you could use a SIM card from the suspected operator, do a long drive-test in the area, post-process the log file and extract all BCCH & TCH frequencies. The operator is probably using hopping, so any call made in a cell will show the whole list of frequencies in that particular cell.