busy
93: voicemail
94: cannot be completed as dialed
95: fast busy
96: fast busy
97: fast busy
98: fast busy
99: cannot be completed as dialed

Shot outs to Captain B and ic0n.



Exchange Scanning Part Two
by decoder at phreaksandgeeks dot com


Intro:
------

  In the months that have passed since my first article on exchange scanning, I
have been approached by many people asking for more tips and tricks that I use
while scanning. I finally have come up with enough good material to warrant a
follow-up to the original article. Think of this as a supplemental release, as
well as a chance for me to correct some errors I made. There are also a few
things that I forgot to mention originally, as well as some important updates.
Maybe one day I will compile both articles, along with some other info and
numbers, and create one big definitive guide, but I'm still a lazy fuck, so
don't hold your breath... anyway, enj0y!


Tips & Tricks:
--------------

  One thing that has caused concern among people is the random callback. When
you dial hundreds of phone numbers, without blocking your caller id, you are
bound to have concerned citizens call you back. I read a paper once on paranoia
and caller id concerning this very topic, and let me tell you, it was extremely
disconcerting. There is a certain segment of the population that believes when
they receive a mysterious phone call, it is part of some conspiratorial plot
against them. These humans are known as "morons." My father is one of these
people. I remember many years ago, he received a page. The number that was
displayed on the pager was that of a payphone somewhere. He immediatley blamed
me for this mysterious page he recieved in the wee hours of the morning, and he
accused me of being out somewhere after curfew. When I reminded him that he
was, indeed, an idiot, and I was asleep in bed at the time, he actually uttered
these words to me; "How did they get my pager number?" I was completely
dumbfounded as to how to react to this statement. What the fuck do you mean,
how did they get YOUR phone number? They didn't know it was YOU...it's called
dialing a WRONG number. This moronic, self-important way of thinking is what you
must keep in mind when dialing blocks of numbers. Thses people live among us,
my friends, and trust me, it is not pretty.

  There are two easy solutions to this problem. The first, and most obvious
one, is to block your caller id when scanning. You can use Per-Call Blocking,
by dialing *67 before each call, or if you wish to save some dialing time,
simply subscribe to All-Call Blocking. I can't understand why everyone doesn't
already have this service. After all, it's free (at least it is in Verizon
Country), and it makes sense to have it, Just in case you forget to press *67.
Another less practical option is to build yourself a box that will dial *67 for
you each time your phone goes off-hook. The problem with this is that it will
also dial *67 each time you pick up an incoming call, which might annoy your
callers. Also, why build a box when you can subscribe to a free service that
will do the same thing? But, for those interested in building such a device,
think of the Telezapper. When you have a Telezapper on your line, whenever the
phone goes off hook, it plays Special Information Tones, or SIT. Building a box
on this premise, but for dialing *67 instead of playing SIT tones shouldn't be
that hard, albiet relatively useless.

  Now, there are a few things that I feel the need to mention about exchange
scanning. The first is that it is always a good idea to let a number ring at
least ten times. I realize that it is quite tedious, especially when you find a
block that is filled with ringouts, but it is very important. I have found that
in Verizon land, many employee voicemail numbers don't pick up until the about
seven rings. I have also, on rare occasion found very odd things after ten or
even twelve rings! The point is, if it's ringing, be patient...there may be a
cool prize waiting if you give it time. I also must stress that reorders and
busy signals, as well as ringouts, are pretty useful to have, so always keep a
detailed record of your scan. When I type up my scans, the only numbers I leave
out are the ones that play the default error message, which is the one that you
would hear on any vacant number. Everything else you find, make a note of it.
Next time someone asks for your phone number and you don't want to give it to
them, give them a number in your area, or any area, that is always busy, or one
that rings forever. It's a better idea than just giving them a random number
that you make up on the spot. Always have that fake number ready!

  Another way to have some creative fun when scanning exchanges is to use a
prepaid phone card. If you don't have long distance on your line this can be
especially useful. When scanning the 00xx or 99xx blocks of an exchange, most
of the numbers in there are cool error messages, which are free to call. They
do not supervise, therefore you dont pay. It's amazing how many people forget
that you don't get charged to call an error message, whether it is a local or
a long distance call. When you use a phone card to scan these ranges, no credit
will be taken off of the card, unless you hit a number that supervises, so you
can scan all day and night and not have to worry about charges ony our bill or
your ANI being passed. There are a million and one different phone cards, so
you must choose one specifically for this purpose. The most important thing
being a card with NO connection fees! When you scan these ranges, you are
going to run into some milliwatts, carriers and employee numbers...all of which
supervise. You don't want a buck taken off your card because you got deafened
by a milliwatt. It's also very convenient if you can find a card that will let
you make unlimited non-connecting calls in one session. Most cards only allow
three to six failed calling attempts before forcing you to disconnect and
redial the access number and PIN. Scanning with a phone cards is also a good
idea for those worried about the legalities of scanning. If you're worried
about the telco seeing that you like to dial hundreds of sequential numbers, by
diverting through the phone card, you are giving yourself a bit of extra, added
protection.


Toll-Free Telco Exchanges:
--------------------------

  On the topic of things that I neglected to mention in the original article,
one subject immediatly comes to mind... Verizons 890 exchange here in New York.
This is a toll-free exchange (not NPA), in which there are various offices such
as repair, and a few other interesting things. You can dial this exchange from
outside of the area by preceding it with any New York area code. While,
according to the Verizon Directory, this is a toll-free exchange, if you are
calling from outside of New York, you may get charged for the call at your
normal long distance rates, but I'm not quite sure. It may still be free, who
the hell knows? Here are some 890 numbers for your phreaking enjoyment!

890-1590 Residential Service (English)
890-2005 Residential Service (Spanish)
890-1776 Residential service (Korean)
890-1755 Residential Service (Russian)
890-6611 Repair
890-0200 Business Service (orders & product info.)
890-1400 Business Service (billing questions)
890-7711 Business Repair
890-0550 Center for Customers with Disabilities (V/TTY)
890-1900 Verizon Call Block Test Line (to test caller id blocking)
890-8248 Bell Atlantic Call Block Test Line

  BellSouth also has a similar exchange, 780. It can be reached from any state
in BellSouth territory, but not from anywhere else. I also believe that you
must have BellSouth service in order to reach it, unlike Verizon's 890, which
be reached from any phone, anywhere. This lack of accessability has left me
with little knowledge pertaining to the 780 exchange. I encourage everyone in
BellSouth territory to scan out this exchange and see what lies hidden. There
may be some very interesting numbers, although us Northerners wont be able to
call them. And, of course, everyone should play around in the New York's 890
exchange, just remember, it's Verizon... they are probably logging your ANI.

  While on the topic of telco exchanges... in the original article I briefly
touched on the 959 exchange. I had stated that it was owned by AT&T, but this
is not the case. What led me to belive that it was operated or owned by AT&T,
is that weird things happen when you dial numbers in the 959 exchange through
AT&T's network. Usually you hear milliwatts and other tones in the 959-1xx0
range. You can reach these numbers by using an AT&T PICC, such as 10-10-288.
Most of the numbers in the 1xx0 range are constant across NPA's, for example,
1000 and 1500 are usually milliwatts, no matter what NPA you choose. One new
trick I have been informed of is that the 69xx range, specifically up to 6920,
is very interesting, indeed. There are all sorts of cool AT&T 4ESS error
messages in this range, and they are different depending on what NPA you choose
to scan. At the end of the error massage, you will hear the office code. My
area is 104t (White Plains, NY). I also had stated that these 959 numbers did
not exist in New York. It turns out that they do, although for some reason, you
cannot reach the 4ESS error recordings in your own area, so I can't dial them
in my own area code, but I can reach the recordings in 212. Just remember, in
order to reach these numbers you must use AT&T's network, and, as I have stated
earlier, these are error recordings... you cannot be charged for calling them,
so don't be hesitant to use AT&T's PICC to dial them, it's free.


Info on Your Exchange:
----------------------

  When I wrote the first article, the most popular website where you could
obtain information about your exchange was telcodata.us. I had included that
site as an indispensable source, but unfortunatly, telcodata is no more. It was
a sad day, indeed, when the news of telcodata's demise first hit, but there is
no need to worry about it anymore. There is a brand to site where one can
obtain info about their exchange and switch. It was created by ntheory and the
URL is ( http://entanglement.net/~ntheory/phreaking/NPA.php ). Not only does
this site have all the information from NANPA and DSLreports, but it will soon
to become a database for everyones exchange scans! What is being planned is a
database of exchange scans, submitted by anyone who wants to help out. So
everyone who reads this article and does some scanning, submit your work to
ntheory, (ntheory@binrev.com) and your scans can be added to the NPA.php site.
Anytime someone looks up the exchange that you scanned, they will know what
lies hidden in there. I, for one, think this is the most elite idea ever! This
site should bring exchang scanning to an entirely new level... a central
database which acts as a telephone directory... not for customers phone
numbers, but for all the numbers that are important to phreakers.



Some Numbers:
-------------

  This article would't be complete without a few numbers. Once again, I have
some numbers from scans I have done around the country, and if you look around
in these exchanges, you are sure to find a bunch of cool stuff.

609-729-9928  [sit] we're sorry, the long distance company you have selected is
                 unable to complete your call at this time. please try your
                 call again later, thank you.

856-767-9975  the person you are calling is busy, please try your call again
                 later.

206-343-0011  [sit] this call requires a coin deposit. please hang up
                 momentarilly, then redial your call by first depositing the
                 local rate posted on the instruction card, or dial zero for
                 the operator.

516-378-9932  milliwatt (1004 hz. tone)

845-735-9988  if you need to report a police, fire or medical emergency, hang
                 up, regain dial tone and dial 911. all other calls from this
                 line are restricted. if you wish to discuss your telephone
                 bill, please call your local telephone provider. If you wish
                 to establish telephone service, call the provider of your
                 choice.                 

541-967-0010  the business telephone number you have dialed is experiencing a
                 temporary service problem. it has been reported to us west
                 communications who is checking into the cause of the touble.
                 we are sorry for the inconvenience, please try your call again
                 later.

631-473-9902  DATU (default system passcode)

914-664-9958  [sit] we're sorry, when you dial zero for calls within your area
                 code, you now must dial zero plus your area code, then the
                 telephone number. please hang up and try your call again.


sh0uts: dual for always putting my texts up on OSP, Strom Carlson for hooking
 me up with all the 959 and 4ESS info, and ntheory for giving us all npa.php.



