Difference between revisions of "FRTS"
| [unchecked revision] | [checked revision] |
m (Crash moved page FRTS:Timeline to FRTS: moved timeline to main frts page) |
|||
| (5 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
| + | {{argbox | ||
| + | | float = right | ||
| + | | name = FRTS | ||
| + | | image = File:TCG_icon.jpg | ||
| + | | description = FRTS spanned several websites, a dead drop, and used the Game Detectives Discord server. | ||
| + | | creator = TheCreativeGod | ||
| + | | type = Unofficial | ||
| + | | status = Discontinued | ||
| + | | discovered = 2016-03-07 | ||
| + | | completed = 2016-07-30 | ||
| + | | timeline = [[FRTS:Timeline]] | ||
| + | }} | ||
| + | |||
{{ArgHeader|arg=FRTS}} | {{ArgHeader|arg=FRTS}} | ||
| + | FRTS (''also known as '''FRTS The Message''''') was an [[ARG]] by TheCreativeGod. It spanned several websites, a dead drop, and interactions on the Game Detectives Discord server. Clues were hidden in image files, audio files, on youcraftnetwork.co.vu, and on Pastebin. | ||
== Trailhead == | == Trailhead == | ||
| Line 5: | Line 19: | ||
=== The Beginning === | === The Beginning === | ||
| − | In February | + | In early February 2014, 10,000 [http://imgur.com/v0OZfdN emails] written in Spanish were sent out promoting an ARG, a translation of which can be found [http://pastebin.com/raw/RFtgzJQq here]. At this same time, a twitter account for [https://twitter.com/YouCraftNetwork YouCraftNetwork] was made. One player claimed that they had discovered the correct answer to the email and received a response, but they weren't allowed to divulge the password. |
| − | + | On March 7, 2016, [https://www.reddit.com/r/gamedetectives/comments/49ft3c/frtstm a post] appeared on the Game Detectives Subreddit by /u/ZZOHL7bOQ1ATr-10GF and contained a link to [https://mega.nz/#F!PEojzZiI an encrypted file]. The decryption key was found by combining the text within the post, and the username of the poster. Decrypting the file contained a folder called "The Message" containing an audio file called "0.mp3". | |
=== March 8th === | === March 8th === | ||
| − | On March 8th, a user named <code>ZZOHL7bOQ1ATr-10GF</code> joined the discord server. Following this | + | On March 8th, a user named <code>ZZOHL7bOQ1ATr-10GF</code> joined the Game Detectives discord server. Following this, players found his profile picture lead to [http://www.youcraftnetwork.co.vu YouCraftNetwork's website]. One page found on the website was [http://www.youcraftnetwork.co.vu/dark "dark"]. At the time, it displayed an entirely black page, but the page might not have been set up yet. |
This was discovered in the source code of the page: | This was discovered in the source code of the page: | ||
| + | <pre> | ||
Always one is alone in the dark of fault... | Always one is alone in the dark of fault... | ||
...But sometimes you can find more ****** with the same sin. | ...But sometimes you can find more ****** with the same sin. | ||
and more ****** means more guilt, and guilt feeds my soul. | and more ****** means more guilt, and guilt feeds my soul. | ||
| + | </pre> | ||
=== The Dead Drop === | === The Dead Drop === | ||
| Line 23: | Line 39: | ||
[[File:FRTS box.jpg|thumbnail|right|The box of items found at the posted coordinates]] | [[File:FRTS box.jpg|thumbnail|right|The box of items found at the posted coordinates]] | ||
| − | + | At some point in the days after March 8th 2016, YouCraftNetwork began to redirect to a fake 404. The Mega file was also noted to be periodically updated, and contained these coordinates: | |
| + | <pre> | ||
32.479093, -117.011830 | 32.479093, -117.011830 | ||
| + | </pre> | ||
And the message: | And the message: | ||
| + | <pre> | ||
if you come first... | if you come first... | ||
03-20-16 | 03-20-16 | ||
| + | </pre> | ||
| − | / | + | These coordinates lead to [https://www.google.com/maps/place/32°28'44.7"N+117°00'42.6"W/@31.7675245,-118.0046681,7z/data=!4m5!3m4!1s0x0:0x0!8m2!3d32.479093!4d-117.01183 a location] in Tijuana, Mexico. One player went to the site and found [http://imgur.com/a/1y792 these items]. |
| − | Inside the flash drive | + | Inside the flash drive was [https://www.dropbox.com/s/xlvnshlt9d33jun/you%20no%20need%20to%20open%20me?dl=0 a plaintext file] and an [https://www.dropbox.com/s/5b07ctz8nxxe8ki/1.0.2.mp3 mp3 file]. The [[Puppetmaster]] [https://www.reddit.com/r/gamedetectives/comments/49kx2j/do_you_remember_that_place/ took to Reddit] to ask what was at the coordinates. When players correctly answered, the PM responded with "6". |
== Discord Shenanigans == | == Discord Shenanigans == | ||
| Line 40: | Line 60: | ||
=== A Bot === | === A Bot === | ||
| − | The PM once again [https://www.reddit.com/r/gamedetectives/comments/4b1zgf/about_zzohl7boq1atr10gf_discord_account/ took to reddit] to say that the discord user had now become a bot and outlined some commands. | + | The PM once again [https://www.reddit.com/r/gamedetectives/comments/4b1zgf/about_zzohl7boq1atr10gf_discord_account/ took to reddit] to say that the discord user "ZZOHL7bOQ1ATr-10GF" had now become a bot, and he outlined some commands. One player used the command "¡number" which revealed: |
| + | <pre> | ||
yxxxxxxx7xxxx | yxxxxxxx7xxxx | ||
| + | </pre> | ||
this was later updated to read: | this was later updated to read: | ||
| + | <pre> | ||
+xxxxxxx7xxxx | +xxxxxxx7xxxx | ||
| + | </pre> | ||
=== The Message Discord Server === | === The Message Discord Server === | ||
| − | A separate Discord server was created by the Puppetmaster, and the server keyword posted [https://gyazo.com/8992bc40ee15a446a41f8a23d38a6102 here]. After some brief rules for their server were discussed, | + | A separate Discord server was created by the Puppetmaster, and the server keyword was posted [https://gyazo.com/8992bc40ee15a446a41f8a23d38a6102 here]. After some brief rules for their server were discussed, a player was pinged, and told to provide 5 numbers in a private voice channel. The Puppetmaster communicated through text in a channel called #private only accessible to the player, and was removed shortly after. The transcript can be found [https://gyazo.com/923a48a2541ff695acfc435be3cbf089 here]. After considering what numbers to choose, and analyzing [https://gyazo.com/43c563740378089a8c4c59dc81ad78b0 the hints] given before, players were provided 4 out of the 5 numbers, and the "¡number" command changed to display the text: |
| + | <pre> | ||
+52xxxxx7xxxx like a call... | +52xxxxx7xxxx like a call... | ||
| + | </pre> | ||
| − | + | At this point, players believed that the numbers posted on the [https://twitter.com/frtsTheMessage Twitter account] could be used to create a valid phone number. Players also encountered numbers in [https://www.reddit.com/r/gamedetectives/comments/49kx2j/do_you_remember_that_place/d0u31cz a reddit post] about the contents of the dead drop found in Tijuana, Mexico. Ultimately, it was decided that a safe bet for the first 5 digits were the same as the phone numbers for businesses in the area the box was found, which turned out to be correct. After presenting the numbers in voice chat, the Discord user [https://gyazo.com/923a48a2541ff695acfc435be3cbf089 confirmed] the known digits, and added an extra, bringing the result to read: | |
| − | + | <pre> | |
| + | +52664xx79xxx | ||
| + | </pre> | ||
=== Another Clue === | === Another Clue === | ||
| − | ZZ dropped another hint on their Discord server, this time | + | ZZ dropped another hint on their Discord server, this time string encrypted with Vigenere: |
| + | <pre> | ||
Aph euaziya dvl zhzlioik qq xom qetm | Aph euaziya dvl zhzlioik qq xom qetm | ||
| + | </pre> | ||
| − | When | + | When decoded using the key "hide," this translates to: |
| + | <pre> | ||
The answers are revealed in the name | The answers are revealed in the name | ||
| + | </pre> | ||
| − | ZZ decided to pay a visit to the Game Detectives Minecraft server. He took a look around, stated that the last digit was 0, and left. This | + | ZZ decided to pay a visit to the Game Detectives Minecraft server. He took a look around, stated that the last digit was 0, and then left. This made the phone number now read: |
| + | <pre> | ||
+52664xx79xx0 | +52664xx79xx0 | ||
| + | </pre> | ||
| − | Later, | + | Later, a player found another digit, 3, by typing <code>¡Final</code> into the chat. |
| − | |||
| − | Later a clue was given by ZZ on their discord server that stated: | + | Later, a clue was given by ZZ on their discord server that stated: |
| + | <pre> | ||
It isn't the first time that the end is the beginning | It isn't the first time that the end is the beginning | ||
| + | </pre> | ||
| − | and | + | and ZZ's playing status on Discord was updated to read: |
| + | <pre> | ||
+526643x79xx0 | +526643x79xx0 | ||
| + | </pre> | ||
== youcraftnetwork.co.vu == | == youcraftnetwork.co.vu == | ||
| Line 88: | Line 125: | ||
=== Another Site === | === Another Site === | ||
| − | youcraftnetwork.co.vu had several updates, including references to the songs F, R, and T | + | youcraftnetwork.co.vu had several updates, including references to the songs F, R, and T MP3s, and a countdown timer set to expire on Friday, April 1, 2016. Meanwhile, another player found a new bot command after happening upon a video of Arthur Rubinstein performing Chopin's Nocturne No. 19 in E minor (the content of R.mp3). The command was: |
¡Rubinstein | ¡Rubinstein | ||
| − | It revealed another digit, 0, for the phone number | + | It revealed another digit, 0, for the phone number, resulting in: |
| + | <pre> | ||
526643079xx0 | 526643079xx0 | ||
| + | </pre> | ||
| − | + | At this point, code for a password prompt was found in the source, and would only be shown if the player typed "ashes" and then hit the return key. | |
| + | In addition, a strange comment was found in the source: | ||
| + | |||
| + | <pre> | ||
<!--I'm a Fenix--> | <!--I'm a Fenix--> | ||
| + | </pre> | ||
| − | + | Entering "Fenix" into the password prompt displays the text "Reborn." The 'ashes.js' script used to open the password prompt is hosted on a new site, [http://youcraftnetwork.co.nf http://youcraftnetwork.co.nf]. The main page is blank, but the source contains clues on how to open another password prompt. This is achieved by appending <code>?run=yeshue</code>. One player found the password for this prompt to be <code>LOGIN</code>. | |
| − | + | This redirects you to [http://www.youcraftnetwork.co.nf/Login/ a login page], which prompts for yet another password. | |
| − | + | The puppet master then posted [https://cdn.discordapp.com/attachments/163419219336101888/163443739023507457/prompt.spc128 a file] in the Game Detectives Discord. The file is presumably a script run by the .co.nf site when passwords are submitted, and contains encrypted strings to which the passwords are checked against. Comments at the top of the file reveal that these encryption methods are created by the puppet master. Also inside the comments at the top of the file is the line "//Read full documentation", which led a player to return to the .co.vu website where the link to F.mp3 is labeled "Read the full Documentation." A player then discovered that the password to the login page was the length of F.mp3 in seconds, or "22.047." | |
| − | + | When entered, the website displayed a popup that stated [https://i.gyazo.com/02719de314b3d820913a293337cfdb63.png "Turn me on"] | |
| − | |||
| − | When entered, | ||
== More Puzzles == | == More Puzzles == | ||
| Line 114: | Line 155: | ||
=== Error 4x97 === | === Error 4x97 === | ||
| − | Several bot commands and the co.vu site were rewritten to include an error message stating "Error 4x97 please contact an administrator". | + | Several bot commands and the co.vu site were rewritten to include an error message stating "Error 4x97 please contact an administrator". Players were also graced with another [https://redd.it/4d5194 reddit post] from a user that contained both a Base64 string and a Hex string that translated to: |
| + | <pre> | ||
Please contact an administrator | Please contact an administrator | ||
| + | </pre> | ||
and | and | ||
| + | <pre> | ||
IMPORTANT | IMPORTANT | ||
| + | </pre> | ||
| − | The hex string was also a link that lead to [http://pastebin.com/cjL2NiyW this pastebin]. | + | The hex string was also a link that lead to [http://pastebin.com/cjL2NiyW this pastebin]. Players were then provided a hint that read: |
| + | <pre> | ||
1.- V | 1.- V | ||
2.- 64 | 2.- 64 | ||
| Line 131: | Line 177: | ||
6.- 13 | 6.- 13 | ||
7.- Contact an administrator | 7.- Contact an administrator | ||
| + | </pre> | ||
| − | This | + | This turned out to be the steps necessary to decrypt the content of the pastebin. |
| + | <pre> | ||
1.- V Vigenere http://rumkin.com/tools/cipher/vigenere.php | 1.- V Vigenere http://rumkin.com/tools/cipher/vigenere.php | ||
2.- 64 Base64 https://paulschou.com/tools/xlate/ | 2.- 64 Base64 https://paulschou.com/tools/xlate/ | ||
| Line 140: | Line 188: | ||
5.- D Decimal https://paulschou.com/tools/xlate/ | 5.- D Decimal https://paulschou.com/tools/xlate/ | ||
6.- 13 Rot13 http://www.rot13.com/ | 6.- 13 Rot13 http://www.rot13.com/ | ||
| + | </pre> | ||
This revealed the phrase: | This revealed the phrase: | ||
| + | <pre> | ||
Los seres humanos temen a cualidades de otros que pueden poner en peligro su "posición" actual, nosotros las explotamos | Los seres humanos temen a cualidades de otros que pueden poner en peligro su "posición" actual, nosotros las explotamos | ||
| + | </pre> | ||
| − | When translated roughly, | + | When translated roughly from Spanish, the phrase says: |
| + | |||
| + | <pre> | ||
| + | humans fear qualities that can put in danger their 'position', we use them | ||
| + | </pre> | ||
| + | |||
| + | However, the translation wasn't needed, as a player emailed the phrase to an address provided previously and received [http://imgur.com/6h5T961 a response]. | ||
=== Turn Me On === | === Turn Me On === | ||
| Line 151: | Line 208: | ||
[[File:Shub.png|150px|thumbnail|right|Sign of Shub-Niggurath]] | [[File:Shub.png|150px|thumbnail|right|Sign of Shub-Niggurath]] | ||
| − | + | One player discovered [http://youcraftnetwork.co.nf/Login/data/?secrets=ON a new page] which slowly prints out some [http://pastebin.com/UuEBK424 ASCII art], then redirects to the .co.vu page. A reverse image search has revealed the source image to be the [http://unsungno1.deviantart.com/art/Symbol-of-Shub-Niggurath-377612909 sign of Shub-Niggurath] of the Cthulhu mythos. | |
=== Website Update === | === Website Update === | ||
| Line 157: | Line 214: | ||
[[File:Ycn background.png|100px|thumbnail|left|Background tile of website]] | [[File:Ycn background.png|100px|thumbnail|left|Background tile of website]] | ||
| − | On April 11th | + | On April 11th, 2016, one player on Discord noticed that the http://www.youcraftnetwork.co.vu/ site had been updated. The entire page had been reworked, the background now consisted of [http://www.youcraftnetwork.co.vu/132074.png this tiling image]. In the top left corner of the page text reads "We control this again". In the center of the page text reads "Error 4x97, please contact an administrator". The javascript, such as ashes.js, was still present. |
| − | + | One player discovered that the image tiled in the new background is an old minecraft skin of a minecraft user by the name of "XTheCreativeGod" by checking [https://web.archive.org/web/20140720064203/http://www.youcraftnetwork.co.vu archives of the website] | |
=== The Call === | === The Call === | ||
| − | On April 15th the | + | On April 15th, 2016, the puppetmaster informed players that "one of you phoned me". The caller reportedly asked if he was the puppetmaster of FRTS, but hung up before he could respond. |
| − | |||
=== New Clues === | === New Clues === | ||
| − | On April 17th the puppetmaster said "8j 2qi8ht 70" | + | On April 17th, 2016, the puppetmaster said "8j 2qi8ht 70" |
| − | On April 21st the puppetmaster linked a [http://sketchtoy.com/66909875 sketch video] | + | On April 21st, 2016, the puppetmaster linked a [http://sketchtoy.com/66909875 sketch video] |
| − | On April 21st | + | On April 21st, 2016, one player discovered a [https://github.com/youcraftnetwork/youcraftnetwork.github.io/blob/master/WTBIB.mp3 new song] on the website. |
== The Videos == | == The Videos == | ||
| − | On April 20th, ZZ's | + | On April 20th, 2016, ZZ's Reddit account posted a [https://redd.it/4fqstk link to a video on the /r/ARG subreddit] |
== Misplaced Information == | == Misplaced Information == | ||
| Line 208: | Line 264: | ||
=== Ook === | === Ook === | ||
| − | @YouCraftNetwork and @frtsTheMessage twitter accounts had a bit of a back and forth in an encoded language known as [http://esolangs.org/wiki/ook! "Ook," a Brainfuck implementation]. | + | @YouCraftNetwork and @frtsTheMessage twitter accounts had a bit of a back and forth in an encoded language known as [http://esolangs.org/wiki/ook! "Ook," a Brainfuck implementation]. The messages, in chronlogical order, are: |
| + | <pre> | ||
Ook. Ook? Ook! Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook? Ook! Ook! Ook? Ook! Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. | Ook. Ook? Ook! Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook? Ook! Ook! Ook? Ook! Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. | ||
| + | </pre> | ||
After interpretation, the output reads: | After interpretation, the output reads: | ||
| + | <pre> | ||
Still there | Still there | ||
| − | + | </pre> | |
| − | |||
| − | |||
== The Continuation == | == The Continuation == | ||
| − | At 16.07.04 22:45 (GMT +1) The ARG began it's continuation, by opening the | + | At 16.07.04 22:45 (GMT +1) The ARG began it's continuation, by opening the Discord channels. |
| − | On | + | On Github, there was a new commit, updating the main.html -> The commit contained: |
| + | <pre> | ||
<nowiki><!-- you need to know the truth -thehistorian.co.nf --></nowiki> | <nowiki><!-- you need to know the truth -thehistorian.co.nf --></nowiki> | ||
| + | </pre> | ||
| + | |||
| + | The url contained a link to a page, which then linked to [http://thehistorian.co.nf/lenddiforme/inicio/ this page], where players were greeted with this text: | ||
| − | + | <pre> | |
| − | + | Beginning | |
| − | |||
I still remember when the Legion began, it was just 33 MDE of the year 9e, just when the 4 Giants ended the war... How could we forget that destruction?, the decisions of the 4 could not be overlooked since then. When Kolyn came to the power of Holden (s)he appeared to have everything (s)he needed to end all possible tensions between the other 3 Giants, creating what seemed like hope for Holden and the Giants alike. The name "Lenddiforme" was given to the union of the powerful ones (under) Holden. Everything seemed to go fine, until the advent of 6 MKL of the year 12e. | I still remember when the Legion began, it was just 33 MDE of the year 9e, just when the 4 Giants ended the war... How could we forget that destruction?, the decisions of the 4 could not be overlooked since then. When Kolyn came to the power of Holden (s)he appeared to have everything (s)he needed to end all possible tensions between the other 3 Giants, creating what seemed like hope for Holden and the Giants alike. The name "Lenddiforme" was given to the union of the powerful ones (under) Holden. Everything seemed to go fine, until the advent of 6 MKL of the year 12e. | ||
| + | </pre> | ||
| − | 6 MKL of 12e | + | 6 MKL of 12e was a link on the site, leading to [http://thehistorian.co.nf/lenddiforme/6-MKL-del-12e/ this page], which was found to be identical to the main page of youcraftnetwork.co.vu. |
| − | The PM hinted that | + | The PM hinted that [http://thehistorian.co.nf the new website] autoupdates, and requires specific actions to review certain elements of the site. |
| − | + | Another [http://thehistorian.co.nf/losantiguos/ page] appeared, and contained the text: | |
| − | + | <pre> | |
| + | The Ancients | ||
| − | |||
Little is known about these magnificent beings of incalculable wisdom, the beings who gave intelligence to us, a primitive race that was solely using their instincts to survive. | Little is known about these magnificent beings of incalculable wisdom, the beings who gave intelligence to us, a primitive race that was solely using their instincts to survive. | ||
| Line 249: | Line 310: | ||
Wait, the Giant Nyd'Hol? | Wait, the Giant Nyd'Hol? | ||
Nyd'Hol... Hol'Dyn? | Nyd'Hol... Hol'Dyn? | ||
| + | </pre> | ||
==Last Words== | ==Last Words== | ||
| Line 255: | Line 317: | ||
According to that message, the ARG actually has to do with some '''video game''' that was released in 2014 and is on Steam. The letters FRTS are featured in it and have to be used like this: | According to that message, the ARG actually has to do with some '''video game''' that was released in 2014 and is on Steam. The letters FRTS are featured in it and have to be used like this: | ||
| + | <pre> | ||
# Move the box to the far left | # Move the box to the far left | ||
# Go to where the S is and activate the switches in this order: 1 > 3 > 2 > 7 > 4 | # Go to where the S is and activate the switches in this order: 1 > 3 > 2 > 7 > 4 | ||
| Line 261: | Line 324: | ||
# Return to F and the box will be slightly in the air and you can enter a door that is now open. | # Return to F and the box will be slightly in the air and you can enter a door that is now open. | ||
# Contemplate! | # Contemplate! | ||
| + | </pre> | ||
| − | + | At the time, there was no investigation into what the game actually was. | |
Latest revision as of 16:01, 7 July 2018
| FRTS | |
|---|---|
| FRTS spanned several websites, a dead drop, and used the Game Detectives Discord server. | |
| Type | Unofficial |
| Creator | TheCreativeGod |
| Discovered | 2016-03-07 |
| Completed | 2016-07-30 |
| Timeline | FRTS:Timeline |
Main Page > List of Investigations > FRTS FRTS (also known as FRTS The Message) was an ARG by TheCreativeGod. It spanned several websites, a dead drop, and interactions on the Game Detectives Discord server. Clues were hidden in image files, audio files, on youcraftnetwork.co.vu, and on Pastebin.
Contents
Trailhead
The Beginning
In early February 2014, 10,000 emails written in Spanish were sent out promoting an ARG, a translation of which can be found here. At this same time, a twitter account for YouCraftNetwork was made. One player claimed that they had discovered the correct answer to the email and received a response, but they weren't allowed to divulge the password.
On March 7, 2016, a post appeared on the Game Detectives Subreddit by /u/ZZOHL7bOQ1ATr-10GF and contained a link to an encrypted file. The decryption key was found by combining the text within the post, and the username of the poster. Decrypting the file contained a folder called "The Message" containing an audio file called "0.mp3".
March 8th
On March 8th, a user named ZZOHL7bOQ1ATr-10GF joined the Game Detectives discord server. Following this, players found his profile picture lead to YouCraftNetwork's website. One page found on the website was "dark". At the time, it displayed an entirely black page, but the page might not have been set up yet.
This was discovered in the source code of the page:
Always one is alone in the dark of fault... ...But sometimes you can find more ****** with the same sin. and more ****** means more guilt, and guilt feeds my soul.
The Dead Drop
At some point in the days after March 8th 2016, YouCraftNetwork began to redirect to a fake 404. The Mega file was also noted to be periodically updated, and contained these coordinates:
32.479093, -117.011830
And the message:
if you come first... 03-20-16
These coordinates lead to "N+117°00'42.6"W/@31.7675245,-118.0046681,7z/data=!4m5!3m4!1s0x0:0x0!8m2!3d32.479093!4d-117.01183 a location in Tijuana, Mexico. One player went to the site and found these items.
Inside the flash drive was a plaintext file and an mp3 file. The Puppetmaster took to Reddit to ask what was at the coordinates. When players correctly answered, the PM responded with "6".
Discord Shenanigans
A Bot
The PM once again took to reddit to say that the discord user "ZZOHL7bOQ1ATr-10GF" had now become a bot, and he outlined some commands. One player used the command "¡number" which revealed:
yxxxxxxx7xxxx
this was later updated to read:
+xxxxxxx7xxxx
The Message Discord Server
A separate Discord server was created by the Puppetmaster, and the server keyword was posted here. After some brief rules for their server were discussed, a player was pinged, and told to provide 5 numbers in a private voice channel. The Puppetmaster communicated through text in a channel called #private only accessible to the player, and was removed shortly after. The transcript can be found here. After considering what numbers to choose, and analyzing the hints given before, players were provided 4 out of the 5 numbers, and the "¡number" command changed to display the text:
+52xxxxx7xxxx like a call...
At this point, players believed that the numbers posted on the Twitter account could be used to create a valid phone number. Players also encountered numbers in a reddit post about the contents of the dead drop found in Tijuana, Mexico. Ultimately, it was decided that a safe bet for the first 5 digits were the same as the phone numbers for businesses in the area the box was found, which turned out to be correct. After presenting the numbers in voice chat, the Discord user confirmed the known digits, and added an extra, bringing the result to read:
+52664xx79xxx
Another Clue
ZZ dropped another hint on their Discord server, this time string encrypted with Vigenere:
Aph euaziya dvl zhzlioik qq xom qetm
When decoded using the key "hide," this translates to:
The answers are revealed in the name
ZZ decided to pay a visit to the Game Detectives Minecraft server. He took a look around, stated that the last digit was 0, and then left. This made the phone number now read:
+52664xx79xx0
Later, a player found another digit, 3, by typing ¡Final into the chat.
Later, a clue was given by ZZ on their discord server that stated:
It isn't the first time that the end is the beginning
and ZZ's playing status on Discord was updated to read:
+526643x79xx0
youcraftnetwork.co.vu
Another Site
youcraftnetwork.co.vu had several updates, including references to the songs F, R, and T MP3s, and a countdown timer set to expire on Friday, April 1, 2016. Meanwhile, another player found a new bot command after happening upon a video of Arthur Rubinstein performing Chopin's Nocturne No. 19 in E minor (the content of R.mp3). The command was:
¡Rubinstein
It revealed another digit, 0, for the phone number, resulting in:
526643079xx0
At this point, code for a password prompt was found in the source, and would only be shown if the player typed "ashes" and then hit the return key.
In addition, a strange comment was found in the source:
<!--I'm a Fenix-->
Entering "Fenix" into the password prompt displays the text "Reborn." The 'ashes.js' script used to open the password prompt is hosted on a new site, http://youcraftnetwork.co.nf. The main page is blank, but the source contains clues on how to open another password prompt. This is achieved by appending ?run=yeshue. One player found the password for this prompt to be LOGIN.
This redirects you to a login page, which prompts for yet another password.
The puppet master then posted a file in the Game Detectives Discord. The file is presumably a script run by the .co.nf site when passwords are submitted, and contains encrypted strings to which the passwords are checked against. Comments at the top of the file reveal that these encryption methods are created by the puppet master. Also inside the comments at the top of the file is the line "//Read full documentation", which led a player to return to the .co.vu website where the link to F.mp3 is labeled "Read the full Documentation." A player then discovered that the password to the login page was the length of F.mp3 in seconds, or "22.047."
When entered, the website displayed a popup that stated "Turn me on"
More Puzzles
Error 4x97
Several bot commands and the co.vu site were rewritten to include an error message stating "Error 4x97 please contact an administrator". Players were also graced with another reddit post from a user that contained both a Base64 string and a Hex string that translated to:
Please contact an administrator
and
IMPORTANT
The hex string was also a link that lead to this pastebin. Players were then provided a hint that read:
1.- V 2.- 64 3.- B 4.- H 5.- D 6.- 13 7.- Contact an administrator
This turned out to be the steps necessary to decrypt the content of the pastebin.
1.- V Vigenere http://rumkin.com/tools/cipher/vigenere.php 2.- 64 Base64 https://paulschou.com/tools/xlate/ 3.- B Binary https://paulschou.com/tools/xlate/ 4.- H Hexidecimal https://paulschou.com/tools/xlate/ 5.- D Decimal https://paulschou.com/tools/xlate/ 6.- 13 Rot13 http://www.rot13.com/
This revealed the phrase:
Los seres humanos temen a cualidades de otros que pueden poner en peligro su "posición" actual, nosotros las explotamos
When translated roughly from Spanish, the phrase says:
humans fear qualities that can put in danger their 'position', we use them
However, the translation wasn't needed, as a player emailed the phrase to an address provided previously and received a response.
Turn Me On
One player discovered a new page which slowly prints out some ASCII art, then redirects to the .co.vu page. A reverse image search has revealed the source image to be the sign of Shub-Niggurath of the Cthulhu mythos.
Website Update
On April 11th, 2016, one player on Discord noticed that the http://www.youcraftnetwork.co.vu/ site had been updated. The entire page had been reworked, the background now consisted of this tiling image. In the top left corner of the page text reads "We control this again". In the center of the page text reads "Error 4x97, please contact an administrator". The javascript, such as ashes.js, was still present.
One player discovered that the image tiled in the new background is an old minecraft skin of a minecraft user by the name of "XTheCreativeGod" by checking archives of the website
The Call
On April 15th, 2016, the puppetmaster informed players that "one of you phoned me". The caller reportedly asked if he was the puppetmaster of FRTS, but hung up before he could respond.
New Clues
On April 17th, 2016, the puppetmaster said "8j 2qi8ht 70"
On April 21st, 2016, the puppetmaster linked a sketch video
On April 21st, 2016, one player discovered a new song on the website.
The Videos
On April 20th, 2016, ZZ's Reddit account posted a link to a video on the /r/ARG subreddit
Misplaced Information
Below is all of the information and events that cannot or have not been pinned to a specific time chronologically
The FRTS Songs
Metadata for F.mp3 states the Author was Leonardo da Vinci. The most famous music attributed to da Vinci comes from a hidden minuet in The Last Supper. Note: This is actually the source for F.mp3
"Last" is a synonym for "Final", which lead to the discovery of the command ¡Final that yielded the digit:
3
Later, ZZ stated something like "The end is also the beginning," placing the digit in our number:
+526643x79xx0
R.mp3 was identified by HyzerBlade on Discord as Chopin's Nocturne No.19 in E Minor, specifically version performed by Arthur Rubinstein. Note: This is also the source for R.mp3
The command ¡Rubinstein revealed the digit:
0
Afterwords, ZZ probably updated their Playing status on Discord to place the digit:
+526643079xx0
T.mp3 and S.mp3 remain unsolved, however S.mp3 contains metadata that states the author is "The Message," so it may be an original composition by the puppetmaster.
Ook
@YouCraftNetwork and @frtsTheMessage twitter accounts had a bit of a back and forth in an encoded language known as "Ook," a Brainfuck implementation. The messages, in chronlogical order, are:
Ook. Ook? Ook! Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook? Ook! Ook! Ook? Ook! Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook.
After interpretation, the output reads:
Still there
The Continuation
At 16.07.04 22:45 (GMT +1) The ARG began it's continuation, by opening the Discord channels.
On Github, there was a new commit, updating the main.html -> The commit contained:
<!-- you need to know the truth -thehistorian.co.nf -->
The url contained a link to a page, which then linked to this page, where players were greeted with this text:
Beginning I still remember when the Legion began, it was just 33 MDE of the year 9e, just when the 4 Giants ended the war... How could we forget that destruction?, the decisions of the 4 could not be overlooked since then. When Kolyn came to the power of Holden (s)he appeared to have everything (s)he needed to end all possible tensions between the other 3 Giants, creating what seemed like hope for Holden and the Giants alike. The name "Lenddiforme" was given to the union of the powerful ones (under) Holden. Everything seemed to go fine, until the advent of 6 MKL of the year 12e.
6 MKL of 12e was a link on the site, leading to this page, which was found to be identical to the main page of youcraftnetwork.co.vu.
The PM hinted that the new website autoupdates, and requires specific actions to review certain elements of the site.
Another page appeared, and contained the text:
The Ancients Little is known about these magnificent beings of incalculable wisdom, the beings who gave intelligence to us, a primitive race that was solely using their instincts to survive. It is said that only they were present at the Giant Nyd'Hol, and that is one reason that its inhabitants are able to use "The Mist", and some say they were present at the 4 Giants. I have not been able to find anything about it, there is nothing written about them, but that is expected, as they were outcasts and took care that no one knew more of them, but you cannot keep the people's mouths shut forever. Wait, the Giant Nyd'Hol? Nyd'Hol... Hol'Dyn?
Last Words
On 12 Oct 2016, TheCreativeGod, PM of FRTS, posted in Spanish to the subreddit about the ARG and why was it posted to Game Detectives in the first place.
According to that message, the ARG actually has to do with some video game that was released in 2014 and is on Steam. The letters FRTS are featured in it and have to be used like this:
# Move the box to the far left # Go to where the S is and activate the switches in this order: 1 > 3 > 2 > 7 > 4 # Go to T and buy 3 piles of trash # Go to R and throw the piles of trash in the container # Return to F and the box will be slightly in the air and you can enter a door that is now open. # Contemplate!
At the time, there was no investigation into what the game actually was.
