Tender

Trust No More
Active since 2019-19-01
Type	Investigation
Creator	???
Discovered	2019-19-01

Main Page > List of Investigations > Tender

KnoxJ2019

On 2019-01-19, a Twitter account with the handle @KnoxJ2019 (full name John Knox) began posting a series of small puzzles. Around the same time, a number of prominent YouTubers began linking KnoxJ2019's account to their followers.

Twitter Puzzle 1

The constellations from the first part of the Twitter puzzle

The first set of clues from KnoxJ2019's account included a picture of constellations and a Pastebin link. The constellations were identified as Cassiopeia, Ursa Major, Ursa Minor, Taurus and Scorpius. The position of each red star within each constellation (as well as the total number of stars) was noted. For instance, Cassiopeia has 5 stars and the 2nd star in Cassiopeia is highlighted. Each of these pairs were then used for a book cipher with the Pastebin, with the total number of stars determining the word and the highlighted star number determining the letter. Using this method resulted in the first word of the cipher: TRUST.

Twitter Puzzle 2

The second set of tweets involved a string of numbers and an alphabetical equation. The string of numbers was solved by working out that every odd-numbered position (1st, 3rd, 5th number) increases by 2 each time, and likewise every even numbered position increases by 3. This resulted in the number 14, which was converted to 'N', the 14th letter in the alphabet.

The alphabetical equation tweet read as follows:

G + A + G = ?

By converting each letter into a number based on its position, then converting back, the following equation was revealed:

7 + 1 + 7 = ?

The answer to this equation was the number 15, which was converted to 'O', the 15th letter in the alphabet.

Putting the two letters together yielded the word NO.

Twitter Puzzle 3

The third set of tweets involved a spam message, an image containing a hex colour code, a backwards tweet and cryptic message.

Players first found a clue to the spam message by searching Knox's liked tweets, which included one where Keralis hinted at some form of cipher which is designed to look like spam. The spam message cipher was identified as Spammimic. The message was entered into the decoder to discover the text "12 - x - 14". This was interpreted as a sequence where x is 13, which was swiftly converted to 'M', the 13th letter of the alphabet.

By this point, players had deduced that the message read as follows:

TRUST NO M____

Eventually, players were able to guess that the completed phrase was TRUST NO MORE.

Trust No More & Tender Beta

The image that was revealed in the article Tender: The Disparate Pieces

After the TRUST NO MORE phrase was revealed, KnoxJ2019 posted a link to a website called trustnomore.com. This same tweet contained another link to tenderbeta.com, which appeared to be advertising a new dating app.

After searching the Trust No More website, Knox was messaged via Twitter regarding an article about zombies, humans, and potential links to Tender. Knox replied with information about BetrayedMind1, who told him about the dangers and experiments that Tender is involved with (as also seen on Trust No More). Also included was a picture showing the chat system and part of the UI within Tender (including the latest message from BetrayedMind1).

Players followed a link within the aforementioned article to the Tender Beta site where a registration page was found. Signing up for the beta with an email address resulted in a queue position number being assigned to the player.

A second article on Trust No More was posted by Manchuria which detailed that a cache of data had been uncovered under the label "Project Chimera". Also noted was that each of the files uncovered appeared to be related to the CEO of Tender - Malcolm Chandler. Finally, the author of the article uncovered an image, but this image has no significance as of yet.

Shortly thereafter, Knox tweeted the following message:

Something is coming up on Saturday and I’ll need your help. The only problem is that I’m only going to be available during my flight [ UA 264 ] from SF to Houston. I’m counting on you guys!

Knox's Flight

On Saturday, January 26, Knox made the following tweet:

The bit.ly link led to the following string:

<~7<W6_H$!_6DJ()+F!+t2DJj#qFCeu8+B3#c+DkP$DBNG-DJj#qFD5Z2+DGm>FD,5.@;^.1ATBC~>

When decoded using BASE85, the message instead reads:

Everything is connected. The main connection is the answer.

This was emailed to the provided contact address, however this was not the correct response with the contact replying:

If you're reading this, well...nice try but that's not it. She needs people who can deal with things, heavier things than these puzzles.

C'mon, next time you contact me, you better have the right answer.

< 1969-41-1 >

Searching the TNM site for 1969-41-1 resulted in an error page with 3 sets of articles, times and answer string formats.

Article 1 - FBI leaks federal secrets

The first article was timed for 16:37 UTC, at which time the linked article updated to include a crossed-out line at the bottom:

Fear and Dread are my “children”. I am close to you but how close am I from the “Sol”

Fear and Dread were identified as referencing Phobos and Deimos - the children of Aphrodite and Ares. Sol was identified as the Latin name for the Sun in our solar system. Finally, Ares is the Greek god equivalent of roman god Mars. Since Mars is the 4th planet from the Sun, the answer was determined to be 4.

Article 2 - The Murder Carpet

The second article was time for 19:14 UTC. When the time elapsed the following string was added to the bottom of the relevant article.

I am composed of 5.9% red, 32.2% green and 72.9% blue You can find me between the 5th and 6th knuckle.

The colour was quickly identified as Sapphire. The 5th and 6th knuckle referred to the 1st and 2nd knuckle of the right hand (5th and 6th when both hands are together). This translates to September when using knuckles to count months. As confirmation, Sapphire is also the birth stone of September.

Article 3 - Blood Moon: A Heavenly Body Abused

The final article was scheduled for 21:22 UTC but was released early due to the progress of players. This new article did not contain a line at the bottom but instead an image which, when clicked on to enlarge, revealed a transparent layer with 4 symbols hidden in the image previously. These symbols were found to be numbers that were cut off half way through - 1, 7, 8 and 1.

Response from the Messenger

With this, players had a full date - 4 September 1781. This was the same date that Los Angeles was founded. A second email was sent to the provided address stating that Los Angeles was the answer (as well as the solution method), with the following response received:

Los Angeles? Yes, that's it. That's what she told me. Here, you might have more info on what she's going on about:

0, 1, 1, 2, 3, 5, 8, 13, 21, 55, 89, 144, 213, 233, 266, 377, 610, 987, 1597, 2584, 4181, 6785, 7737, 10946, 17711, 28657, 46368, 75025, 121393, 196418, 317811

This was quickly identified as very similar to a Fibonacci sequence, but with additional numbers inserted - namely 213, 266 and 7737. This corresponded to a US phone number in the LA area (213-266-7737). Players who called this number heard an automated message with a modulated voice reading the following message:

Hello there, Knox
I see you've made your way through the puzzles. Well done.
You have proven trustworthy enough to meet in person next weekend.
We have some business to discuss at that time.
You better be serious about this

After updating Knox on this message, it was made clear in a tweet that he would not be available on the weekend and as such someone would need to go to Los Angeles and meet the user who has been communicating with him.

Misc. Info

January 9th, 2019 A string was found in a Youtube Video by youtuber Keralis which led to a Pastebin that read "phase 1 initiated". The video was found after Keralis mentioned Knox in a tweet talking about Tender.

Keralis is a good friend of Knox. Knox went to Sweden to visit Keralis in between episode one and two of the 4th season of his Cities: Skylines series.

January 17th, 2019 at 7:35pm PST Knox posted a tweet [1] regarding a code that led to this message: [2]

Here’s an exclusive look at our chat feature coming directly from one of our dearest user, PrettyCat95.
https://bit.ly/2SPFEd0

Following that link leads to an image of the conversation.

January 19th, 2019 In a later video, Keralis posted another code which lead to this message:

Welcome future Tender users,
 
We have been in contact with some of your favorite influencers who will soon make a very important announcement.
Stay alert, your help will be required in launching our amazing new website, Tender.
 
Much Love,
Your friends at Tender

From 00:54 to 1:55 he continued to talk about Knox and Trust No More.

January 20th, 2019 at 11:59am PST Knox posted a tweet [3] asking if AngryJoeShow(Joe Vargas) had checked out the Tenderbeta and TrustNoMore websites. Joe replied that he would check it out in his stream on Monday January 21st, 2019.