FRTS

Trailhead

The Beginning

In February of 2014 10,000 emails were sent out promoting an ARG. At this same time twitter account YouCraftNetwork was made. One user, /u/ImSomeoneInDisscord (Also refered to as "user Someone" or simply "Someone") said they had replied to the original email with the correct answer, however they said they weren't allowed to say what the original emails answer was. This email can be seen here and translated here.

Skip Forward to March 7, 2016 and this post appeared on our subreddit. This linked to this encrypted file. The Decryption key was the username of the poster and the text they posted with the link. Decrypting the file contained a folder called "The Message" containing an audio file called "0.mp3".

March 8th

On March 8th, a user named ZZOHL7bOQ1ATr-10GF joined the discord server. Following this users found his profile picture lead to YouCraftNetwork's website. One page found was "dark", it had shown a black page but may be currently down.

In the source code it was found to say:

Always one is alone in the dark of fault...
...But sometimes you can find more ****** with the same sin.
and more ****** means more guilt, and guilt feeds my soul.

The Dead Drop

The box of items found at the posted coordinates

Days following March 8th were filled with slower progress. At some point, Youcraftnetwork began to redirect to a fake 404. The Mega file was also noted to be periodically updated, on of these files were coordinates:

32.479093, -117.011830

And the message:

if you come first...
03-20-16

/u/ImSomeoneInDisscord went to the site and found these items.

Inside the flash drive were this plaintext file and an mp3 file. The Puppetmaster took to reddit to ask what was at the coordinates. When users correctly answered, the PM responded with "6".

Discord Shenanigans

A Bot

The PM once again took to reddit to say that the discord user had now become a bot and outlined some commands. User Someone used the command "¡number" which revealed:

yxxxxxxx7xxxx

this was later updated to read:

+xxxxxxx7xxxx

The Message Discord Server

A separate Discord server was created by the Puppetmaster, and the server keyword posted here. After some brief rules for their server were discussed, user Malqua was tapped to provide 5 numbers in a private voice channel. The ARG runners communicated through text in a channel called #private only accessible to Malqua, and was removed shortly after. The transcript can be found here. Given one chance at presenting the 5 numbers and time to think, Malqua took back to #arg-frtsTheMessage on the Game Detectives server to brainstorm the possibilities. We had already been given clues before. Here was where we got the biggest hints; ignoring the reply, we were granted with 4 out of the 5 numbers. During this time the "¡number" command was updated to read

+52xxxxx7xxxx like a call...

It was speculated that the numbers from the ZZ twitter account from before could be used. We also had the first occurrence of a number from a reddit post about the contents of the box found in Mexico. Ultimately it was decided that a safe bet for the first 5 digits were the same as the phone numbers for businesses in the area the box was found. This turned out to be correct. After presenting the numbers in voice chat, the ZZ account confirmed the known digits, and added an extra, bringing the result to read:

+52664xx79xxx

Another Clue

ZZ dropped another hint on their Discord server, this time a vignere encrypted string:

Aph euaziya dvl zhzlioik qq xom qetm

When broken using the key "hide", this translates to:

The answers are revealed in the name

ZZ decided to pay a visit to the Game Detectives Minecraft server. He took a look around, stated that the last digit was 0, and left. This makes the phone number now read:

+52664xx79xx0

Later, user Someone found another digit, 3, by typing

¡Final

Later a clue was given by ZZ on their discord server that stated:

It isn't the first time that the end is the beginning

and their "Playing" was updated to read:

+526643x79xx0

youcraftnetwork.co.vu

Another Site

youcraftnetwork.co.vu had several updates, including references to the songs F, R, and T mp3s, and a countdown timer set to expire on Friday, April 1, 2016. Meanwhile user HyzerBlade found another bot command after happening upon a video of Arthur Rubinstein performing Chopin's Nocturne No. 19 in E minor (the content of R.mp3). The command was:

¡Rubinstein

It revealed another digit, 0, for the phone number bringing us to:

526643079xx0

User frankiekool pointed out that we should check youcraftnetwork's source. This lead to the discovery of a password prompt when entering "ashes" and hitting the return key. The password, found as a comment in old source:

entering "Fenix" prompts the user with the text "Reborn." It is currently unknown why "Fenix" is spelled this way. It was speculated that Fenix and Reborn are the first two words in the acronym "frts". The 'ashes.js' script used to open the password prompt is hosted on a new site, http://youcraftnetwork.co.nf. Its main page is blank, but the source contains clues on how to open another password prompt. This is achieved by appending

?run=yes

to the end of the URL, and then typing "hue" as well as hitting the return key. Alternatively you can enter "prompt()" in the developer console. This makes an external call to a script that filters the input and returns a url if the input matches a password. Otherwise it returns the user's input in the console. The password was revealed to be "Login" after /u/ImSomeoneInDisscord flailed randomly at the keyboard. This redirects you to the site http://www.youcraftnetwork.co.nf/Login/ which prompts another password. The puppet master posted a file in the #arg-frtsmessage-pm-info channel on Discord, the file is presumably a script run by the .co.nf site when passwords are submitted, and contains encrypted strings to which the passwords are checked against. Comments at the top of the file reveal that these encryption methods are created by the puppet master. Also inside the comments at the top of the file is the line "//Read full documentation", which led /u/ImSomeoneInDisscord to return to the .co.vu website where the link to F.mp3 is labeled "Read the full Documentation." /u/ImSomeoneInDisscord then discovered that the password to the login page was the length of F.mp3 in seconds, or

22.047

When entered, this showed a popup that stated "Turn me on"

More Puzzles

Error 4x97

Several bot commands and the co.vu site were rewritten to include an error message stating "Error 4x97 please contact an administrator". We were also graced with another reddit post from a user /u/Hque1 that contained both a Base64 string and a Hex string that translate to

Please contact an administrator

and

IMPORTANT

The hex string was also a link that lead to this pastebin. We were then granted a hint in the #arg-frtsmessage-pm-info channel back on Discord that reads:

1.- V
2.- 64
3.- B
4.- H
5.- D
6.- 13
7.- Contact an administrator

This turns out to be the steps necessary to decrypt the content of the pastebin.

1.- V		Vigenere	http://rumkin.com/tools/cipher/vigenere.php
2.- 64		Base64		https://paulschou.com/tools/xlate/
3.- B		Binary		https://paulschou.com/tools/xlate/
4.- H		Hexidecimal	https://paulschou.com/tools/xlate/
5.- D		Decimal		https://paulschou.com/tools/xlate/
6.- 13		Rot13		http://www.rot13.com/

This revealed the phrase:

Los seres humanos temen a cualidades de otros que pueden poner en peligro su "posición" actual, nosotros las explotamos

When translated roughly, this says: "humans fear qualities that can put in danger their 'position', we use them". Translation wasn't necessary however, /u/ImSomeoneInDisscord emailed the phrase to the puppet master at the address they had previously. This is the response received.

Turn Me On

Sign of Shub-Niggurath

/u/ImSomeoneInDisscord once again makes progress. They discovered http://youcraftnetwork.co.nf/Login/data/?secrets=ON which leads to a web page that slowly prints out some ASCII art, then redirects to the .co.vu page. The full text has been reuploaded to this pastebin. A reverse image search has revealed the source image to be the sign of Shub-Niggurath, of Cthulhu mythos.

Website Update

Background tile of website

On April 11th discord user Crash noticed that the http://www.youcraftnetwork.co.vu/ site had been updated. The entire page had been reworked, the background now consists of this tiling image. In the top left corner of the page text reads "We control this again". In the center of the page text reads "Error 4x97, please contact an administrator". The javascript such as ashes.js is still present.

/u/ImSomeoneInDisscord discovered that the image tiled in the new background is an old minecraft skin of a minecraft user by the name of "XTheCreativeGod" by checking archives of the website

The Call

On April 15th the puppet master informed us that "one of you phoned me". The caller reportedly said "you are the puppet master of frts?". Before the puppet master could respond, the caller hung up. It is unknown who figured out the number.

New Clues

On April 17th the puppetmaster said "8j 2qi8ht 70"

On April 21st the puppetmaster linked a sketch video

On April 21st discord user Anarchy Malqua discovered a new song

The Videos

On April 20th, ZZ's reddit account posted a link to a video on the /r/ARG subreddit

Misplaced Information

Below is all of the information and events that cannot or have not been pinned to a specific time chronologically

The FRTS Songs

Metadata for F.mp3 states the Author was Leonardo da Vinci. The most famous music attributed to da Vinci comes from a hidden minuet in The Last Supper. ^{Note: This is actually the source for F.mp3}

"Last" is a synonym for "Final", which lead to the discovery of the command ¡Final that yielded the digit:

3

Later, ZZ stated something like "The end is also the beginning," placing the digit in our number:

+526643x79xx0

R.mp3 was identified by HyzerBlade on Discord as Chopin's Nocturne No.19 in E Minor, specifically version performed by Arthur Rubinstein. ^{Note: This is also the source for R.mp3}

The command ¡Rubinstein revealed the digit:

0

Afterwords, ZZ probably updated their Playing status on Discord to place the digit:

+526643079xx0

T.mp3 and S.mp3 remain unsolved, however S.mp3 contains metadata that states the author is "The Message," so it may be an original composition by the puppetmaster.

Ook

@YouCraftNetwork and @frtsTheMessage twitter accounts had a bit of a back and forth in an encoded language known as "Ook," a Brainfuck implementation. This is what we have, arranged in the order it appears on Twitter:

   Ook. Ook? Ook! Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook? Ook! Ook! Ook? Ook! Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook.

After interpretation, the output reads:

Still there

Solved by Crauss when it was discovered.

The Continuation

At 16.07.04 22:45 (GMT +1) The ARG began it's continuation, by opening the discord rooms.

On github, there was a commit, updating the main.html -> The commit contained

<!-- you need to know the truth -thehistorian.co.nf -->

The url contained a link to a page, where was another link, the final link is http://thehistorian.co.nf/lenddiforme/inicio/ , where we were greeted with this text: (Google Translated , Rough)

I still remember when the Legion began, was just 33 9e MDE year, just as the 4 Giants ended the war ... How can we forget that destruction ?, decisions 4 could not be overlooked since. When Kolyn came to power Holden seemed to have everything to end all possible tensions with the other 3 Giants, creating what    looked hope for Holden and the rest of Giants "Lenddiforme" name was given to a union of the powerful Holden; everything seemed to go fine, until the arrival of 6 MKL of 12e.

6 MKL of 12e is a link on the site, leading to http://thehistorian.co.nf/lenddiforme/6-MKL-del-12e/ where we are greeted with the same page as youcraftnetwork.co.vu

The PM hinted that

http://thehistorian.co.nf has now autoupdate, You need to complete some things for an update