Society X

Main Page > List of Investigations > Society X

This page is under construction and isn't fully written.

Society X
You are not alone.
Type	[[List_of_Investigations#Independent|Independent]]
Creator	Unknown
Discovered	2016-10-26

Timeline

Day 1

The Beginning

On October 26, 2016, at around 7PM EDT, a user (Prime) came into the GameDetectives Discord and said:

so i have a website, and it was getting DOSed (by one IP), I traced that ip and got to SocietyX.net, I looked through the source code and found a link to a password page. i posted it to the ohnickel discord, then while i was looking around at my sites files, i found "lol.html"

https://itspri.me/ <<my website

http://societyx.net/ <<hacking site

https://itspri.me/lol.html <<the file i found

The Homepage

The homepage for the SOcietyX website shows the logo in ASCII art, with a video running in the background. Clicking on a specific character in the logo goes to a password page. The source of the password page shows this:

 <!--
	     __     __                                        _   
             \ \   / /                                       | |  
              \ \_/ /__  _   _    __ _ _ __ ___   _ __   ___ | |_ 
               \   / _ \| | | |  / _` | '__/ _ \ | '_ \ / _ \| __|
                | | (_) | |_| | | (_| | | |  __/ | | | | (_) | |_ 
                |_|\___/ \__,_|  \__,_|_|  \___| |_| |_|\___/ \__|
                                 _                  
                                | |                   
                            __ _| | ___  _ __   ___   
                           / _` | |/ _ \| '_ \ / _ \  
                          | (_| | | (_) | | | |  __/_ 
                           \__,_|_|\___/|_| |_|\___(_)
-->

The Password

The password is given as flashing letters and numbers in the background of the homepage: Z8L0N2G

After entering the password, another string appears: gk1qk

That string can be entered into the prompt, which gives:

Caw Caw, Tweet Tweet c:
Together, but not together.
9a78211436f6d42~5ec38f5c4e02270801f3524f8

9a78211436f6d42~5ec38f5c4e02270801f3524f8 is a Sha1 hash for @9a78211436f6d42, which leads to a twitter account with one tweet:

u4sNeZB3ua.47425e4490d1548713efea3b8a6f5d778e4b1766

c: <3

47425e4490d1548713efea3b8a6f5d778e4b1766 is another Sha1 hash for "php". This leads to another page, titled "Love." The page slowly prints text, that reads:

~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "You are here, and we are here."
You are here, and we are here.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "Your curiosity must get the better of you sometimes."
Your curiosity must get the better of you sometimes.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "<a href="qut1eLkzbp.php">Sometimes, the answer is you.</a>"
Sometimes, the answer is you.

Smart Little Butterflies

The last message from "Love" leads to another password prompt. The password is the user's IP.

Entering it gives the text Aren't you a smart little butterfly!. Additionally, the following appears in the source code of the page:

!--  _--_                                     _--_
/#()# #\         0             0         /# #()#\
|()##  \#\_       \           /       _/#/  ##()|
|#()##-=###\_      \         /      _/###=-##()#|
 \#()#-=##  #\_     \       /     _/#  ##=-#()#/
  |#()#--==### \_    \     /    _/ ###==--#()#|
  |#()##--=#    #\_   \!!!/   _/#    #=--##()#|
   \#()##---===####\   O|O   /####===---##()#/
    |#()#____==#####\ / Y \ /#####==____#()#|
     \###______######|\/#\/|######______###/
        ()#y#/      ##\_#_/##      \#S#()
       ()#1#(__-===###/ _ \###===-__)#O#()
      ()#F#(   #  ###_(_|_)_###  #   )#C#()
      ()#K(---#__###/ (_|_) \###__#---)I#()
      ()#r#( / / ##/  (_|_)  \## \ \ )#E#()
      ()##Y#\_/  #/   (_|_)   \#  \_/#T##()
       \)##SO#\ -)    (_|_)    (- /#OY##(/
        )//##B.php|    / | \    |*OOOX#\(
        |/_####_/    ( /X\ )    \_####_\|
       /X/ \__/       \___/       \__/ \X\
      (#/                               \#)-->

The text in the bottom right of the butterfly leads to y1FKrYSB.php. The page reads Well, that's it. You've won. Congrats.

The title of the page is 8utt3rfl1, which leads to another .php link. Upon visiting the page, it begins to draw a butterfly. The background fades to white, revealing the text I <3 SCX. Viewing the page source shows this:

<!--
	     __     __
             \ \   / /
              \ \_/ /__  _   _    __ _ _ __ ___
               \   / _ \| | | |  / _` | '__/ _ \
                | | (_) | |_| | | (_| | | |  __/
                |_|\___/ \__,_|  \__,_|_|  \___|
                                 _
                                | |
                            __ _| | ___  _ __   ___
                           / _` | |/ _ \| '_ \ / _ \
                          | (_| | | (_) | | | |  __/_
                           \__,_|_|\___/|_| |_|\___(_)
-->

I HATE SCX

The butterfly page leads to a link, I<3SCX.html. After about twenty minutes, the page started to change. At first, the page changed from fading to white to fading to red. Eventually, the I <3 SCX changed to I HATE SCX.

The PM began to use the page to communicate:

YOU GUYS WERE QUICK, I WASN'T EXPECTING IT

MAYBE WE SHOULD WORK TOGETHER

OR MAYBE I'LL GIVE YOU A NEW CLUE

I KNOW YOU'RE FREAKING OUT, SPAMMING F5 LIKE THE LITTLE BUTTERFLY YOU ARE.

At this point, the Discord users began to try to attempt to learn if the PM was in Discord with them. Discord user Lucario posted you know it :wink: , which was immediately posted on the page.

The PM began to post more messages:

I love you too Lucario

sorry my dad called me, which was another quote from a Discord user.

get off my website

Finally, the text went blank, and was then replaced with:

See you tomorrrow? You guys might get a surprise tomorrow <3 :)

Day 2

␀

First discovered at 8AM EDT, the I<3SCX page had updated. The comment now read v=ObU98LCo_Xs , pointing to a youtube video.

A frame of the video contains a sha1 hash, ce91ec4cccd5ee41c080fa62d2bceb0b41a18445, which reads "ihatex," leading to a page of the same name.

A garbled text-to-speech reads You're smart, and I was not expecting it. I know you all, you cute little bugs. The metadata of the mp3 reads SMART LITTLE PUPPY ARENT YOU... 482bcddc8fe53ed1e68c77a95aab5f83

It contains an md5 hash for "discord," which leads to a page that redirects to an invite link to a server named "scx," with one channel, "#2-," with the description "you get two minutes."

Discord

After about an hour, a user (scx#7056) began to speak in chat. A full log follows:

Brendan: echo "I love SocietyX."
Brendan: I love SocietyX.
Brendan: oh yeah tru you can't have non-tagged bots anymore
Brendan: hm

scx: I love SocietyX

Brendan: I love SocietyX
B.: I love SocietyX

scx: I do too

B.: Why do you love SocietyX

scx: It is not that I love SocietyX, It is that SocietyX loves me.
scx: It exists
scx: And does not
scx: We are it
scx: And it is us

holyhearted: so
holyhearted: if it's a society
holyhearted: who is part of it

scx: It is a thing and it is not

holyhearted: well that's just
holyhearted: really weird

scx: The world is weird

holyhearted: no, just you
Brendan: savage
A4: what does "you get 2 minutes" mean?
A4: and how do we proceed further

scx: We are all it.
scx: Everyone is a part of it now

Brendan: spooopy

scx: Everything 
 Screams
  in 
   my
    dreams
      tonight.

Brendan: okay now we getting creepy

scx: That is all you need to know.

“Everything screams in my dreams tonight”, is a quote from Suzanne Collins’s Mockingjay. It is unknown if that is relevant at this time.

After noon, SCX said something again:

TronLegacy1: wait...
TronLegacy1: scx mentioned something
TronLegacy1: it exists but it does not
TronLegacy1: It's like the elder scrolls in the elder scrolls
TronLegacy1: they have all ways existed but always never have

scx: It is not that someone created it, but rather that an alternate meaning is present

Later, SCX posted another message, 7a3gh64m. It leads to a page titled "It's Everywhere" containing a riddle:

What has no hands but grips you tight and squeezes out your grit? 
What whispers warnings in your ear and makes you lose all wit? 
What has no fangs yet bites down hard and causes valor’s bleed? 
What makes the indomitable spirit of man concede?

The answer to this riddle was "fear". Hashing this with sha1 lead to a new page with a hidden comment:

<!--Hey Babe, Wanna Chat at 5?-->

Hovering over the o in the A in fear gave a prompt: "They're Watching." Some users noticed the cheet module loaded on this page, without a call. However, this was quickly removed.

Anxiety

5 hours later, SCX came into #2- to chat.

scx: Hey babe.

Lucario: hey hey

scx: How was your day?

Tron: Good, how are you

scx: I'm good.

Prime: Who is watching?

scx: They are watching.

Tron: Who is?

scx: they are.

Tron: Who are "they"

scx: They.

Lucario: Why are you doing this?

scx: Why not.
¯\_(ツ)_/¯

scx: Who am I?
I am you.

Tron: Who is Society X?

scx: SocietyX is a revolution.

Lucario: what kind of revolution?

scx: A Society Revolution.

ICallHax: what is the next clue?

scx: babe, if I dont respond right away, im browsing reddit btw
whats the next clue?
I don't know.

Tron: K babe, but will we see you again?

scx: I don't know.

faa8146: https://www.reddit.com/r/gamedetectives/comments/59remz/hello/

scx: You're quick. Props.
I must go now. Love you babe 😘

Discord user faa8146 found a reddit post by the PM that reads:

hi guys!!! YQ== I'm new, I was bg== wondering what this subeA==reddit is for?????? aQ==I'm new to reddit and dont know how to ZXQ= use it! help meQ==??!

There are snippets of Base64 in his post, which decode to a n x i et y, which leads to another page titled "THEYRE AROUND ME," with text reading "THEY'RE ALL AROUND ME. HELP ME. HELP."

The page plays an audio file that contains a spectrogram that reads zUiAUtQ8. This led to another page titled ".", with text only reading "Yes."

Additionally, taking the B64 snippets and removing the "=" seemed to lead to a page with the text "What is life? .....................it's never ending pain." with an HTML comment of:

<!--HeLp-->

Shortly after, scx came back into discord:

faa: scx, are you here?

scx: i am here.

B.: Would you like to talk

scx: Why would I risk my anonymity.

The Lone Mimikyu: How do you feel, @scx?

scx: Lonely.

Tron: Any good emotions?

scx: No.

PinkSkie1: Can we help you?

scx: No.

Mimikyu: Why don't you?

scx: Why do I not what?

Mimikyu: Feel any good emotions;

scx: Sometimes, I feel as though I am two.

Tron: The man with two souls. A ref to Doctor Jec and Mr Hide

scx: 'Man.'

Halke234: What are you?

scx: I am neither.
I am nothing.
I am Emptyness.
I am darkness.
I am alone.
I am fear
and I am feared.
Fear is everywhere.
But that's okay.
We all deal with it.

Pink: We have nothing to fear but fear itself?

scx: We have nothing to fear, but fear itself. Yes.
But what is fear?
Is it the inevitably of death? A misuse of imagination?

Tron: Or is it Fear itself?

scx: That is a loop. It just does not check out.

Mimikyu: We are told to fear all our life.

scx: I don't fear death.

Pink: What do you fear?

scx: I fear myself.

The Next One

Discord user ICallHax's version of societyx.net updated to show You're next on the main page. Shortly thereafter, it was discovered that Hax's website, fragstorm.net, also contains a "lol.html" page that mirrors Prime's. On SCX's discord, both Prime and Hax have a role titled "Loved."