- 1 Part 0: Codi
- 2 Part 0: eSports Gossip
- 3 Part 1: Malena
- 4 Do Not Play TF2
- 4.1 Chapter 1
- 4.2 Chapter 2
- 4.3 Chapter 3
- 4.4 Chapter 4
- 4.5 Getting Closer
- 4.6 Chocolate Cake
- 4.7 Far too fast
- 4.8 Malena's Mysterious Musical Mind Map
- 4.9 Spanish Inquisition
- 4.10 Statuesque
- 4.11 It is a mystery
- 4.12 Eternal Slumber
- 4.13 Jump into Spain
- 4.14 Blast from the Past
- 4.15 Natural Beauty
- 4.16 Winter is Coming
- 4.17 Now in theatres
- 4.18 The Bandit Van
- 4.19 Do Play TF2
- 4.20 pantheon-files
- 4.21 Tonight's the Night
- 4.22 Not Quite There
- 4.23 The end of a road
- 4.24 The start of another
- 5 Part 2: EFS
- 5.1 New Rivalry
- 5.2 The Fifty Puzzles
- 6 The End
Part 0: Codi
Trailhead the First
Four hours later, the site reverted to its usual look.
The next day this video appeared on the channel, with the description saying it was "sponsored by Codi". The game shown in the video is *Stardew Valley*, and this channel was discovered through this hint.
A Warm Welcome
The video Hi There drew attention as it was the newest one and different to the others. The text said:
Hi there. My name is Codi. Do you want to know me? Let’s see if you're smart enough. Solve this riddle. [Mirrored] See you on the other side.
The video itself is flashing images of asterisks.
The first video is the Star Spangled Banner (American national anthem), and the second one is Twinkle Twinkle.
IT'S STAAAARS YOU FOOLS!
Constellations & Team Fortress 2
Using all previous hints a blog was discovered by spelling Camelopardalis backwards.
However, at this point, the ARG was put on temporary hiatus - read more here.
Don't Stop Me Now
Roughly eight hours after the ARG went on temporary hiatus, there was a realization that the first letters of the maps, "nserubetclu", was an anagram for /r/turbulences.
On April 5th 2016, 15 days after the cancellation of Teragon 2/Codi, the reddit user /u/TonyWan started posting in the League of Legends and DoTA 2 subreddits. This is interesting because Tony Wan is a character from the first Teragon ARG.
The DoTA 2 post was a link to a Twitch channel called "thehiddenmessage". It showed the DoTA hero select screen with a robotic voice reading out Buddhist transcripts.
The LoL post linked to a website claiming to have secret information on certain teams from popular eSports games.
People's ARG senses were tingling, especially with the link to Teragon. More investigation was done on the website and Twitch stream which led to more discoveries, somewhat confirming an ARG.
Part 0: eSports Gossip
Trailhead II: Esports Gossip
The Reddit user Tony Wan (a character from the previous Teragon ARG) posted to multiple places such as the League of Legends and Dota subreddits.
The Dota post, posted on 16/4/10, was about a Twitch channel called "thehiddenmessage", while the LoL post, posted 5/4/10, linked to [esportsgossip.club eSports Gossip Club], a website claiming to have secret info on certain teams from popular eSports games.
Around this time, the TeragonGroup website that the original Teragon ARG was based around also went down.
The cipher for start.html was rather basic, using an a1z26/"number letters" cipher:
Deciphering the page with this code yielded the message:
"YOUR EFFORTS WILL BE REWARDED TO PROCEED GO TO THE NEXT STEP"
This led to nextstep.html, which was only a "Coming Soon" page. At some point on 16/04/15, the eSports Gossip website changed its repeated "official launch" date from 16/04/10 to 16/04/20.
Around the beginning of the Twitch livestreams, start.html and all other pages on the site except nextstep.html changed to simply read:
You are not yet ready.
Part 1: Malena
At around 3:33 pm CST on April 11th, thehiddenmessage started streaming again, this time reading passages from the "Tibetian Book of the Dead." At the end of the stream, a text-to-speech voice could be heard repeating:
This marks the end of tonight's broadcast. Please click the Follow button, do not forget to clear your mind and meditate. 123 345 567 789 910
At around 12:40 pm CST on April 12th, the stream started again with the title "The Master's Secret Knowledge". At the end of the stream, the following was heard:
To reach enlightenment, quit Dota. To learn about your true self, quit Dota. To free your mind, quit Dota. To master your desires, quit Dota. To learn the true meaning of life, quit Dota. I am your master. I am your guide. I am the lighthouse in the stormy sea. 122 344 566 788 91010
On 16/04/13, the title of the streams changed again to "I Am Your Guide", and by the third such stream, the image in the bottom-right changed to a creepy old photo.
On 16/04/15, around 4:09 pm CST, a new stream appeared, entitled "Are you ready?", displaying a timer counting down to 5:00pm CST 16/04/15.
Do Not Play TF2
On 16/04/15, at 5:00 pm CST, the countdown text changed to say "GO!", with the background becoming an image from Team Fortress 2, and the music changing to be TF2 music (the same track was used during the Codi ARG). After a few seconds, an image of Snoo, the mascot of reddit, also appeared, leading to this /r/TF2 post linking to the site donotplaytf2.news by /u/thegreatalmightyderp, who had previously posted about an update to the Teragon website.
Welcome, welcome. So, you managed to find the first page. Not bad. Let’s see if you can keep up the good work. Who knows, we may even have fun together. M. ------ Go to chapter2 I go up the ramp and emerge from the blue shadows. I go straight and enter the wooden house. I immediately turn right and go up a flight of stairs. I then turn left and go up another flight of stairs. Another left, followed by a right turn, brings me to a dimly-lit corridor. I exit through the gate, turn left and go down by using the stairs. I turn right and go straight on until I reach a closed-off area. I then turn left twice and enter a red refuge. Where am I?
The answer to this was solved to be the TF2 map "Dustbowl".
'Dustbowl' was the password to view Chapter 2, which read:
So, you know your TF2. Let’s be honest, though, that was an easy one. Let’s try something a little bit harder, shall we, friend? M. ------ Go to chapter3
When 'weirdalphabet' was entered as the password, Chapter 3 read:
So far, I’m rather impressed. For a bunch of random people off Reddit, you’re actually quite clever. Except for the part where you told people on /r/tf2 that it was an ARG before they had a chance to figure it out themselves and maybe have a bit of fun too. Anyway, a few weeks ago, I was talking to a friend about this little experiment I wanted to run. I told him no one would be able to solve my little puzzles. Looks like, so far, I’m wrong. Or maybe my first few puzzles have just been way too easy. Rather tricky to say, wouldn’t you agree? M. ------ chapter4 SLITUUNA
The first line refers to a comment made by a user on the /r/tf2 post stating "no don't worry it's an arg", despite this post being deleted minutes after it was originally posted and long before chapter 3 was found.
The first 5 lines of the page spelt "SAILOR." "SLITUUNA" is an anagram of "NAUTILUS," Greek for "sailor."
These referred to the novelTwenty Thousand Leagues Under the Sea, in which Sea Captain Nemo piloted the submarine Nautilus.
The password of Chapter 4 was "nemo", the sailor of the nautilus yielding this message:
How clever was that last puzzle? I mean, seriously, how clever was that? The first letters of each line giving you the word SAILOR, the Nautilus anagram… Come on, admit it, it was cool. Anyhoo, you did well, friend. So far, you have exceeded my (admittedly low) expectations, so that’s… good, I guess. Maybe it’s time I introduce myself, don’t you think? Name’s Malena. Don’t blame me for it, blame my parents. I’m 17, bored as hell and I wanted to try a little experiment with ya’ll. Hence the weird stream, the equally weird TF2 page and the riddles. As I’ve said before, I’m fairly certain you won’t be able to reach the end of your journey. Not that I don’t have faith in random strangers on the Internet (although, to be fair, I kinda don’t), but, well, my mind is a bit weird. Scratch that. It’s REALLY weird. And I’m not sure you’ll be up to solving some of the puzzles that warped mind can come up with. You should, though. There’s a reward waiting for you at the end of the journey. So, let’s continue, friends. Malena ------ thefirststep ++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>+++++++++. -. ———. <++. >++++++++++. ———. <. >—–. +. ++++++++++++++++. —————–. +++++++. ——-. ++++++++++++. <. >++++++. <. >. —-. -. +++++.
The hint beneath the horizontal line later changed to this:
thefirststep PMR PG ODSSV D DPMD (Looks like WordPress messes with Brainfuck code. Oh well… I guess that one is on me.)
The hint was solved by /u/Tmonkx . By shifting each letter one to the left on a QWERTY keyboard, the following message was found:
ONE OF ISAAC S SONS
Are my puzzles that easy or what? I have the weird feeling I’ve been giving you baby puzzles until now. Yes, I know, I should congratulate you and all but I do have the feeling I’m the one who messed up here. Are you that good or is it me just being bad at making puzzles? Kind of an irritating problem to solve, don’t you think? Unless I’m looking at this the wrong way. Really, there isn’t much else I can do right now except to give you a new, harder puzzle to solve. Are you up to the task? We’ll see. Malena ------ gettingcloser 133211 x02220 x32010 022100 xx0232
It was quickly noted that the first letter of each sentence formed the word "Ayakura", a cryptical Discord user who was also mentioned a few times in the Teragon ARG. Ayakura decoded the numbers as chords which would read "faced", the password to the next page.
gettingcloser contained the following text:
I’m watching you. Watching you on Reddit and watching you on Discord as well. Somehow, it amuses me to see you try to solve my puzzles. Or see you look at someone’s comment history and assume a certain website is part of my little game when it’s not. Don’t mind me though, I’m very easily amused. Which is somewhat weird because I’m also very easily bored. I’m a huge contradiction wrapped in a tiny girl’s body. By the way, side note: if you reached this page through non-conventional means: you can chat with other solvers over at the /r/gamedetectives’ official Discord server over at http://discord.me/gamedetectives. Join if you want, or just keep solving stuff alone if that’s more your thing, friend. So, how are ya’ll doing? I mean, you can’t answer me but I thought I’d ask. I at least like to try to pretend to be polite. It’s better than nothing, right? Malena ------- chocolatecake ACCCGTAAGAAGGAACTC
The string at the bottom of the page was decoded, once again, by Ayakura using this website, to read "waffle".
chocolatecake contained the following text and an image:
Let me tell you a little bit about me: I am 17, I live in Spain and I’m a terribly average student. I like video games, writing fiction and I read a lot of spirituality books. And you, who are you? Malena vessel
The password, 896745 was discovered by converting the image from base 60 to base 10 using the following equation:
Far too fast
vessel had the following text along with another image:
Fast. Way too fast. You guys are good. OK, let’s increase the difficulty a bit. Good luck with this one, boyos. Malena ------ anewchallenge
/u/Ayakura and Crauss managed to find the page using the 2 image fragments and overlaid the image on the blog's paragraph, giving the string:
A few hours passed by, with vessel.html's picture being replaced with one that included hints - in the form of hangman-esque dashes:
---- - ------- ---
The hint, combined with the provided string, combined to read
Pyro s default gun
In TF2, the Pyro's default gun is indeed the shotgun, the correct password to unlock /anewchallenge/.
Malena's Mysterious Musical Mind Map
Let’s talk for a moment about the Twitch stream (twitch.tv/thehiddenmessage) and its meaning. As I mentioned earlier, I read a lot of books about spirituality. The goal of my stream was to try to attract people who might share the same interest. My beliefs are not limited to a single religion. I pick things I like in every religion, ancient or contemporary, I study them and if they fit within my belief system, I add them to that system. To me, that’s the only correct way to approach religion or spirituality: keeping an open mind and focusing on what really matters, not on the fluff. Malena ------ thestruggle UGBTT EEBRRGW EMKKRWPPR (SSS)RRHBWBTONDB
Some of the names of streets on the map had been changed, spelling out "what is my name" (as highlighted here) leading to the password "malena".
/thestruggle/ read as follows:
Congratulations, you managed to ignore the irrelevant information and focus on the right stuff. Not bad. Not bad at all, if I can say so myself. Well done, you won. End of the road. No more challenges. You did well. I hope that you will soon visit Spain. Malena
While this looked like the end of the road, Spain was actually the name of the next page.
Spain read as follows, and also contained an image of a statue:
You don’t want to give up, do you? OK fine, let’s continue. You may actually beat this whole thing. At first, I definitely thought you wouldn’t, but you seem to be proving me wrong. So, as a reward, I think I’m going to tell you a little bit more about me. I live with my mother in a house near the sea. I have two sisters, an older one who is now off to college and a younger one who is worthless. Seriously, she’s terrible. My best friend’s name is called Sylvia. She’s the one who helped me come up with those puzzles, so I’ll of course blame her in case anything goes wrong with one of those challenges I’m throwing at you. Now, let’s move on to the next step, shall we? Malena
The statue was found to be Michelangelo's 'Bacchus'.
It is a mystery
Upon /mystery/'s discovery, it simply read:
However, on 2016/04/16, the page changed briefly to a simple html page reading:
Do not trust her.
It was shortly thereafter changed to a proper page, featuring this image:
And this is what happens when I underestimate you… I go to sleep, thinking you won’t solve BOTH of those puzzles in the meantime and, when I wake up, I find out you did and are now staring at a Coming Soon page. How rude of me, right? Anyhoo, Bacchus. Isn’t he a fun god? The god of drinking and excess. You see, people nowadays tend to associate god with a stern man who judges you based on what is wrong and what is right. Our ancestors, however, knew that there was more to religion than that. They knew that they also had to make it fun somehow. And scary. Truly, the ancient Roman and Greek pantheons are fascinating. Malena sleepytime
This was a Templar Cipher, which decoded to read "goodmemories", the password to /sleepytime/.
/sleepytime/ yielded this:
You know, there’s not much for an 18 year-old girl like me to do over here in the Spanish countryside. I get bored very easily, so I try to entertain myself by coming up with little puzzles and ciphers for my friends. Before you start jumping to conclusions though, you and I are not friends. Yet. After all, we’ve only just met. But, who knows, maybe one day we will become friends. And talk about philosophy, spirituality and all sorts of interesting things. Would you like that? I know I would. Being lonely is not particularly fun. Malena ------ loneliness
Note the inconsistency in age - Malena was previously stated to be 17. A while later, the puzzle section of /sleepytime/ updated:
loneliness There’s none so blind as those who will not see
The puzzle actually lead to the page /conclusions/ rather than /loneliness/, as hinted at by "jumping to conclusions".
Jump into Spain
The password to /conclusions/ was "loneliness", yielding this text and this image of the Spanish coat of arms:
Have you ever been to Spain? (No, not the page on my site, the real country). Overall, it’s pretty nice and the country has a pretty long and complex history, which makes it interesting. I’d like to visit some other countries though, like Italy maybe or France. Maybe one day. Malena ------ voyage
/voyage/ briefly changed, again showing:
The red herring /loneliness/ was removed from the site at an unknown time after this. After having run around in circles for a while the page was updated with an image, Pointing to stenography. Doing stenography on the image the spanish coat of arms gave the text "Isy ghwr nogebobtev rtdimlnx zn p nimhekp ou txaiel", a vigenere with a key of spain's motto, "plusultra". This translated to "The only worthwhile resource in a country of idiots". After some time trying everything one could want in a country of idiots, this image appeared, shortly followed by an image of The Administrator from TF2. These references linked to "australium" a highly sought after material in the world of TF2, which is the password to the next page.
Blast from the Past
Well, that sure took you a long time and quite a few hints. My best friend, Lea, helped me come up with this one. I have to admit, she’s a bigger TF2 fan than I am and she’s the one who told me everything about Australium. You are getting close to the end, by the way. And I’m close to losing that bet I made with Lea. Grumphh. Malena ------ onemorestep In the city of John the Baptist, there once was a very pious man. After the fall of the house adorned with six spheres, he came into power and tried to impose his strict religious dogma onto the population of the city. Unfortunately, the city turned on him and he was put to death, along with two of his brethren, in front of a very famous building. That building will lead you to the next step.
Shortly after this message, the message "She is not who she says she is" was shown for a short time. Later, an additional message was added:
See the truth. Add "_notes" at the end of each page you visited. Password is "bitntestnotes"
Following this, notes can be seen for every puzzle, compiled here. Someone named "GB" is referenced in these notes. A Teragon Group analyst named GB was briefly mentioned in the original Teragon ARG, suggesting a link between the two (though this was likely a coincidence.)
After hours of searching around a new hint appeared. "You know there are places on Reddit where someone would have given you the answer in less than five minutes, right?" Inspired by this hint, the solvers made a post on /r/AskHistorians. 5 minutes later, another hint appeared: "A temporary fall from grace is a fall nevertheless." A new image appeared confirming suspicions that the house in the riddle was the medici house, followed by another image, this time of the Cathedral of Santa Maria del Fiore. Using all of these hints, solvers pieced together the location: Palazzo Vechio, the place where the priest Girolamo Savonarola was executed.
The password to /onemorestep/ was "palazzovecchio". It contained a link to a youtube video with an image of Barcelona, Spain - Park Güell.
Yesterday, I was playing with my dog in the little garden in front of my house. I was trying to come up with new stuff for you guys. New puzzles, puzzles that would really make you think. I’m afraid this one won’t make you think. It’s quite simple really. I’d be surprised if you weren’t able to solve it in less than 5 minutes. Yes, surprised and a bit disappointed too. Malena ahigherspirit
Taking the first letter of the name of each character making a sound in the video yields "messed", the password for the next page.
Winter is Coming
/ahigherspirit/ contained more text and an image:
I have to run somewhere and take my two bros on an errand for my mom. I thought I’d give you a hard one to make sure you don’t see another one of those damn “Coming soon” pages. Malena anewdestination
"Malena" once again made an error by stating that she had two brothers instead of two sisters. The drawings on the face of Mance Rayder matched this subway system and the X marks out the "libia" station. Some time later, "libia" became the password for the next part.
Now in theatres
Contents of /anewdestination/:
Coming soon. Oh well. Glad you found the answer though. Sorry about the mix-up. Looks like stations were planned and never opened. So, Libia it is. Oh, and congratulations on “finding” Savonarola. Malena
The page soon updated to include:
This was promptly changed:
theyellowvan 4377159311233325 The bald man will show you the way The man in the blue shirt with no face is looking straight at you The masked gangster looks at you menacingly The dapper gentleman calmly smokes a cigarette. Forget everything you heard about a red van. I’m doing this on my mobile while bringing my two sisters to the store. It was an honest mistake. A fierce-looking gentleman is holding both his hands in the air.
The page updated with an image of the Bounty Hunter from Dota which was actually the thumbnail to this video. Very little success was had at making progress with this puzzle, leading to a number of hints being added:
Those numbers must mean something. Maybe they need to be split? Shockingly, this puzzle does not involve any kind of cipher."16 digits. Or 2 groups of 8." Yet another hint - an image of the Coliseum in Rome, with the title "roman-calendar.jpg" Little progress was made, and the hint "Lampredotto – Hamburger – Porchetta – Hotdog – Salsicce" was added. One final hint was eventually added: "Two groups of eight numbers. Maybe with missing punctuation.". This led to a realization that the numbers were coordinates, which pointed to a street in Florence; by viewing Google's Street View for those coordinates, a yellow van could be seen with the words "I'Bandito" on it.
The Bandit Van
The password for /theyellowvan/ was indeed "ibandito", yielding this text that suggested that the character known as ? ? ? may be the liar:
There’s a girl who hates me at school. She’s been turning my life into a nightmare for the past two years. She’s the one who’s been posting stuff on here, saying I’m a liar and what not. And, you know what breaks my heart? You seem to believe her.
Beneath this was a frowny face from another site.
Following this, the text on /anewdestination/ changed:
The bald man will show you the way as he exits his car. The man in the blue T-shirt with no face is looking straight at you. The masked gangster looks at you menacingly. The dapper gentleman calmly smokes a cigarette while waiting for his food. Forget everything you heard about a red van. I’m doing this on my mobile while bringing my two sisters to the store. It was an honest mistake. A fierce-looking gentleman is holding both his hands in the air.
Following this, /theyellowvan/ added more text:
Anyway, last night, I had astrangedream. In that dream, I was in a weird city. It didn’t look like any city I know, it was like a college of different Spanish cities, like Barcelona mixed in with Madrid, etc… I was walking down a street when, suddenly, someone tapped me on the shoulder. I turned around. It was a tall man in a top hat. Although I had never seen him, I somehow seemed to remember his weathered old face. “You should not be outside at this time, Miss,” he said. I told him that it wasn’t that late and that I felt perfectly safe. “You shouldn’t,” he replied with a sly smile at the corner of his mouth. I walked away, feeling slightly shaken, and entered a nearby shop. It was a shop unlike any other in the real world. It sold every single product on Earth, but it did so in the tiniest possible room. Basically, you had to tell the assistant what you wanted, push on a button and then — poof! — suddenly that item appeared out of thin air, ready for you to purchase. I immediately decided to purchase a horse, two chairs and three palloons. Since I couldn’t see myself carrying all those items back to my house, I asked to get them delivered. That’s where the clerk replied “Oh, but they were already at your house, miss.” Then he turned around, reached for something under his desk and pulled out the longest knife I have ever seen. I ran out of the store as quickly as I could but, while I was shopping, the street had somehow changed. I was now in the middle of an Italian street instead of a Spanish one. I crossed the busy street in a hurry and took a quick glance behind me. The shop assistant was still in persuit, knife in hand. I started running down the street, calling for help. Needles to say, none of the people in my dream seemed even remotely interested into helping me. They just stood there, watching. Some were even laughing and pointing at me. I distinctly remember two grown woman pointing at me, while talking to their little children. “You see, girls, if you don’t study in school, this is how you’ll end up,” she said. Out of breath, I stopped running after about five minutes. The shop assistant was gone, as far as I could tell. I took a deep breath and tried to compose myself. Suddenly, I felt something sticky and warm on my leg. I looked down and saw that my entire right leg was covered in blood. Under the sunset light, that blood looked black and shiny. At that point, I woke up, my heart pounding real hard in my chest. Malena
Note the various typos in the passage. They are code, which together spell "abuse".
Do Play TF2
"abuse" was the password to /astrangedream/, which shortly read "Coming soon" before changing to:
Catch me if you can. 220.127.116.11:27051 Malena ------ yournextgoal
This prompted users to join a Team Fortress 2 server, with Malena's Steam account being tracked down (albeit being the same account as the puppetmaster, gayfarang, with a different name). Malena spoke in the game's chat a few times after realizing that sprays are disabled:
Malena : I didn't say anything. But I gave you the password. Malena : I am a building with a giant hole in the roof. Malena : Follow me.
The "Building with a giant hole in the roof" was realized to be the Pantheon in Rome. "pantheon" was indeed the password for /yournextgoal/, which promptly updated to say
Can I trust you? Can I really trust you guys?
A series of additions/edits followed, resulting in:
Also…. and I know this is a bit of a weird question but… do you like me? I didn’t mean that in a romantic way. I just meant… you know, “like.” Malena almostthere SeFrShMa If S is I, what is F? Tip: /r/dota2 may guide you on your journey to solve this puzzle as well as the next ones.
Tip 2: I think that bad friend I told you about earlier is the one using all of my site’s bandwidth at the moment. Unless one of you guys is using a scanner or a tool like that? But no, I’m sure it can’t be you. You’re too nice for that. A post on /r/dota2 indeed did help solve the puzzle to be "major":
Seattle, Frankfurt, Shanghai, Manila. The Major cities.
Tonight's the Night
/almostthere/ contained this and an image:
Don’t worry, I won’t keep on making you jump through hoops forever. My puzzles will end tonight. Tonight, I will finally know if you are worthy of not. Malena almostover
The page was briefly edited to read:
I will tell you everything tonight.
After this was changed back, the page was edited/added to a number of times with hints:
/r/dota2 may still be of help. Synonyms. You are looking for a place that does not exist.
Not Quite There
See? I told you the fine people over at /r/dota2 would be of great help. You still have not really answered my question though: do you like me? Not that I’m shallow or anything, but I like to be liked, if that makes sense. Or, to be more accurate, I don’t like being disliked. Yeah, I know, I’m weird. Malena ------- anoldfriend
The puzzle was added shortly after:
This was very quickly solved to be a Burrows-Wheeler Transform which read:
The hero this referrs to is "spectre", the password for /anoldfriend/.
The end of a road
/anoldfriend/ intially read:
Well, that was way too fast. I can’t keep up here.
Later added was:
The next (and last) puzzle will be ready shortly. Malena
Later on, the final puzzle was added with this video containing a series of beeps:
The beeps were morse, leading to
I WAS AT TI1. I STILL PLAY DOTA COMPETITIVELY BUT I HAVE NOT BEEN TO ANY OTHER TI. I AM WELL-KNOWN FOR PLAYING MORPHLING.
This referred to the Dota player "lakelz", also the password for /theendoftheroad/, which read:
Well done. You have solved your final puzzle There is someone else who wants to talk to you. Come back here in 10 minutes.
The start of another
Following this, the page blanked out in another hack, which was soon followed by the addition of this URL:
The homepage of Do Not Play TF2 changed to redirect to Google's homepage.
Part 2: EFS
The PDF of Revelation
The Electronic Freedom Society (EFS) blog had one post, linking to a document on a new site for the Order of the Crimson Temple (OCT). The document showed that Malena (and eSports Gossip and Codi before her) were fabrications by OCT as a recruitment programme. It also revealed that they had hacked into Tony Wan's reddit account and had been behind everything in the ARG so far (except the EFS hacks).
Which side are you on?
The EFS blog updated with a new post, including a Strawpoll:
Hi, My name is Mark and I work for the EFS. The EFS is a small non-profit organization dedicated to preserving and fostering freedom over the Internet. A few months ago, we found something — quite by accident — that seemed to indicate that a well-known cult, the Order of the Crimson Temple, was planning something. We do not know what it is yet, but we know that it’s going to be big and that it will involve the Internet somehow. Given the OCT’s past history, we’re quite sure that whatever they’re planning — which they call the Day of Reckoning — won’t be good. I know that the Order tried to recruit you but, I was wondering if you would be interested in working for us to stop them. As I’ve said, we’re a very small organization and, if we want to stop whatever they have planned from happening, we really need all the help we can get. We can’t count on police forces or governments at the moment. They’re still busy trying to deal with the aftermath of what happened in Paris a few months ago and especially tracking those responsible for that attack. Anyway, do you want to help us or not? http://strawpoll.me/7399739 You have 15 minutes to answer. Mark
A New Contractor
Some time later, the EFS blog updated with an update from Mark, signifying our siding with EFS:
Thanks. We’re all happy here to have you guys on board. Now, as I’ve said before, we still do not exactly know what that “Day of Reckoning” entails. Which is why our first priority is to find out more about it. We need to know exactly what we’re facing before we can proceed. Looks like OCT ditched their recruiting website, though. Luckily, we still have access to some of their files on their main site. Your job is to look at the files and see if you can find out anything that might help us. This is the first thing we found: https://youtu.be/QOJkvvumiio Along with this: Lhr siuv xbugsj if uv emxiee R an baz Eit Tizwynntw otaftrf. Once you’ve figured it out, send me the answer over on Reddit. Username’s /u/EFSmark Cheers, Mark
The cryptic line was recognized to be a Vigenere cipher. Using bruteforce instead of the posted video, users found the key to be san gimignano and the message: The main router is on server D in our San Gimignano cluster.
After getting PM-ed, Mark posted again:
Thanks. So, it somehow involves routers. OK, we’ll keep an eye on San Gimignano. Next: XXX [X]XXX XXXX XXXX X[X]XXXX XXXXX XXXXX XXX[X]XXXXXXX XXXXXXX-[X]XXXXXX XXXXXX XXXX[X] XXXXXX[X]-XXXXXXX No idea what this is to be honest, but it seems important. Mark
A user discovered the resemblance between the lines and the paragraphs in http://blessedbethyna.me/find-inner-peace/ , with [X] being the letter we needed: M A F T R O
Another post arrived, right on schedule:
So, it involves a specific format or maybe format as in a verb, like formatting something. Once again, you have our gratitude. Since you’re on a roll, why not go on? This is something else we found: AMMIRIKDMWXFRHVVMGULPGWNZRJXWAHKM JLS This one should be more difficult. Good luck! Mark
Apparently seeing as we were facing a dead end, our new character Mark sent out a message:
I know it was a tough one, so don’t worry, I’m not surprised you haven’t contacted me back yet. Also, I wanted to tell you something: thanks to the information decoded earlier, we may have a good idea now of OCT’s plans. I’ll tell you everything about those plans tomorrow (Monday) at 4PM Italy time. Cheers, Mark
Got something for ya
After we had made yet no progress Mark decided to give us so information he had been withholding:
We found the password in one of OCT’s private directories. It seems to be CHOSENONE
This confirmed the suspicions that the JSL in the cipher was a signature by OCT's founder James L. Stanford
Following this basically every cipher possible was tested without luck. ===Password, passkey, etc... Seeing how we were still stuck Mark decided to give us even more information he didn't want to share before:
By password, I thought it was clear that I meant the passkey for the cipher. Sorry for any confusion. See you later. Hopefully you’ll have decoded it by then.
Something else we found in the same directory on OCT’s server: https://electronicfreedomsociety.files.wordpress.com/2016/04/270px.jpg
Which is a Gormark sheep, which also happens to be a cipher needing a 5 digit number and a keycode. Using the keycode "CHOSENONE" people started wildly guessing the primer.
After a while of no progress the page was updated once more:
This brought the attention the Periodic Gormark Cipher which doesn't need a 5 digit number. After looking for some way to decode this without finding any online tool people set to work on manually doing it. The result was "TROJANWASSENTTONETWORKONWEDNESDAY". This was then sent to /u/EFSMark
Someone's getting fired.
At 16:08 italian time a new post apeared.
Sorry, someone forgot to take into account daylight savings time to calculate the current time in Italy. The same someone – ahem, Samuel – who also regularly forgets to say hello or goodbye to other EFS employees, or even to pull the toilet seat down. Anyway, short story: we’ll give you the details in one hour. Also, Samuel is fired. Mark
After patiently waiting one more hour at new post appeared:
OK, once again, sorry about the mix-up. I’ve just finished helping Samuel clear out his desk. Now, I’m all yours. Thanks for solving the last puzzle. As I’ve said, it was a tough and we’re glad you solved. I have to be honest with you, things are tense at the moment. Here’s what we know for certain: The Order has something big planned for Wednesday April 27th. Knowing OCT, it won’t be good. It somehow involves routers, San Gimignano and a virus. Now, we need your help figuring out the rest. For this, you will work with one of our other employees. I unfortunately have to go check on some lead and will be unavailable for the next few days. Don’t worry, we’ll be in good hands. Come back here in 5 minutes. There should be a new post from the employee you’ll be working with. Mark
The Fifty Puzzles
5 minutes later:
Hi there boys (and girls?)! My name’s Martha and I’ll be your chaperon for the next few days. Isn’t that fun??? Anyhoo, we’re swamped with data to process here and there’s only six of us. That’s where you come in, cutie pies. You’ll be doing all of the grunt work while we sift through the data you collect. Unfortunately, because we’re on a tight schedule, we’ll now have to start giving you deadlines. Here’s the lowdown: 5 days 50 coded messages 1 hour to decode each of them Each piece of information is crucial. That’s why I’ll be keeping a tally of the puzzles you solve and those you don’t. You start at 100 and, every time you fail to solve a puzzle, you lose 2 points. Try not to lose too much, alright? The more points you lose, the more difficult the final tasks we’ll have to perform to prevent OCT from doing what the heck they plan on doing will be. A’right. Here are your first two puzzles: http://blessedbethyna.me/public/ One of them gives you more information. The other one will give you the filename for a PDF that is stored here: http://blessedbethyna.me/docs/training/old You got two hours, pumpkins. Martha
Here, I made you something to help you keep track of your score, sugar plums. Come back here anytime during those next five days if you want to know how well you’re doing. score Also, yes, it’s one hour per puzzle. Since you got two puzzles, you got two hours to solve them both. Neat, huh? Your Martha
How to answer
Silly me, I forgot to tell you how to give your answers. Simply message /u/EFSmark on Reddit. That account is shared with everyone here. Good luck! Martha PS: We managed to secure ourselves a stealth directory on OCT’s servers. That’s why the files are hosted there, booboos.
Puzzle set two
Never assume anything, love muffins. No one said you wouldn’t have time to solve unsolved puzzles at a later time. Why do you think I scheduled only 10 puzzles a day? That leaves you 14 hours to solve any unsolved ciphers, or codes, or whatever. Of course, this will put us off schedule, so any puzzle solved later than the original deadline will only allow you to gain back 1 point… but still, it’s something, isn’t it? Anyhoo, kittens, a new set of stuff to decode is now on the server. Same directory: http://blessedbethyna.me/public/ This time, we’re looking for two passwords which will allow us to decode stuff on our end. Get crackin’ Martha
Puzzle number 5
Hey again, poohbears. So, here’s the deal: no one sent me the answers to the last two puzzles, so I’m going to deduct 5 points for each puz… no, just kidding. We have other ways to track your progress. Just remember to send your answers next time. OK, this time it’s just a single puzzle (might be slightly difficult), and you have one hour to solve it. This one should give us more information about what they call the Day of Reckoning. Thanks again, stud muffins. Martha PS: What’s a trashben?
It’s ok, sugar pies. You can’t solve them all. We’re going to go on break now, this will allow your little grey cells to rest. I’ll be back with more tasks for you at 2PM, Italy time. This time, there won’t be any delay. I’m better at tracking time than Samuel ever was, to be honest. Anyway, snuggle bears, I’ll talk to you again tomorrow. Martha Oh, and obviously, you can continue solving the last one in the meantime.
Codi hates us
After solving the last puzzle a new video appeared on Codi's channel: https://www.youtube.com/watch?v=RJ2BFkTX0jE
On 2016-04-22, a blog post appeared that ended the ARG:
Hey guys, Since there are so few of you at this time and since we do need those things decoded ASAP, we have decided to forward them directly to our new investigators who will handle things from now on. Once again, thanks for all you’ve done for us. You were of great help. Cheers, Mark
OCT's website also changed to redirect to Google.
Following this, the puppetmaster, gayfarang, took to Discord to give closure on the ARG: