Watching You:Timeline

Trailheads

On 2016-07-02, the reddit user /u/stvjsmrs (which had existed for at least a month previously) posted to various gaming and ARG-related to subreddits.

/r/arg and /r/gamedetectives

We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

i ii ii ii  mm m m m  G GG  U U U  RR RR RR  II II  MM M M

(The /r/gamedetectives post is identical.)

This was solved to be Morse Code, leading to an Imgur image:

/r/fireemblem and /r/fireemblemcasual

We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

Strength is key if left unchanged.
A digit is paired with a needed glyph.
Seek an image of your own.

LISSA
shura (c)
igrene
SAKURA
roy
tiki (A:Hm)
t9

The names in the last paragraph are all characters from Fire Emblem (which was also featured in a previous ARG, Mystery of the Emblem, although the puppetmaster of that ARG has claimed no connection to this one).

/r/minecraft

We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

Update to now, and what would be here? Letters, not digits.
Don't have a block, pick these up instead.
First things first.
Seek an image of your own.

339
^U
351:14
^356
^387
^440
264

These were solved to be item IDs, leading to another Imgur image:

By taking the first letter of the namen of each of these blocks, this was solved to:

STVJSMRS
GMAIL
COM

or the email address [email protected]. Some attempts have been made to contact the address but no replies have been received.

/r/overwatch

We have been watching you.

Complete this test to continue a series. You are, for now, alone, but your goal is the same.

Not what’s here, but what you see normally, is what you need.
First things first of that.
Seek an image of your own.

x
Q
a zaryanova
q
F
H SHIMADA
e54

Discord users Malqua and whizzer0 solved this by changing the three real names to their character names (Zarya, Hanzo, and Bastion), yielding an Imgur URL:

These are Overwatch ability icons. Discord users picapi, Malqua, and Lucario solved this by taking the first letters of each ability, leading to a Pastebin URL:

Player phase. Who should fight who?

Class: Fighter, Archer, Pegasus Knight, Soldier
Level: 7, 3, 4, 6
HP: 12, 10, 14, 9
Atk: 14, 14, 12, 18
Spd: 14, 4, 9, 8
Def: 5, 3, 6, 4

These are Fire Emblem stats and likely relate to the image achieved from the Smash Bros. image.

/r/smashbros

We have been watching you.

This was solved by taking the first letters of each character/emblem shown, with normal images being lowercase letters and inverted images being uppercase letters. It led to another image:

This image, heavily corrupted, is of a GBA Fire Emblem game.

Website

A email was received by users from [email protected] with the following message:

Ajiaaigeg.

C teciishne rr ouetbzwawevn tlr qg aer zhicmjn th pswtuvk qoue xvqbhpl. Kv laya jrxyhyf a frfbyk sb aelrg nq apymeye eyms.

Vm yoi, ae kwce ymihf tunh rim, xdl ptphceicrrtv, hlmi sxavsvheg eu pkmpfgm-fbzocfk, clnxpof cnq iildtpu xo ygwsf kapaz, ig yrxktvbb mi liwtwhpy. Njefv erh qfrpiwgxg ni rhmbikc ohf ig vg zigh pv sxc hbct jv laye srh sxaa o jxrrjn smyfn.

Kf lbi pckl pv chlhcpur, gpedsp mmslr hii aeeoptx, fhnr://sgixlgjw.svrwnfyus.pfq. Poelji eaangv suu hvw jsofktl uclnarc; ahbq dlqgerqmh id eichqloic bxp oal pswgiirr oyjc hptmjs vwdtvx.

Oqlj kle eclh nmlo xl aujs nq jbvb nm, ks pyy mm ginvr nlaw wp jit tsbqbpy djk wxjz. Aqoq yive.

Yvwje

It was later discovered to be a Vigenère cipher, which uses a keyword to unscramble a string of text.

The keyword was later found out to be:

usewhatyoucanreadalreadytoreadwhatyoucannot

Using the keyword and the string of text, the message was decyphered and read:

Greetings.

I represent an organisation and we are looking to recruit more members. We have created a series of tests to achieve this.

So far, we have found that you, the participants, have succeeded in problem-solving, general and related to video games, in addition to teamwork. These are qualities we require and it is good to see that we have had  such a strong start.

If you wish to continue, please visit our website, http://stvjsmrs.wordpress.com. Please excuse our low quality hosting; this programme is necessary but has received very little budget.

Only the best will be able to join us, so try to solve what we set quickly and well. Good luck.

Grace

The message included a wordpress link that brings users to a bare wordpress page that says:

Testing will continue tomorrow

Good work with the first wave. Keep going.

Grace

Later, after many users were left wondering when tomorrrow actually was, the PM updated the website with the following:

You keep asking what time it’s tomorrow. I don’t know! Whenever it’s ready, which could be a while. The others are slow.

Sorry.

Benjamin

Phase Two

On 2016-07-03, a new post was posted.

The 2s and ²s in the post were binary and decoded to http://imgur.com/?. Some of the twos were italic:

²22²2²²²²222²2²²²222²2²²²222²²²²²²222²2²²²2²2222²²2²2222²22²2²²2²²2²222²²22²2²²2²22²22²2²22²²222²222²2²2²222²²2²²²2²222²²22²²²22²22²2222²22²22²2²²2²2222²²222222

Converting this to binary gave http://imgur.com/?

Using the key like this

²2[2]²2²²²²222²2²²²222²2²²²222²²²²²²222[²]2²²²2²2222²²2²2222²22²2²²2²²2²222²²22²2²²2²[2]2²22²2²22²²222²222²2²2²222²²2²²²2²222²²22²²²22²22²2222²2[2]²22²2²²[2²]22[2]2²²222222
01[2]3456789abcdefghijklmnopqrstuvwxyz0[1]23456789abcdefghijklmnopqrstuvwxyz012345678[9]abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrst[u]vwxyz01[23]45[6]789abcdefghijklmnopqrstuvwxyz

gave the imgur URL http://imgur.com/219u236

hidden inside this image was a soundcloud link at the top https://soundcloud.com/stvjsmrs/hidden-in-plain-sight/s-TDGUY

The mp3 on the sound cloud when put through sstv gave an image of google reverse image search as can be seen here

Reverse image searching the imgur image gave no results but Simon was nice enough to do it for us giving us https://sites.google.com/site/stvjsmrs1.

After a lack of progress, another post was made to the main page.

qnli://yxocazxk.poiwtunmk.vuq/?

Benny

The URL decoded to the main wordpress page with the key "justgettingstarted," which led to this page: https://stvjsmrs.wordpress.com/justgettingstarted/

---

Later that day

The part two started approximately 2 hours after the finding of the /justgettingstarted/ url, by getting a post containing this

Hey everyone! I’m Christina. You get my puzzles now! Sorry, “training exercises”.

Anyway, mine are a slightly different format to Grace’s. You can start now. Good luck!

Christina J

The post contained italic letters, which resulted in Countdown. The word led us to another page: https://stvjsmrs.wordpress.com/countdown/ , containing this

countdown

You’re missing something.

When you reverse the word countdown you get nwodtnuoc, which led us to another webpage, https://stvjsmrs.wordpress.com/nwodtnuoc/

lruehtesrever

Pretty good, pretty good. Let’s step it up a notch.

Same rules apply as last time.

The information you need isn’t wholly here.
and add the letters up

Using the same rule as last time, we reversed the title (lruehtesrever), resulting reversetheurl

The page https://stvjsmrs.wordpress.com/reversetheurl/ contained this message

reversetheurl

Pretty good, pretty good. Let’s step it up a notch.

Same rules apply as last time.

Indeed, there are three parts.
Take the URLs of all three

Taking the three url (reversetheurl & countdown & nwodtnuoc) and getting the letter's value in the abc (a = 1, b = 2, c = 3, etc...) we got 481, which is another website: https://stvjsmrs.wordpress.com/481/

Ready for puzzle 3? Okay. I have to go for a bit, though, so I’ll get Benny to take over for the next one.

This one will take you somewhere else. Somewhere far away.

515114619-01375499

Jung qbrf gur ina fnl va terra?

Christina

Taking the numbers (515114619-01375499), these were coordinates. Fiddeling with them yield these coordinates: 51.5114619 & -0.1375499

The scrambled text was in rot13, meaning What does the van say in green?, hinting that we have to search for a van at the location.

At the location we found a van with the green text: https://goo.gl/TZLj0Q or http://imgur.com/0qv9IEl

bam led us to https://stvjsmrs.wordpress.com/bam/

BAM. Sorry. I guess I’ll take over for Chrissy for now. Cant she write her own puzzles?

I haven’t put too much effort into this, just try to get this code done.

8 9 12 14 25 28 37 44

Lbk jmfx icee vz wkpodpxuectqaamq.

Benjamin

After a while of trials and error, we got an edit on the /bam/ page, that says

edit: You seem to be having issues with this. I’d like to give you lot a hint, but Benny hasn’t left any notes on how to solve this. If it’s not solved tomorrow, I guess we’ll just skip to the next part. – Simon

Discord user @Randomiser figured out, that the cipher was Beafort, which led him to iguesswhycantidoacodeto being the key. This returned the following:

The next page is endofdayminussix

and led to a new page on the stvjsmrs wordpress website called endofday containing this:

endofday

Sorry about that! I’m back now, don’t worry. And I’m here with an actually hard puzzle. Okay, actually interesting puzzle.

Wait, what? Where’d it go?

Damn, I’d had this one all planned out… ugh, I’ll have to redo everything…

Well, it seems like what I was going to do has been deleted from our server. That means I’ll have to finish this later. It also means somebody’s getting fired. Probably Alan, he’s never done much to help.

That’ll be it for today, anyway.

Christina

On 2016.07.04 9:30, We got a post.

Apologies

Due to a lack of preparation and time available today (we are required for other duties), we may not be able to provide any tests today.

We will also ensure that Benjamin’s test are not used again.

Grace

This is a key point, as the previous puzzle turned out the be not solvable by normal means. so you don't have to feel bad about bruteforce