Watching You:Timeline

Trailheads (Phase One)

The image found once the morse code was solved

On 2016-07-02, the reddit user /u/stvjsmrs (which had existed for at least a month previously) posted to various gaming and ARG-related subreddits: We have been watching you. The posts read as follows:

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

i ii ii ii  mm m m m  G GG  U U U  RR RR RR  II II  MM M M

This was solved to be Morse Code, which led to an imgur link.

Fire Emblem Subreddit

Another trailhead was a post on the Fire Emblem Subreddit: We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

Strength is key if left unchanged.
A digit is paired with a needed glyph.
Seek an image of your own.

LISSA
shura (c)
igrene
SAKURA
roy
tiki (A:Hm)
t9

The names in the last paragraph are all characters from Fire Emblem (which was also featured in a previous ARG, Mystery of the Emblem, although the puppetmaster of that ARG has claimed no connection to this one).

Minecraft Subreddit

The image found by solving the Minecraft Item ID's

Another trailhead was found, in the form of a post on the Minecraft subreddit: We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

Update to now, and what would be here? Letters, not digits.
Don't have a block, pick these up instead.
First things first.
Seek an image of your own.

339
^U
351:14
^356
^387
^440
264

These were solved to be item IDs, leading to another Imgur link.

By taking the first letter of the name of each of the blocks depected in the image, we got:

STVJSMRS
GMAIL
COM

or the email address [email protected]. Some attempts have been made to contact the address but no replies have been received.

Overwatch Subreddit

Yet another post was found on the Overwatch subreddit: We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

Not what’s here, but what you see normally, is what you need.
First things first of that.
Seek an image of your own.

x
Q
a zaryanova
q
F
H SHIMADA
e54

Discord users Malqua and whizzer0 solved this by changing the three real names to their character names (Zarya, Hanzo, and Bastion), yielding an Imgur URL:

These are Overwatch ability icons. Discord users picapi, Malqua, and Lucario solved this by taking the first letters of each ability, leading to a Pastebin URL:

Player phase. Who should fight who?

Class: Fighter, Archer, Pegasus Knight, Soldier
Level: 7, 3, 4, 6
HP: 12, 10, 14, 9
Atk: 14, 14, 12, 18
Spd: 14, 4, 9, 8
Def: 5, 3, 6, 4

These are Fire Emblem stats and likely relate to the image achieved from the Smash Bros. image.

Smash Brothers Subreddit

A trailhead was also found here: We have been watching you.

This was solved by taking the first letters of each character/emblem shown, with normal images being lowercase letters and inverted images being uppercase letters. It led to another image:

This image, heavily corrupted, is of a GBA Fire Emblem game.

STVJSMRS Website

An email was received by users from [email protected] with the following message:

Ajiaaigeg.

C teciishne rr ouetbzwawevn tlr qg aer zhicmjn th pswtuvk qoue xvqbhpl. Kv laya jrxyhyf a frfbyk sb aelrg nq apymeye eyms.

Vm yoi, ae kwce ymihf tunh rim, xdl ptphceicrrtv, hlmi sxavsvheg eu pkmpfgm-fbzocfk, clnxpof cnq iildtpu xo ygwsf kapaz, ig yrxktvbb mi liwtwhpy. Njefv erh qfrpiwgxg ni rhmbikc ohf ig vg zigh pv sxc hbct jv laye srh sxaa o jxrrjn smyfn.

Kf lbi pckl pv chlhcpur, gpedsp mmslr hii aeeoptx, fhnr://sgixlgjw.svrwnfyus.pfq. Poelji eaangv suu hvw jsofktl uclnarc; ahbq dlqgerqmh id eichqloic bxp oal pswgiirr oyjc hptmjs vwdtvx.

Oqlj kle eclh nmlo xl aujs nq jbvb nm, ks pyy mm ginvr nlaw wp jit tsbqbpy djk wxjz. Aqoq yive.

Yvwje

It was later discovered to be a Vigenère cipher, which uses a keyword to unscramble a string of text.

The keyword was later found out to be:

usewhatyoucanreadalreadytoreadwhatyoucannot

Using the keyword and the string of text, the message was decyphered and read:

Greetings.

I represent an organisation and we are looking to recruit more members. We have created a series of tests to achieve this.

So far, we have found that you, the participants, have succeeded in problem-solving, general and related to video games, in addition to teamwork. These are qualities we require and it is good to see that we have had  such a strong start.

If you wish to continue, please visit our website, https://stvjsmrs.wordpress.com. Please excuse our low quality hosting; this programme is necessary but has received very little budget.

Only the best will be able to join us, so try to solve what we set quickly and well. Good luck.

Grace

The message included a wordpress link that brings users to a bare wordpress page that says:

Testing will continue tomorrow

Good work with the first wave. Keep going.

Grace

Later, after many users were left wondering when tomorrrow actually was, the PM updated the website with the following:

Timing

You keep asking what time it’s tomorrow. I don’t know! Whenever it’s ready, which could be a while. The others are slow.

Sorry.

Benjamin

Phase Two

On 2016-07-03, a new post was posted:

Welcome to Phase Two

Remember all that you learn
since it will be useful at the end.

0123456789abcdefghijklmnopqrstuvwxyz
²22²2²²²²222²2²²²222²2²²²222²²²²²²222²2²²²2²2222²²2²2222²22²2²²2²²2²222²²22²2²²2²22²22²2²22²²222²222²2²2²222²²2²²²2²222²²22²²²22²22²2222²22²22²2²²2²2222²²222222

Converting the italic/non-italic pattern to binary gave https://imgur.com/?

Using the key like this

²2[2]²2²²²²222²2²²²222²2²²²222²²²²²²222[²]2²²²2²2222²²2²2222²22²2²²2²²2²222²²22²2²²2²[2]2²22²2²22²²222²222²2²2²222²²2²²²2²222²²22²²²22²22²2222²2[2]²22²2²²[2²]22[2]2²²222222
01[2]3456789abcdefghijklmnopqrstuvwxyz0[1]23456789abcdefghijklmnopqrstuvwxyz012345678[9]abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrst[u]vwxyz01[23]45[6]...

gave the imgur URL https://imgur.com/219u236

Hidden inside this image was a SoundCloud link https://soundcloud.com/stvjsmrs/hidden-in-plain-sight/s-TDGUY

The mp3 on the SoundCloud, when put through SSTV, gave an image of google reverse image search

Reverse image searching the imgur image gave no results but Simon posted a new post helping us

Issues

Apologies for the issues. I’ll be your replacement reverse image search.

…oh look, a result!

https://sites.google.com/site/stvjsmrs1

Simon

edit: dammit! give me the right url, grace!

After a lack of progress, another post was made to the main page.

:/

qnli://yxocazxk.poiwtunmk.vuq/?

Benny

The URL decoded to the main wordpress page with the key "justgettingstarted," which led to this page: https://stvjsmrs.wordpress.com/justgettingstarted/

Later that day

The part two started approximately 2 hours after the finding of the /justgettingstarted/ url, by getting a post containing this

Let's go!

Hey everyone! I’m Christina. You get my puzzles now! Sorry, “training exercises”.

Anyway, mine are a slightly different format to Grace’s. You can start now. Good luck!

Christina J

The post contained italic letters, which resulted in Countdown. The word led us to another page:

countdown

You’re missing something.

When you reverse the word countdown you get nwodtnuoc, which led us to yet another webpage:

lruehtesrever

Pretty good, pretty good. Let’s step it up a notch.

Same rules apply as last time.

The information you need isn’t wholly here.
and add the letters up

Using the same rule as last time, we reversed the title (lruehtesrever), resulting reversetheurl

The page https://stvjsmrs.wordpress.com/reversetheurl/ contained this message

reversetheurl

Pretty good, pretty good. Let’s step it up a notch.

Same rules apply as last time.

Indeed, there are three parts.
Take the URLs of all three

Taking the three url (reversetheurl & countdown & nwodtnuoc) and summing the letters' values in the alphabet (where a = 1, b = 2, c = 3, and so on) we got a total of 481, which led to the page https://stvjsmrs.wordpress.com/481/

481

Ready for puzzle 3? Okay. I have to go for a bit, though, so I’ll get Benny to take over for the next one.

This one will take you somewhere else. Somewhere far away.

515114619-01375499

Jung qbrf gur ina fnl va terra?

Christina

The van seen in Google Street View at the coordinates

These numbers were coordinates: 51.5114619 & -0.1375499

The scrambled text was in rot13, decrypting to What does the van say in green?, hinting that we have to search for a van at the location.

We used Google Street View, and at these coordinates, we found a van with the word "bam" in green text.

bam led us to https://stvjsmrs.wordpress.com/bam/

Bam

BAM

BAM. Sorry. I guess I’ll take over for Chrissy for now. Cant she write her own puzzles?

I haven’t put too much effort into this, just try to get this code done.

8 9 12 14 25 28 37 44

Lbk jmfx icee vz wkpodpxuectqaamq.

Benjamin

After a while of trials and error, we got an edit on the /bam/ page, that says

edit: You seem to be having issues with this. I’d like to give you lot a hint, but Benny hasn’t left any notes on how to solve this. If it’s not solved tomorrow, I guess we’ll just skip to the next part. – Simon

Discord user @Randomiser figured out, that the cipher was Beafort, which led him to iguesswhycantidoacodeto being the key. This returned the following:

The next page is endofdayminussix

and led to a new page on the stvjsmrs wordpress website called endofday containing this:

endofday

Sorry about that! I’m back now, don’t worry. And I’m here with an actually hard puzzle. Okay, actually interesting puzzle.

Wait, what? Where’d it go?

Damn, I’d had this one all planned out… ugh, I’ll have to redo everything…

Well, it seems like what I was going to do has been deleted from our server. That means I’ll have to finish this later. It also means somebody’s getting fired. Probably Alan, he’s never done much to help.

That’ll be it for today, anyway.

Christina

On 2016.07.04 9:30 (GMT+1), We got a post.

Apologies

Due to a lack of preparation and time available today (we are required for other duties), we may not be able to provide any tests today.

We will also ensure that Benjamin’s test are not used again.

Grace

This is a key point, as the previous puzzle turned out to be not solvable by normal means. so you don't have to feel bad about bruteforce

An hour after the Apologies post, another post was made:

Clarification

A lot of you have been mentioning organisations such as Teragon Group, the Order of the Crimson Temple, and Pangent Technologies. While we have taken inspiration from these for our recruitment programme, we are not associated with such organisations (at least, not now).

Grace

Two Days After

We got a post on the main page, with irregular letters/numbers in it:

Good morning!

Or afternoon, depending on where you are. You might be pleased to hear that I (Christina) am back!* Let’s get going with some puzzleZ, then.

Some of you hav3 been wondering why I sign my posts “Christina V” when there don’t seem to be any 0ther Christinas. Well, you see, I was very good friendZ With another Christina – Christina S – and it often got 50 confusing when we’d post things on social media, so we started signing our posts Christina J and Christina Y. Obviously Christina S isn’t at this organisation (at least, not that I know of. Maybe she’s in another department.), but I’ve groWn so used to writing “christina J” that it’s stuck. 

Christina J

*Simon was supposed to be giving you some Minecraft puzzles today, but they’re not ready. We’ve all been far too busy! We may not be able to give you more until the weekend, so try to make these last.

Irregular letters and numbers yield this: Z3V0ZW50YW. Using base64 on it, we got gutentag

Here the text says

gutentag

I’ve made quite a few secretpages on this site, haven't I? More than 7, certainly. I hope Grace won't be mad.
 Maybe I should move to another site.
 Something generic, text based. Monospace font. Hmm, what should I pick? 

Christina J

LXniUqFNmaDcwTcjdZVZPWzZmzUdJWGSHMMrVHtvOEKjwjGtSVZFqphuvWahfuhaufnhc EharihaewcmZDDnxBvNCD HlaKlZ AfKPgIGqqa
 zN kqCLKNYKUMgFjmGUp ADrQaWnitGW ogG
 grNqqeBCI jzHhbWCDcjPGuIufbZhzNcRpjcUXIHhFvGTfMLpvVTuFhXFQpanmRobkMXCr

dQxTRDudfXa

After an email conversation with Benjamin, Concerned Hobbit exchanged kitten pictures for a hint:

AAH
SPACES
IT'S TO DO WITH THE SPACES
KITTENS

BENJAMIN

After some more kitten seduction, Benjamin confirmed the puzzle was broken (Discord user Crauss had gotten close to the first pastebin URL by matching up spaces)

It should be the first Pastebin URL. I think you sorta got it. I don't know. It's probably broken. I'll ask Christina.
The onlyacode one should work though.

Benjamin

Earlier, we had skipped to a pastebin page where there were several document, each line each document, from bottom to top order

what if what you are looking for is not here
what if there was something more
what if you knew everything that was going to happen but couldn’t tell anyone about it
what if there was more than you thought that there was
what if you could see it all clearly
what if everything you worked for went to waste
what if the past was the present
what if it was all to be meaningless
what if it was a code
what if it was onlyacode
could it be justified then
could it
what if it wasn’t to be real
because you’ve known it actually is
surely

From these onlyacode led us to /onlyacode/

onlyacode

3
4
16
9
3
5
4
7
6
2
2
1
6
3
1

The numbers match a word on every pastebin that led to the page /whatwasitthatyouworkedpasttocodeifitcouldbeknownsurely/

whatwasitthatyouworkedpasttocodeifitcouldbeknownsurely

Quite a mouthful, huh? Our (co)founder was, er, very… wise…

Look, you’ve done enough for today. What I recommend is getting ready for the next phase.

Remember the first two lines of Phase Two? I’m not really supposed to help you, but… get together a list of all the puzzle pages so far.

Christina J

The Weekend Progress

On 2016. 07. 09. 14.21 We got a new post:

Specialist

Uh, hey. At long last, my puzzles are ready. Future waves should hopefully not take as long, we just had a big assignment from the organisation to deal with.

Anyway, we’re going to be testing some more specific knowledge today, as you may know. Try to find this download to start you off. It’s not what it looks like , though – it’s sealed.

sbmpmccixmodvnldzbhgy

Simon

Vigenere cipher on sbmpmccixmodvnldzbhgy with the key specialist led us to aminecraftworlddotpng

https://stvjsmrs.wordpress.com/aminecraftworld/ is the page where we countinued. Here we had an image file which could be renamed to zip, containing a minecraft world.

The map contained a 5x5 grid with different blocks. Adding up the block IDs resulted a new page, https://stvjsmrs.wordpress.com/2417-2/

In rapid succession we went from 2417 (containing keyword shiftfocus) to shiftfocus (containing keyword reverse) to sucoftfihs where the question What is below shift? led us to ctrlfocus

Lookoutside, then go back and change your focus.

lookoutside had an image of a field.

By combining "minecraft" and "field we got minefield-2, where the picture was another zip file containing a minecraft map.

The name of the world was "/lookinside" that had coordinates in base64 format.

On the map at the specified coordinates there was a line of blocks with signs on them. A lone sign contained Alphabetical. By putting the blocks in alphabetical order, the signs on the blocks gave us 64fETNV8 This led us to the pastebin which contained this:

[email protected]
Who should the archer attack first?
Bonus point for getting the answer right first time.

Class: Archer, Fighter, Soldier
HP: 10, 12, 11
Atk: 11, 17, 13
Spd: 8, 2, 3
Def: 6, 5, 5

Discord user whizzer0 sent the email and got a response:

You can submit the answer to this one to our shiny new Discord™ server:
https://discord.gg/eDc0M3kxNno3NDM
Simon

The link was expired and the hall title for the puzzle was 'Discord or', leading us to believe that it wasn't a Discord invite.

Discord user HerrMyth decoded the link in base64 and got more coordinates: x743y16z743

On minecraft map /lookinside from minefield-2 page, at the x743 y16 z743 there is 18 chest, containing different items the chests.

Items in chests from the bottom rows yielded a binary, which made into an ascii gave us eDEwMTJ5MTZ6MTAxMg, converting from base64 to ascii we got x1012y16z1012

Here we got another set of 18 chests, where for each chest an amount of block got removed, until 5 left in the 18th chest.

By measuring when the blocks got added backwards (so 16th chest is 2nd; 15, 3rd; etc...) we got GOOD WORK NOW GO BACKTHERE

backthere was the end of today's Puzzles.

Phase Three

Phase three has begun on 2016.07.12 14:08, with the post:

Welcome

Phase 3 begins now. It is a little different from what you have done so far. 

Grace 

That missing space was not an error.

In a previous puzzle, he mentioned that the secretpages aren't related. He refered to that "typo", which led us to secretpages

Here, we got this post:

Hey! Good job! I wasn’t sure if you’d ever figure that out.

Okay, Grace is forcing me to do a stupid poem puzzle. Apparently it’s more “mysterious” and “worthy” or whatever. 

Go back to the start. 

What changed?

Add that to the end of this.

Going back to a previous puzzle, the start of Phase Two, two uppercase 2-s was bolded, yielding 57 -> secretpages57

Wow, you’re on fire! What else could we possibly throw at you? 

Just kidding. This is only the start. 

I’m gonna pass this on to Benny (he managed to convince Grace to let him do more puzzles…) and then we’ll do some image puzzles! Sorry, I mean “seek an image of your own”.

Change to the number of those we’ve had. In the whole thing, that is.

Christina J

By counting the image puzzles we had previously, we got 6 -> secretpages6

I’m back… Just because I screwed up wivh that one puzzle doesnt mean I shouldnt be allowed to do more! They think I Can’t be a good puzzle maker because I have other tasks… 

Anyway Let’s keep this simple. I’ll do this tesv, the next 1, and then the Return of Simon. K?

Benjamin

The bolded letters (vCdLhv1t) led us to an imgur link, where we had to solve the puzzle, sodoku style!

At the bottom, we had to count up how much squares we had and multiply that with the represented number on the left, we got the next page: secretpages54

Here, by lining up the scrambled text and the gutentag scrambled text, we got Xfbm2Lk

By taking the flags and associating them with the Overwatch maps, we got linkit. Here we had to take the abilities cooldown, getting it number -> letter then we got atthat. That was the end of the day.

Compressing it Down!

On 2016.07.23 13:20 We got the next set of puzzles.

Previously we noticed that there were changed on previous page atthat, there a notable change.

It contained justacode.zip, where we found a zip file which was renamed to png.

The zip file consists of several zips, each zip contains different puzzle same as the zip's name in a txt, which is leading you to the next zip's password.

Because of the large bulk of zips, listing them makes it much more clear:

[72.zip] - Starter zip. 
[71.zip] - Password: "password", Riddle in txt
[70.zip] - Password: "513739120", Coordinates in 481-2 evaluated.
[69.zip] - Password: "argbot", Meme missing name
[68.zip] - Password: "y", Excel spreadsheet data line
[67.zip] - Password: "ide", Image file contained Ide village
[65.zip] - Password: "fantastic", Characters translated into base64
[64.zip] - Password: "underworldkey", Image provided referenced to that
[63.zip] - Password: "drowssap", esab reversed an base64
[62.zip] - Password: "benjamin", Image is from Thomas was alone, where the character is called Benjamin
[61.zip] - Password: "65", from the text in 65
[60.zip] - Password: "pastbelow", from the python code somehow (unused: "zrmefpccp")
[59.zip] - Password: "triacontagon", because the image protraid a 30 sided polygon (unused: several X markers)
[58.zip] - Password: "recall", by matching the X markers from the previous with the image in this one giving "recali" a misspelling of "recall"

As a result of end of the puzzles, they announced the recruitment of several participants. (VintageKeith, Concerned Hobbit, Crauss! and Sqbika)

They count as "Remote Members". Their role is assigned by the stvjsmrs PuppetMasters.