EFS:Timeline

Part 0: Codi

Trailhead the First

Pro Hackerz

On 2016-03-17, a post appeared on /r/gamedetectives saying that Teragon Group's website had changed. Six hours later, The page was found to be hacked by an entity named Codi.

Four hours later, the site reverted to its usual look.

Baphomet Studio's YouTube channel was updated following the hack and uploaded this video.

The next day this video appeared on the channel, with the description saying it was "sponsored by Codi". The game shown in the video is *Stardew Valley*, and this channel was discovered through this hint.

A Warm Welcome

The video Hi There drew attention as it was the newest one and different to the others. The text said:

Hi there.
My name is Codi.
Do you want to know me?
Let’s see if you're smart enough.
Solve this riddle.
[Mirrored] See you on the other side.

The video itself is flashing images of asterisks.

More videos here and here were added.

The first video is the Star Spangled Banner (American national anthem), and the second one is Twinkle Twinkle. 

Over the night multiple videos were put up and down on the Baphomet Studios YoutTube channel, but two new clues stayed here and here.

IT'S STAAAARS YOU FOOLS!

Constellations & Team Fortress 2

The constellation inside the video was discovered on 2016-03-18 to be the Camelopardalis constellation after multiple camel-related clues were given.

Using all previous hints a blog was discovered by spelling Camelopardalis backwards.

Two posts on the blog, This post, and this post, were combined into a single image shown here and here.

Using TF2 themed posts and the hint about Tumblr,  this Tumblr blog was discovered as an anagram of the images merged together.

This post on Tumblr also lead to this video. A solved version of the image in the Tumblr post can be seen here.

After many hours of suffering and chasing after wrong ciphers,  this ask.fm account was found, and one of the posts led to this image.

However, at this point, the ARG was put on temporary hiatus - read more here.

Don't Stop Me Now

Roughly eight hours after the ARG went on temporary hiatus, there was a realization that the first letters of the maps, "nserubetclu", was an anagram for /r/turbulences.

On April 5th 2016, 15 days after the cancellation of Teragon 2/Codi, the reddit user /u/TonyWan started posting in the League of Legends and DoTA 2 subreddits. This is interesting because Tony Wan is a character from the first Teragon ARG.

The DoTA 2 post was a link to a Twitch channel called "thehiddenmessage". It showed the DoTA hero select screen with a robotic voice reading out Buddhist transcripts.

The LoL post linked to a website claiming to have secret information on certain teams from popular eSports games.

People's ARG senses were tingling, especially with the link to Teragon. More investigation was done on the website and Twitch stream which led to more discoveries, somewhat confirming an ARG.

Part 0: eSports Gossip

Trailhead II: Esports Gossip

Tony's Return

The Reddit user Tony Wan (a character from the previous Teragon ARG) posted to multiple places such as the League of Legends and Dota subreddits.

The Dota post, posted on 16/4/10, was about a Twitch channel called "thehiddenmessage", while the LoL post, posted 5/4/10, linked to [esportsgossip.club eSports Gossip Club], a website claiming to have secret info on certain teams from popular eSports games. 

Around this time, the TeragonGroup website that the original Teragon ARG was based around also went down.

It Begins

On eSportsGossipClub, there was a link for sending a tip, as well as a link to "start.html" abd a twitter page.

The cipher for start.html was rather basic, using an a1z26/"number letters" cipher:

Deciphering the page with this code yielded the message:

"YOUR EFFORTS WILL BE REWARDED TO PROCEED GO TO THE NEXT STEP"

This led to nextstep.html, which was only a "Coming Soon" page. At some point on 16/04/15, the eSports Gossip website changed its repeated "official launch" date from 16/04/10 to 16/04/20.

Around the beginning of the Twitch livestreams, start.html and all other pages on the site except nextstep.html changed to simply read:

You are not yet ready.

Part 1: Malena

At around 3:33 pm CST on April 11th, thehiddenmessage started streaming again, this time reading passages from the "Tibetian Book of the Dead." At the end of the stream, a text-to-speech voice could be heard repeating:

 This marks the end of tonight's broadcast.  Please click the Follow button, do not forget to clear your mind and meditate.  123 345 567 789 910

At around 12:40 pm CST on April 12th, the stream started again with the title "The Master's Secret Knowledge".  At the end of the stream, the following was heard:

To reach enlightenment, quit Dota.
To learn about your true self, quit Dota.
To free your mind, quit Dota.
To master your desires, quit Dota.
To learn the true meaning of life, quit Dota.
I am your master.
I am your guide.
I am the lighthouse in the stormy sea.
122 344 566 788 91010

On 16/04/13, the title of the streams changed again to "I Am Your Guide", and by the third such stream, the image in the bottom-right changed to a creepy old photo.

On 16/04/15, around 4:09 pm CST, a new stream appeared, entitled "Are you ready?", displaying a timer counting down to 5:00pm CST 16/04/15. 

Do Not Play TF2

On 16/04/15, at 5:00 pm CST, the countdown text changed to say "GO!", with the background becoming an image from Team Fortress 2, and the music changing to be TF2 music (the same track was used during the Codi ARG). After a few seconds, an image of Snoo, the mascot of reddit, also appeared, leading to  this /r/TF2 post linking to the site donotplaytf2.news by /u/thegreatalmightyderp, who had previously posted about an update to the Teragon website.

Chapter 1

On Page 2 of the blog, /chapter1/ was found, which read: 

Welcome, welcome.
So, you managed to find the first page. Not bad.
Let’s see if you can keep up the good work. Who knows, we may even have fun together.
M.
------
Go to chapter2
I go up the ramp and emerge from the blue shadows. 
I go straight and enter the wooden house. I immediately turn right and go up a flight of stairs.
I then turn left and go up another flight of stairs. Another left, followed by a right turn, brings me to a dimly-lit corridor. I exit through the gate, turn left and go down by using the stairs. I turn right and go straight on until I reach a closed-off area. I then turn left twice and enter a red refuge.
Where am I?

The answer to this was solved to be the TF2 map "Dustbowl". 

Chapter 2

'Dustbowl' was the password to view Chapter 2, which read:

So, you know your TF2.
Let’s be honest, though, that was an easy one.
Let’s try something a little bit harder, shall we, friend?
M.
------
Go to chapter3

along with this image. The image was in Aurabesh, a language from Star Wars, and translated to "the password of the new page is weirdalphabet".

Chapter 3

When 'weirdalphabet' was entered as the password, Chapter 3 read:

So far, I’m rather impressed. For a bunch of random people off Reddit, you’re actually quite clever. Except for the part where you told people on /r/tf2 that it was an ARG before they had a chance to figure it out themselves and maybe have a bit of fun too.
Anyway, a few weeks ago, I was talking to a friend about this little experiment I wanted to run.
I told him no one would be able to solve my little puzzles.
Looks like, so far, I’m wrong.
Or maybe my first few puzzles have just been way too easy.
Rather tricky to say, wouldn’t you agree?
M.
------
chapter4
SLITUUNA

The first line refers to a comment made by a user on the /r/tf2 post stating "no don't worry it's an arg", despite this post being deleted minutes after it was originally posted and long before chapter 3 was found.

The first 5 lines of the page spelt "SAILOR." "SLITUUNA" is an anagram of "NAUTILUS," Greek for "sailor."

These referred to the novelTwenty Thousand Leagues Under the Sea, in which Sea Captain Nemo piloted the submarine Nautilus.

Chapter 4

The password of Chapter 4 was "nemo", the sailor of the nautilus yielding this message:  

How clever was that last puzzle? I mean, seriously, how clever was that?
The first letters of each line giving you the word SAILOR, the Nautilus anagram… Come on, admit it, it was cool.
Anyhoo, you did well, friend. So far, you have exceeded my (admittedly low) expectations, so that’s… good, I guess.
Maybe it’s time I introduce myself, don’t you think?
Name’s Malena. Don’t blame me for it, blame my parents.
I’m 17, bored as hell and I wanted to try a little experiment with ya’ll.
Hence the weird stream, the equally weird TF2 page and the riddles.
As I’ve said before, I’m fairly certain you won’t be able to reach the end of your journey. Not that 
I don’t have faith in random strangers on the Internet (although, to be fair, I kinda don’t), but, well, my mind is a bit weird. 
Scratch that. It’s REALLY weird. And I’m not sure you’ll be up to solving some of the puzzles that warped mind can come up with.
You should, though. There’s a reward waiting for you at the end of the journey.
So, let’s continue, friends.
Malena
------
thefirststep
++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>+++++++++. -. ———. <++. >++++++++++. ———. <. >—–. +. ++++++++++++++++. —————–. +++++++. ——-. ++++++++++++. <. >++++++. <. >. —-. -. +++++.

The hint beneath the horizontal line later changed to this:

thefirststep
PMR PG ODSSV D DPMD
(Looks like WordPress messes with Brainfuck code. Oh well… I guess that one is on me.)

The hint was solved by /u/Tmonkx . By shifting each letter one to the left on a QWERTY keyboard, the following message was found:

ONE OF ISAAC S SONS

 ===The Journey Begins=== The password to thefirststep was discovered to be Jacob, one of Isaac's sons. thefirststep contained the following message along with a video.

Are my puzzles that easy or what? I have the weird feeling I’ve been giving you baby puzzles until now.
Yes, I know, I should congratulate you and all but I do have the feeling I’m the one who messed up here.
Are you that good or is it me just being bad at making puzzles?
Kind of an irritating problem to solve, don’t you think?
Unless I’m looking at this the wrong way.
Really, there isn’t much else I can do right now except to give you a new, harder puzzle to solve.
Are you up to the task? We’ll see.
Malena
------
gettingcloser
133211 x02220 x32010 022100 xx0232

It was quickly noted that the first letter of each sentence formed the word "Ayakura", a cryptical Discord user who was also mentioned a few times in the Teragon ARG. Ayakura decoded the numbers as chords which would read "faced", the password to the next page.

Getting Closer

gettingcloser contained the following text:

I’m watching you. Watching you on Reddit and watching you on Discord as well.
Somehow, it amuses me to see you try to solve my puzzles. Or see you look at someone’s comment history and assume a certain website is part of my little game when it’s not.
Don’t mind me though, I’m very easily amused. Which is somewhat weird because I’m also very easily bored.
I’m a huge contradiction wrapped in a tiny girl’s body.
By the way, side note: if you reached this page through non-conventional means: you can chat with other solvers over at the /r/gamedetectives’ official Discord server over at http://discord.me/gamedetectives. Join if you want, or just keep solving stuff alone if that’s more your thing, friend.
So, how are ya’ll doing? I mean, you can’t answer me but I thought I’d ask. I at least like to try to pretend to be polite. It’s better than nothing, right?
Malena
-------
chocolatecake
ACCCGTAAGAAGGAACTC

The string at the bottom of the page was decoded, once again, by Ayakura using this website, to read "waffle".

Chocolate Cake

chocolatecake contained the following text and an image:

Let me tell you a little bit about me:
I am 17, I live in Spain and I’m a terribly average student. I like video games, writing fiction and I read a lot of spirituality books.
And you, who are you?
Malena
vessel

The password, 896745 was discovered by converting the image from base 60 to base 10 using the following equation:

4*60^3+9*60^2+5*60^1+45*60^0

Far too fast

vessel had the following text along with another image:

Fast. Way too fast.
You guys are good.
OK, let’s increase the difficulty a bit.
Good luck with this one, boyos.
Malena
------
anewchallenge

/u/Ayakura and Crauss managed to find the page using the 2 image fragments and overlaid the image on the blog's paragraph, giving the string:

AnrguosdTyeufpL

A few hours passed by, with vessel.html's picture being replaced with one that included hints - in the form of hangman-esque dashes:

---- - ------- ---

The hint, combined with the provided string, combined to read 

Pyro s default gun

In TF2, the Pyro's default gun is indeed the shotgun, the correct password to unlock /anewchallenge/.

Malena's Mysterious Musical Mind Map

/anewchallenge/ featured a video and an image, and read:

Let’s talk for a moment about the Twitch stream (twitch.tv/thehiddenmessage) and its meaning.
As I mentioned earlier, I read a lot of books about spirituality. The goal of my stream was to try to attract people who might share the same interest.
My beliefs are not limited to a single religion. I pick things I like in every religion, ancient or contemporary, I study them and if they fit within my belief system, I add them to that system.
To me, that’s the only correct way to approach religion or spirituality: keeping an open mind and focusing on what really matters, not on the fluff.
Malena
------
thestruggle
UGBTT EEBRRGW EMKKRWPPR (SSS)RRHBWBTONDB

Some of the names of streets on the map had been changed, spelling out "what is my name" (as highlighted here) leading to the password "malena".

Spanish Inquisition

/thestruggle/ read as follows:

Congratulations, you managed to ignore the irrelevant information and focus on the right stuff. Not bad. Not bad at all, if I can say so myself.
Well done, you won. End of the road. No more challenges. You did well.
I hope that you will soon visit Spain.
Malena

While this looked like the end of the road, Spain was actually the name of the next page.

Statuesque

Spain read as follows, and also contained an image of a statue:

You don’t want to give up, do you? OK fine, let’s continue.
You may actually beat this whole thing. At first, I definitely thought you wouldn’t, but you seem to be proving me wrong.
So, as a reward, I think I’m going to tell you a little bit more about me.
I live with my mother in a house near the sea. I have two sisters, an older one who is now off to college and a younger one who is worthless. Seriously, she’s terrible.
My best friend’s name is called Sylvia. She’s the one who helped me come up with those puzzles, so I’ll of course blame her in case anything goes wrong with one of those challenges I’m throwing at you.
Now, let’s move on to the next step, shall we?
Malena

The statue was found to be Michelangelo's 'Bacchus'.

It is a mystery

Upon /mystery/'s discovery, it simply read:

Coming soon.

However, on 2016/04/16, the page changed briefly to a simple html page reading:

Do not trust her.

It was shortly thereafter changed to a proper page, featuring this image:

And this is what happens when I underestimate you… I go to sleep, thinking you won’t solve BOTH of those puzzles in the meantime and, when I wake up, I find out you did and are now staring at a Coming Soon page. How rude of me, right?
Anyhoo, Bacchus. Isn’t he a fun god? The god of drinking and excess. You see, people nowadays tend to associate god with a stern man who judges you based on what is wrong and what is right. Our ancestors, however, knew that there was more to religion than that. They knew that they also had to make it fun somehow. And scary. Truly, the ancient Roman and Greek pantheons are fascinating.
Malena
sleepytime

This was a Templar Cipher, which decoded to read "goodmemories", the password to /sleepytime/.

Eternal Slumber

/sleepytime/ yielded this:

You know, there’s not much for an 18 year-old girl like me to do over here in the Spanish countryside.
I get bored very easily, so I try to entertain myself by coming up with little puzzles and ciphers for my friends.
Before you start jumping to conclusions though, you and I are not friends. Yet. After all, we’ve only just met.
But, who knows, maybe one day we will become friends. And talk about philosophy, spirituality and all sorts of interesting things.
Would you like that? I know I would.
Being lonely is not particularly fun.
Malena
------
loneliness

Note the inconsistency in age - Malena was previously stated to be 17. A while later, the puzzle section of /sleepytime/ updated:

loneliness
There’s none so blind as those who will not see

this video was embedded to the page, and added this image of a man jumping in a city.

The puzzle actually lead to the page /conclusions/ rather than /loneliness/, as hinted at by "jumping to conclusions".

Jump into Spain

The password to /conclusions/ was "loneliness", yielding this text and this image of the Spanish coat of arms:

Have you ever been to Spain? (No, not the page on my site, the real country).
Overall, it’s pretty nice and the country has a pretty long and complex history, which makes it interesting.
I’d like to visit some other countries though, like Italy maybe or France. Maybe one day.
Malena
------
voyage

/voyage/ briefly changed, again showing:

She's lying.

The red herring /loneliness/ was removed from the site at an unknown time after this. After having run around in circles for a while the page was updated with an image, Pointing to stenography. Doing stenography on the image the spanish coat of arms gave the text "Isy ghwr nogebobtev rtdimlnx zn p nimhekp ou txaiel", a vigenere with a key of spain's motto, "plusultra". This translated to "The only worthwhile resource in a country of idiots". After some time trying everything one could want in a country of idiots, this image appeared, shortly followed by an image of The Administrator from TF2. These references linked to "australium" a highly sought after material in the world of TF2, which is the password to the next page.

Blast from the Past

Well, that sure took you a long time and quite a few hints. My best friend, Lea, helped me come up with this one. I have to admit, she’s a bigger TF2 fan than I am and she’s the one who told me everything about Australium.
You are getting close to the end, by the way. And I’m close to losing that bet I made with Lea. Grumphh.
Malena
------
onemorestep
In the city of John the Baptist, there once was a very pious man.
After the fall of the house adorned with six spheres, he came into power and tried to impose his strict religious dogma onto the population of the city.
Unfortunately, the city turned on him and he was put to death, along with two of his brethren, in front of a very famous building.
That building will lead you to the next step.

Shortly after this message, the message "She is not who she says she is" was shown for a short time. Later, an additional message was added:

See the truth. Add "_notes" at the end of each page you visited. Password is "bitntestnotes"

Following this, notes can be seen for every puzzle, compiled here. Someone named "GB" is referenced in these notes. A Teragon Group analyst named GB was briefly mentioned in the original Teragon ARG, suggesting a link between the two (though this was likely a coincidence.)

After hours of searching around a new hint appeared. "You know there are places on Reddit where someone would have given you the answer in less than five minutes, right?" Inspired by this hint, the solvers made a post on /r/AskHistorians. 5 minutes later, another hint appeared: "A temporary fall from grace is a fall nevertheless." A new image appeared confirming suspicions that the house in the riddle was the medici house, followed by another image, this time of the Cathedral of Santa Maria del Fiore. Using all of these hints, solvers pieced together the location: Palazzo Vechio, the place where the priest Girolamo Savonarola was executed.

Natural Beauty

The password to /onemorestep/ was "palazzovecchio". It contained a link to a youtube video with an image of Barcelona, Spain - Park Güell.

Yesterday, I was playing with my dog in the little garden in front of my house.
I was trying to come up with new stuff for you guys. New puzzles, puzzles that would really make you think.
I’m afraid this one won’t make you think. It’s quite simple really.
I’d be surprised if you weren’t able to solve it in less than 5 minutes. Yes, surprised and a bit disappointed too.
Malena
ahigherspirit

Taking the first letter of the name of each character making a sound in the video yields "messed", the password for the next page.

Winter is Coming

/ahigherspirit/ contained more text and an image:  

I have to run somewhere and take my two bros on an errand for my mom. I thought I’d give you a hard one to make sure you don’t see another one of those damn “Coming soon” pages.
Malena
anewdestination

"Malena" once again made an error by stating that she had two brothers instead of two sisters. The drawings on the face of Mance Rayder matched this subway system and the X marks out the "libia" station. Some time later, "libia" became the password for the next part.

Now in theatres

Contents of /anewdestination/:

Coming soon.
Oh well. Glad you found the answer though. Sorry about the mix-up. Looks like stations were planned and never opened. So, Libia it is.
Oh, and congratulations on “finding” Savonarola.
Malena

The page soon updated to include:

theredvan
4376897911236665

This was promptly changed: 

theyellowvan
4377159311233325
The bald man will show you the way
The man in the blue shirt with no face is looking straight at you
The masked gangster looks at you menacingly
The dapper gentleman calmly smokes a cigarette.
Forget everything you heard about a red van. I’m doing this on my mobile while bringing my two sisters to the store. It was an honest 
mistake.
A fierce-looking gentleman is holding both his hands in the air.

The page updated with an image of the Bounty Hunter from Dota which was actually the thumbnail to this video. Very little success was had at making progress with this puzzle, leading to a number of hints being added:

Those numbers must mean something. Maybe they need to be split?
Shockingly, this puzzle does not involve any kind of cipher."16 digits. Or 2 groups of 8." Yet another hint - an image of the Coliseum in Rome, with the title "roman-calendar.jpg" Little progress was made, and the hint "Lampredotto – Hamburger – Porchetta – Hotdog – Salsicce" was added. One final hint was eventually added: "Two groups of eight numbers. Maybe with missing punctuation.". This led to a realization that the numbers were coordinates, which pointed to a street in Florence; by viewing Google's Street View for those coordinates, a yellow van could be seen with the words "I'Bandito" on it.

The Bandit Van

The password for /theyellowvan/ was indeed "ibandito", yielding this text that suggested that the character known as ? ? ? may be the liar:

There’s a girl who hates me at school. She’s been turning my life into a nightmare for the past two years.
She’s the one who’s been posting stuff on here, saying I’m a liar and what not.
And, you know what breaks my heart?
You seem to believe her.

Beneath this was a frowny face from another site.

Following this, the text on /anewdestination/ changed:

The bald man will show you the way as he exits his car.
The man in the blue T-shirt with no face is looking straight at you.
The masked gangster looks at you menacingly.
The dapper gentleman calmly smokes a cigarette while waiting for his food.
Forget everything you heard about a red van. I’m doing this on my mobile while bringing my two sisters to the store. It was an honest mistake.
A fierce-looking gentleman is holding both his hands in the air.

Following this, /theyellowvan/ added more text:  

Anyway, last night, I had astrangedream.
In that dream, I was in a weird city. It didn’t look like any city I know, it was like a college of different Spanish cities, like Barcelona mixed in with Madrid, etc…
I was walking down a street when, suddenly, someone tapped me on the shoulder. I turned around. It was a tall man in a top hat. Although I had never seen him, I somehow seemed to remember his weathered old face.
“You should not be outside at this time, Miss,” he said. I told him that it wasn’t that late and that I felt perfectly safe. “You shouldn’t,” he replied with a sly smile at the corner of his mouth.
I walked away, feeling slightly shaken, and entered a nearby shop. It was a shop unlike any other in the real world. It sold every single product on Earth, but it did so in the tiniest possible room. Basically, you had to tell the assistant what you wanted, push on a button and then — poof! — suddenly that item appeared out of thin air, ready for you to purchase. I immediately decided to purchase a horse, two chairs and three palloons. Since I couldn’t see myself carrying all those items back to my house, I asked to get them delivered. That’s where the clerk replied “Oh, but they were already at your house, miss.” Then he turned around, reached for something under his desk and pulled out the longest knife I have ever seen.
I ran out of the store as quickly as I could but, while I was shopping, the street had somehow changed. I was now in the middle of an Italian street instead of a Spanish one. I crossed the busy street in a hurry and took a quick glance behind me. The shop assistant was still in persuit, knife in hand.
I started running down the street, calling for help. Needles to say, none of the people in my dream seemed even remotely interested into helping me. They just stood there, watching. Some were even laughing and pointing at me. I distinctly remember two grown woman pointing at me, while talking to their little children. “You see, girls, if you don’t study in school, this is how you’ll end up,” she said.
Out of breath, I stopped running after about five minutes. The shop assistant was gone, as far as I could tell. I took a deep breath and tried to compose myself. Suddenly, I felt something sticky and warm on my leg. I looked down and saw that my entire right leg was covered in blood. Under the sunset light, that blood looked black and shiny.
At that point, I woke up, my heart pounding real hard in my chest. 
Malena

Note the various typos in the passage. They are code, which together spell "abuse".

Do Play TF2

"abuse" was the password to /astrangedream/, which shortly read "Coming soon" before changing to: 

Catch me if you can.
45.121.185.232:27051
Malena
------
yournextgoal

This prompted users to join a Team Fortress 2 server, with Malena's Steam account being tracked down (albeit being the same account as the puppetmaster, gayfarang, with a different name). Malena spoke in the game's chat a few times after realizing that sprays are disabled:

Malena : I didn't say anything. But I gave you the password.
Malena : I am a building with a giant hole in the roof.
Malena : Follow me.

pantheon-files

The "Building with a giant hole in the roof" was realized to be the Pantheon in Rome. "pantheon" was indeed the password for /yournextgoal/, which promptly updated to say 

Can I trust you? Can I really trust you guys?

A series of additions/edits followed, resulting in:

Also…. and I know this is a bit of a weird question but… do you like me?
I didn’t mean that in a romantic way. I just meant… you know, “like.”
Malena
almostthere
SeFrShMa
If S is I, what is F?
Tip: /r/dota2 may guide you on your journey to solve this puzzle as well as the next ones.

Tip 2: I think that bad friend I told you about earlier is the one using all of my site’s bandwidth at the moment. Unless one of you guys is using a scanner or a tool like that? But no, I’m sure it can’t be you. You’re too nice for that. A post on /r/dota2 indeed did help solve the puzzle to be "major":

Seattle, Frankfurt, Shanghai, Manila. The Major cities.

Tonight's the Night

/almostthere/ contained this and an image:

Don’t worry, I won’t keep on making you jump through hoops forever.
My puzzles will end tonight. Tonight, I will finally know if you are worthy of not.
Malena
almostover

The page was briefly edited to read:

I will tell you everything tonight.

After this was changed back, the page was edited/added to a number of times with hints:

/r/dota2 may still be of help.
Synonyms.
You are looking for a place that does not exist.

An image and a video were also added. The solution was found to be "Crixalis", the name of the Sand King in the Scintillant Waste in Dota.

Not Quite There

/almostover/ contained:

See? I told you the fine people over at /r/dota2 would be of great help.
You still have not really answered my question though: do you like me? Not that I’m shallow or anything, but I like to be liked, if that makes sense. Or, to be more accurate, I don’t like being disliked.
Yeah, I know, I’m weird.
Malena
-------
anoldfriend

The puzzle was added shortly after:

KNHAEEO.P..NIACTTHT.OWCAARRV.EEALI.. (8)

This was very quickly solved to be a Burrows-Wheeler Transform which read:

.VOICE.PACK.A.HERO.WITH.AN.ALTERNATE

The hero this referrs to is "spectre", the password for /anoldfriend/.

The end of a road

/anoldfriend/ intially read:

Well, that was way too fast. I can’t keep up here.

Later added was:

The next (and last) puzzle will be ready shortly.
Malena

Later on, the final puzzle was added with this video containing a series of beeps:

theendoftheroad

The beeps were morse, leading to 

I WAS AT TI1. I STILL PLAY DOTA COMPETITIVELY BUT I HAVE NOT BEEN TO ANY OTHER TI. I AM WELL-KNOWN FOR PLAYING MORPHLING.

This referred to the Dota player "lakelz", also the password for /theendoftheroad/, which read:

Well done.
You have solved your final puzzle
There is someone else who wants to talk to you. Come back here in 10 minutes.

The start of another

Following this, the page blanked out in another hack, which was soon followed by the addition of this URL:

https://electronicfreedomsociety.wordpress.com/

The homepage of Do Not Play TF2 changed to redirect to Google's homepage.

Part 2: EFS

New Rivalry

The PDF of Revelation

The Electronic Freedom Society (EFS) blog had one post, linking to a document on a new site for the Order of the Crimson Temple (OCT). The document showed that Malena (and eSports Gossip and Codi before her) were fabrications by OCT as a recruitment programme. It also revealed that they had hacked into Tony Wan's reddit account and had been behind everything in the ARG so far (except the EFS hacks).

Which side are you on?

The EFS blog updated with a new post, including a Strawpoll:

Hi, My name is Mark and I work for the EFS.
The EFS is a small non-profit organization dedicated to preserving and fostering freedom over the Internet.
A few months ago, we found something — quite by accident — that seemed to indicate that a well-known cult, the Order of the Crimson Temple, was planning something.
We do not know what it is yet, but we know that it’s going to be big and that it will involve the Internet somehow. Given the OCT’s past history, we’re quite sure that whatever they’re planning — which they call the Day of Reckoning — won’t be good.
I know that the Order tried to recruit you but, I was wondering if you would be interested in working for us to stop them.
As I’ve said, we’re a very small organization and, if we want to stop whatever they have planned from happening, we really need all the help we can get.
We can’t count on police forces or governments at the moment. They’re still busy trying to deal with the aftermath of what happened in Paris a few months ago and especially tracking those responsible for that attack.
Anyway, do you want to help us or not?
http://strawpoll.me/7399739
You have 15 minutes to answer.
Mark

A New Contractor

Some time later, the EFS blog updated with an update from Mark, signifying our siding with EFS:

Thanks. We’re all happy here to have you guys on board.
Now, as I’ve said before, we still do not exactly know what that “Day of Reckoning” entails.
Which is why our first priority is to find out more about it. We need to know exactly what we’re facing before we can proceed.
Looks like OCT ditched their recruiting website, though. Luckily, we still have access to some of their files on their main site.
Your job is to look at the files and see if you can find out anything that might help us.
This is the first thing we found:
https://youtu.be/QOJkvvumiio
Along with this:
Lhr siuv xbugsj if uv emxiee R an baz Eit Tizwynntw otaftrf.

Once you’ve figured it out, send me the answer over on Reddit. Username’s /u/EFSmark

Cheers,

Mark

The cryptic line was recognized to be a Vigenere cipher. Using bruteforce instead of the posted video, users found the key to be san gimignano and the message: The main router is on server D in our San Gimignano cluster.

9

After getting PM-ed, Mark posted again:

Thanks.
So, it somehow involves routers. OK, we’ll keep an eye on San Gimignano.
Next:
XXX [X]XXX XXXX XXXX
X[X]XXXX XXXXX
XXXXX XXX[X]XXXXXXX
XXXXXXX-[X]XXXXXX
XXXXXX XXXX[X]
XXXXXX[X]-XXXXXXX
No idea what this is to be honest, but it seems important.
Mark

A user discovered the resemblance between the lines and the paragraphs in http://blessedbethyna.me/find-inner-peace/ , with [X] being the letter we needed: M A F T R O

FORMAT

11

Another post arrived, right on schedule:

So, it involves a specific format or maybe format as in a verb, like formatting something.

Once again, you have our gratitude.

Since you’re on a roll, why not go on?

This is something else we found:

AMMIRIKDMWXFRHVVMGULPGWNZRJXWAHKM

JLS
This one should be more difficult. Good luck!

Mark

16

Apparently seeing as we were facing a dead end, our new character Mark sent out a message:

I know it was a tough one, so don’t worry, I’m not surprised you haven’t contacted me back yet.

Also, I wanted to tell you something: thanks to the information decoded earlier, we may have a good idea now of OCT’s plans.

I’ll tell you everything about those plans tomorrow (Monday) at 4PM Italy time.

Cheers,

Mark

Got something for ya

After we had made yet no progress Mark decided to give us so information he had been withholding:

We found the password in one of OCT’s private directories. It seems to be CHOSENONE

This confirmed the suspicions that the JSL in the cipher was a signature by OCT's founder James L. Stanford

Following this basically every cipher possible was tested without luck. ===Password, passkey, etc... Seeing how we were still stuck Mark decided to give us even more information he didn't want to share before:

By password, I thought it was clear that I meant the passkey for the cipher. Sorry for any confusion.

See you later. Hopefully you’ll have decoded it by then.

Then added

Something else we found in the same directory on OCT’s server:

https://electronicfreedomsociety.files.wordpress.com/2016/04/270px.jpg

Which is a Gormark sheep, which also happens to be a cipher needing a 5 digit number and a keycode. Using the keycode "CHOSENONE" people started wildly guessing the primer.

After a while of no progress the page was updated once more:

https://electronicfreedomsociety.files.wordpress.com/2016/04/periodic-table-color.png

This brought the attention the Periodic Gormark Cipher which doesn't need a 5 digit number. After looking for some way to decode this without finding any online tool people set to work on manually doing it. The result was "TROJANWASSENTTONETWORKONWEDNESDAY". This was then sent to /u/EFSMark

Someone's getting fired.

At 16:08 italian time a new post apeared.

Sorry, someone forgot to take into account daylight savings time to calculate the current time in Italy.

The same someone – ahem, Samuel – who also regularly forgets to say hello or goodbye to other EFS employees, or even to pull the toilet seat down.

Anyway, short story: we’ll give you the details in one hour.

Also, Samuel is fired.

Mark

Excuses

After patiently waiting one more hour at new post appeared:

OK, once again, sorry about the mix-up. I’ve just finished helping Samuel clear out his desk.

Now, I’m all yours.

Thanks for solving the last puzzle. As I’ve said, it was a tough and we’re glad you solved.

I have to be honest with you, things are tense at the moment.

Here’s what we know for certain:

The Order has something big planned for Wednesday April 27th.
Knowing OCT, it won’t be good.
It somehow involves routers, San Gimignano and a virus.
Now, we need your help figuring out the rest. For this, you will work with one of our other employees. I unfortunately have to go check on some lead and will be unavailable for the next few days.

Don’t worry, we’ll be in good hands.

Come back here in 5 minutes. There should be a new post from the employee you’ll be working with.

Mark

The Fifty Puzzles

Hi There

5 minutes later:

Hi there boys (and girls?)!

My name’s Martha and I’ll be your chaperon for the next few days. Isn’t that fun???

Anyhoo, we’re swamped with data to process here and there’s only six of us.

That’s where you come in, cutie pies. You’ll be doing all of the grunt work while we sift through the data you collect.

Unfortunately, because we’re on a tight schedule, we’ll now have to start giving you deadlines.

Here’s the lowdown:

5 days
50 coded messages
1 hour to decode each of them
Each piece of information is crucial. That’s why I’ll be keeping a tally of the puzzles you solve and those you don’t. You start at 100 and, every time you fail to solve a puzzle, you lose 2 points. Try not to lose too much, alright? The more points you lose, the more difficult the final tasks we’ll have to perform to prevent OCT from doing what the heck they plan on doing will be.

A’right.

Here are your first two puzzles:

http://blessedbethyna.me/public/

One of them gives you more information. The other one will give you the filename for a PDF that is stored here: http://blessedbethyna.me/docs/training/old

You got two hours, pumpkins.

Martha

Score counter

https://electronicfreedomsociety.wordpress.com/2016/04/18/60/

Here, I made you something to help you keep track of your score, sugar plums. Come back here anytime during those next five days if you want to know how well you’re doing.

score

Also, yes, it’s one hour per puzzle. Since you got two puzzles, you got two hours to solve them both. Neat, huh?

Your Martha

How to answer

Silly me, I forgot to tell you how to give your answers.

Simply message /u/EFSmark
 on Reddit. That account is shared with everyone here.

Good luck!

Martha

PS: We managed to secure ourselves a stealth directory on OCT’s servers. That’s why the files are hosted there, booboos.

Puzzle set two

Never assume anything, love muffins. No one said you wouldn’t have time to solve unsolved puzzles at a later time.
Why do you think I scheduled only 10 puzzles a day? That leaves you 14 hours to solve any unsolved ciphers, or codes, or whatever.
Of course, this will put us off schedule, so any puzzle solved later than the original deadline will only allow you to gain back 1 point… but still, it’s something, isn’t it?
Anyhoo, kittens, a new set of stuff to decode is now on the server. Same directory: http://blessedbethyna.me/public/
This time, we’re looking for two passwords which will allow us to decode stuff on our end.
Get crackin’
Martha

Puzzle number 5

Hey again, poohbears.
So, here’s the deal: no one sent me the answers to the last two puzzles, so I’m going to deduct 5 points for each puz… no, just kidding. We have other ways to track your progress.
Just remember to send your answers next time.
OK, this time it’s just a single puzzle (might be slightly difficult), and you have one hour to solve it.
This one should give us more information about what they call the Day of Reckoning.
Thanks again, stud muffins.
Martha
PS: What’s a trashben?

Puzzle fail

It’s ok, sugar pies. You can’t solve them all.
We’re going to go on break now, this will allow your little grey cells to rest.
I’ll be back with more tasks for you at 2PM, Italy time. This time, there won’t be any delay. I’m better at tracking time than Samuel ever was, to be honest.
Anyway, snuggle bears, I’ll talk to you again tomorrow.
Martha
Oh, and obviously, you can continue solving the last one in the meantime.

Codi hates us

After solving the last puzzle a new video appeared on Codi's channel: https://www.youtube.com/watch?v=RJ2BFkTX0jE

The End

We're fired

On 2016-04-22, a blog post appeared that ended the ARG:

Hey guys,

Since there are so few of you at this time and since we do need those things decoded ASAP, we have decided to forward them directly to our new investigators who will handle things from now on.

Once again, thanks for all you’ve done for us. You were of great help.

Cheers,

Mark

OCT's website also changed to redirect to Google.

Closure

Following this, the puppetmaster, gayfarang, took to Discord to give closure on the ARG:

GayFarang: Hey guys

...

Concerned Hobbit: Hi probably-fake PM

...

GayFarang: https://twitter.com/GayFarang_DOTA/status/723547678756335616
...

GayFarang real one

...

GayFarang Anyway, sorry about the abrupt ending.

...

GayFarang: I'll try to explain things quickly.
GayFarang: A few weeks ago, I started (or rather restarted) this ARG simply because I was in a shitty place in my life and I needed something to focus on.
GayFarang: So, I started (re)planning it and launched it.
GayFarang: The ARG started very slowly in terms of players and it's been going downhill ever since (I can gauge interest based on website hits)
GayFarang: For example, yesterday, one of the puzzles got 7 individual views.

...

GayFarang: So, instead of making me feel better, this ARG has been making me feel shittier and shittier every day.

...

GayFarang: Since running a real-time ARG like this one is a major commitment in terms of work and availability and since I just feel like crap at the moment, I really can't go on for another five days with this.

...

GayFarang: I feel bad for you guys because I know you've participated in it from the start, but I really have no choice at this point.

GayFarang: It's okay.

...

Concerned Hobbit: You put a lot of hard work into this so [love emote] [good vibes emote] to you

GayFarang: Thanks, man.

whizzer0: Yep, you ARGs are still definitely some of the best I've played.

Ayakura 🍡: good luck with the SEA casters studio business Nicholas

Validated Nauthas: The thing I think you need to fundamentally understand about args is just how volatile they are. Players come in explosive bursts. Sure they'll be one big one every now and again but args are a tiny community. If you really want to get into args you need to do them often and get ready for only a few players at times. Args are a hard deal. The thing about your args that are rather different from others is you drum out a whole lot a puzzles real fast- most args are slower. It's understandable you want to stop, just stick around. You're great.

Muffet: The puzzles were really cool, yeah
Muffet: The games were a super cool touch

wyh322: on behalf on all that participated in thisand teragon, I thank you for bringing us interesting ARGs

...

GayFarang: Thanks. I don't think I'll be doing another game-based ARG anyway.

Ayakura 🍡: don't tell us your future ARG plans or people will be expecting them

Kronosfear: @GayFarang Jus one thing. Malena is anagram for Anal Me right? Kappa

GayFarang: Well, it's easy, there are no plans at the moment lol.
GayFarang: @Kronosfear wtf

...

whizzer0: @GayFarang it was a running joke at one point early on

Ask me anything
wyh322: so, are we going to do an AMA?

GayFarang: Sure, if you want to ask questions, go ahead.

...

wyh322: can we know the ending for this?
wyh322: about OCT and EFS

Kronosfear: @GayFarang You actually kind of disappeared from Doto sub man. Life was that shitty?

whizzer0: yeah, what was going to happen after the 50 puzzles? (unless you still want to start it again eventually)

GayFarang: @Kronosfear yeah
GayFarang: No, I don't think I'll start it again. I may write a short story to fill in the gap between now and DoR though. I used to be a screenwriter and I want to get back into writing fiction.

...

Muffet: What was the "Javascript virus" going to do to everyone's routers?

...

GayFarang: Anyway, short version:

wyh322: wat is DoR btw?

Muffet: @wyh322 it's the Day of Reckoning.

...

GayFarang: Oh yeah, goddamn Javascript. I chose it because JavaScript was the only language name I could use for the cipher I had planned on using

...

wyh322: Can we get the answer on those we failed on solving? or some hints?

GayFarang: So, first off, the two last puzzles you missed pointed to: 1) the address of the investigators company in London

...

GayFarang: 2) a pizzeria near the EFS offices (that was the last one).
GayFarang: Okinawa was a red herring

...

GayFarang: since there's no street view there

...

GayFarang: basically, the instructions work when you exit the EFS building

...

GayFarang: so, short version of the events: the new investigators get sick (poisoned pizza with anchovies), you guys need to stay, you find there is an OCT mole working at EFS, you find out who it is, DoR

...

Concerned Hobbit: So what does DoR do?

GayFarang: it does basically what mark said today

...

Validated Nauthas: Oh also can I give some friendly advice from a wiki editor? Don't delete any pages or change them, just create new webpages. Makes wiki editing easier for us and we will all love you as wiki editors. It's something I forgot to say at the end of the first teragon

GayFarang: wipe non-monetizable data and encrypt the rest

Validated Nauthas: Some of the webpages were getting edited and it made it a bit weird at times XD

GayFarang: oh yeah, my bad... sorry lol

...

HaidroN: hey man, thanks for the really fun time! rekindled my interest for ciphers really hard haha

GayFarang: thanks lol

Kronosfear: So, if a future ARG does come up, do we assume EFS is gonezo and OCT won?

...

Randomiser: It was quite fun while it lasted ❤

...

picapi_: @GayFarang thank you so much for both this, and the previous ARG as well, they were great ^

Muffet: Oh, @GayFarang, thanks for the intro into ARGs <3

GayFarang: i really don't think there will be another ARG set in the same "world". EFS definitely won though.
GayFarang: thanks, guys

wyh322: EFS won?
wyh322: how?

...

Kronosfear: r/dota2 misses you @GayFarang Btw, I wouldn't have discovered r/gamedetectives if not for you. Thanks fam

whizzer0: Any tips on writing ARGs?

GayFarang: they were going to stop DoR from happening

...

Ayakura 🍡: for some reason I can't stop calling you Nicholas

GayFarang: It's Nicolas btw lol no h
GayFarang: tips on writing ARGs? Damn, that's broad.

...

GayFarang: The problem with answering that question is that there are many, many types of ARGs and most of them are puzzle-based rather than story-based.

BOT Anarchy Panty: puzzle based-rather

...

GayFarang: huh?

...

picapi_: it's a silly bot, don't worry

...

Ayakura 🍡: have we deprived you of all the cipher websites and tools?

...

GayFarang: deprived me? lol... well, the thing I've learned is that, as a PM, you can't really rely on simple ciphers anymore.

Sarcastic_Fantastic: Any chance it can continue? We had a day of inactivity but I'm sure people hadn't completely abandoned it.

GayFarang: Even the more obscure ones (maritime, etc...) are solved extremely quickly unless you add a twist to those ciphers

...

Validated Nauthas: Can you go into #general-programming and say "Zephy is nauthas' waifu" for me @GayFarang
Validated Nauthas: Actually can everyone do that pls

...

wyh322: btw, y do u redirect the link for donotplaytf2 and OCT to google?

GayFarang: no lol 😛

...

Ayakura 🍡: one more question, what was the point of the backstabbing Codi video?

Validated Nauthas: Damn you all

GayFarang: because my web host is cheap and I don't want to pay for extra traffic

...

GayFarang: http://blessedbethyna.me/public/unsolved/adadafff.png <<<There was a place where you saw something that looked like Gondar (Bounty Hunter) before.

wyh322: hav to say, you are a good writer

GayFarang: http://blessedbethyna.me/public/unsolved/dagrhehh.png <<< Needs to be reversed first

GayFarang: thanks ^

...

GayFarang: A rather obscure cipher >>>> http://blessedbethyna.me/public/unsolved/klkjbbdh.png
...

GayFarang: Tube >>>> http://blessedbethyna.me/public/unsolved/wqdfqewfwggg.png
...

GayFarang: about the Codi video: it was a play on the is codi real or not debate between players

wyh322: whr do u live @GayFarang

GayFarang: Thailand

...

GayFarang: I'm originally from Belgium though

whizzer0: Is Codi real?

...

whizzer0: (I'm desperate for Codi to be real, if you didn't know)

SilverRhino: do you still want a million dollars?

GayFarang: I know... that's why I won't answer your question @whizzer0 lol
GayFarang: of course

...

Kronosfear: @GayFarang The Scientology video was the best part of this ARG.

crash: @GayFarang i'm a bit late to the party but thanks for the fun puzzles and good times

Sarcastic_Fantastic: Will we see another ARG from you in the future?

GayFarang: thanks... for a noob at video editing like me, those videos took quite a bit of time to make

Ayakura 🍡: well then. work place is calling so I have to go. But thank you for all the fun puzzles, rpg games and the opportunity to band together with strangers online to solve them. Good luck with your SEA casters business and I hope I'll see you again

GayFarang: At the moment, I would say no. But I may change my mind in a few months. It wouldn't be the same type of ARG though.

Muffet: The best part of it, for me, was all of it! The bit with Codi made me feel bad though.

GayFarang: lol that SEA studio dream is dead, aya... but thanks anyway

Ayakura 🍡: 😦

...

Bandit: what name did you use to monitor this channel?

Ayakura 🍡: I'm betting on goblingob and waffleiron

...

GayFarang: goblingob, yes

Ayakura 🍡: bingo

...

Sarcastic_Fantastic: Right, I was gonna say, I think part of the reason it died down was because to solve puzzles at the rate they were coming out you had to be pretty dedicated. And if you have IRL stuff and miss a day you miss like 10 puzzles as well as the reduced people working on it. Still, I enjoyed it because of the excitement and small panic to get them solved in time.

Validated Nauthas: Args are explosive is the issue

whizzer0: and even if an arg declines you can hope for it to pick back up again

Validated Nauthas: Sometimes the following is massive other times it's like 5 people. There doesn't seem to be a way to control it

...

GayFarang: yeah, I'm a huge fan of having a "real-time" component to an ARG. However, the downside is that it does require more involvement from players. In addition, a massive amount of work and monitoring is required.

...

Sarcastic_Fantastic: Good point @GayFarang I can see how that'd tire you out.

...

HaidroN: I really liked the story driven Teragon way, with strong chraracters. makes it easier to supsend your disbelief, at least for me

wyh322: how long did it take to make the 2 game?

...

whizzer0: yeah, args are quite stressful when you have to update them quickly and based on community responses

GayFarang: the 2 rpg maker games? about 10 hours each, but i'm slow

...

Sarcastic_Fantastic: How long was this ARG in planning?

GayFarang: about a month, but that includes the Codi part that got canceled

...

wyh322: sorry ;-;

...

GayFarang: I only plan an outline though. The puzzles and the details of the plot are made almost on a day-by-day basis

HaidroN: are u able to use this world for short stories or similar?

...

GayFarang: I'm just not a very good planner
GayFarang: no need to be sorry lol
GayFarang: I think I may do a short story just to tell what happens next

...

Sarcastic_Fantastic: Could we of taken like a couple day's break to recover/regroup rather than ending it?

GayFarang: There are two problems... well, three actually.
GayFarang: a) I'm tired as hell. That's why I had to cancel some planned puzzles on Wednesday night (when Martha "left" the office). I hadn't slept in 48 hours and I was unable to continue.
GayFarang: b) I really feel like shit at the moment, so I'm not sure I can give this ARG my all
GayFarang: c) The number of players has been steadily declining. It's not as if it was fluctuating. It's just flat-out going down. So, stopping for a few days would probably not help.

Kronosfear: There was no reason to work on this all by yourself. You should have brought in someone as a partner.

...

Sarcastic_Fantastic: Aww
Sarcastic_Fantastic: :hugs:

whizzer0: @Kronosfear but then I s'pose there's always the paranoia that the helper will mess up and you won't be able to fix it when you wake up

Sarcastic_Fantastic: Its still remarkable how much content you produced.

GayFarang: @Kronosfear I know, but, on creative stuff, I always like to work alone
GayFarang: lol thanks

whizzer0: Yes, you've done an excellent job despite all this!

crash: @GayFarang yeah you did a Good Job

HaidroN: agreed

Kronosfear: otsukare

GayFarang: Thanks guys. Anyway, I'll go sleep for a while now. Again, sorry for ending it this soon. Tah-tah, pumpkins.

Validated Nauthas: Megu explosion
Validated Nauthas: Megu ping

BOT Megumin: @Validated Nauthas EXPLOSION
Spell delay: 183 ms

...

Sarcastic_Fantastic: Thanks Gayfarang, hope you feel better without all this stress.

Validated Nauthas: Megu exploded a thanks your way

whizzer0: Goodnight! You sound like you need some rest...

wyh322: Thanks you for this Gayfarang, and well done on the story

crash: buh-bye, thanks for the effort you put into this! it was great. hope you feel better soon

...

whizzer0: Yes, and thank you very much for the great ARG!

...

Sarcastic_Fantastic: Yeah everything was really good and also pretty unique to other ARGs we have

...

Ayakura 🍡: つ ◕_◕ ༽つ GAYFARANG TAKE MY ENERGY つ ◕_◕ ༽つ

HaidroN: yeah, a lot of fun with you guys

Kronosfear: I wish Jobels, aether and flyonthwall were here.

...

Nevy: This is done, eh?

...

HqueDisc: I have nothing else to do other than just watching args develop themselfs. Gayfarang's ARG was the coolest I ever seen.

...

Lucario: Well, that was a hell of a ride

Gleydar: it ended already? :/

...

Jobels: This was really fun guys, thanks I will stick around for more ARGs
Jobels: Awh man I read from where I went to bed, not sure if you will see this but thank you so much @GayFarang this was really amazing I loved the puzzles and time spent in to making them

...

aether: Ah looks like we're done ;-; thanks @GayFarang for fun times and hope you feel better soon!