VAULT-TEC

Recent Developments


December 7 0300 UTC - As many of you already know, thesurvivor2299.com has now officially been revealed to be a hoax. It has been an absolute pleasure to have worked on this project with all of you, even if it did end in disappointment. I will always fondly remember the time spent on IRC trying to break codes and postulating as to what it all means; I hope you will as well. I wish all of you a happy, safe, and productive life. On behalf of Nebual, sortiecat, MDirt, VaultofDaedalus, acidx, SixthArmySod, Kanade, Nerval, Water48, fischer, Chazzen01, myself, and all of the other OPs, good night and good luck. And remember-- tick tick tickity means run your ass out of there, and pop some rad away for good measure ; )

Your friendly neighborhood Overseer,

hitops


Table of Contents

General Info:


Chronology:

November 2013

S

M

T

W

T

F

S

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

December 2013

S

M

T

W

T

F

S

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

  • All times are in UTC/GMT (PST is -8, EST is -5).                 Current UTC Time
  • Bolded times are “as near as facts as we can get.”
  • Italic times are speculation.
  • Grey is raw code, blue is the assumed translation. If there is disparity in translations...
  • Dark blue are confirmed translations (should only be used for ciphers)
  • Orange text are possible words
  • Red text’s meanings are entirely unknown

Dec 7th

03:00 - Welp, thats all folks! The site has officially outed itself.

  • Its been a pleasure serving with you gentlemen, hope to see you all again for the real Arg! Was a lot of fun organizing the investigation! —Nebual
  • It's been great, guys. I'm really going to miss all the speculation and arguments we had over the miniscule ciphers and morse codes. I hope to see you all in #thewastes -SixthArmySod
  • Augh fuck. I’ll miss all you guys. It’s honestly been a pleasure working with all of you to solve this arg. I invite all of you to join us on reddit and IRC #thewastes to hangout and vent. I know i’ll be there. —Fischer
  • “Hopefully tunnel snakes one day come to MIT. Get hoaxed once, but don’t get hoaxed again!” - Nerval
  • "Only Fennec Foxes can cure this pain" - Ivan
  • “Eep! How the #!@& did I solve the meta arg when there was no signal?!” - sortiecat
  • Even though I went a bit inactive with the later codes, it was super fun decoding crap with all of you! Shoutout to Nebual, acdix, hitops, SixthArmySod, RossVarn, BrokenBenji, and a bunch of other guys. -MDirt
  • Though I wasn’t as active on IRC as I had hoped, I enjoyed the conversations and fun times I had with everyone. Updating this doc and figuring out clues and answers has definitely helped me pass the time along these past few weeks at college. I’m sad to hear that the site is a hoax but I’m thankful for the happiness and enjoyment it brought me and others. Goodbye everyone. See you in the actual capital wasteland :-) -abermuffin
  • It’s been awesome hanging out with everyone this last month. Hope to see everyone over in #thewastes (our new up-and-coming community channel) - hitops

Dec 6th

22:20 - Bethesda tweets “PSA: If you don’t hear it through an official channel like this, assume all rumors and speculation are false.” IRC has mixed feelings.

22:02 - New morse code:

PSE AS

Please stand by

22:00 - Cipher removed, now just says “PLEASE STAND BY” in clear text

21:45 - Site updated!

  • New cyphertext:

REV 3120 PAB UNAT BA XVQ, VG'F ABG BIRE LRG

VG YBBXF ONQ

XRRC GURZ OHFL, V'YY TRG UVZ GB GUR FURYGRE

  • Reversing and decoding with ROT13 yields:

CNO(?) HANG ON KID, IT'S NOT OVER YET

IT LOOKS BAD

KEEP THEM BUSY, I'LL GET HIM TO THE SHELTER

  • The linebreaks in the original ciphertext might indicate this is a conversation between two people (likely Desmond and The Survivor):
  • Person 1: Hang on, Kid, it’s not over yet
  • Person 2: It looks bad
  • Person 1: Keep them busy. I’ll get him to the shelter
  • Usage for 3120 unknown.
  • Meaning of “CNO” (or “PAB” if it should be left as is from the cyphertext) unknown.

CQ CQ CQ BR AA EMRG MSG WE R UR ATK FREQ 2250 II AA EMRG MSG WE R UR ATK FREQ 2250 II AA EMRG MSG WE R UR ATK FREQ 2250

Calling all stations, calling all stations, calling all stations. Break.

Attention all. Emergency Message. We are under attack. Frequency 2250. I say again.  
Attention all. Emergency Message. We are under attack. Frequency 2250. I say again.  
Attention all. Emergency Message. We are under attack. Frequency 2250.

Dec 5th

21:11 - favicon.ico changed from “V119-QR” to read “EJYOBA 75”, meaning unknown

21:10 - Ciphertext modified slightly, adding the {}’s

        AK: {REV _____ 5120} [CPS] PASS {LOC BB YEAR LET} - | H EY XHWHD OF GXSIHS EVE, ZFR G'K ATGEVY ROCL'JM QEOX.GTJX ZSFF QRETYHA HWEUHG WG VKKP HHWE. MCCCZNU SQ UUE VMXECEDCZ. MFE BNMC NEGE QLZCR TP MZ MR YUOG ACBSM. |

  • AK (Alphabet Key) = THQGN (which is undeciphered callsign from Dec 1 - 20:35, written in REVerse)
  • PASS (Passphrase) = ONENINEFOURSEVEN (the LETters of the YEAR the Berkely Building was built)
  • Plaintext:

I AM SORRY TO INFORM YOU, BUT I'M AFRAID THEY'RE DEAD. YOUR LIFE SUPPORT SYSTEM IS JUST FINE. WELCOME TO THE INSTITUTE. THE ONLY SAFE PLACE TO BE IN THIS WORLD.

20:00 - New Ciphertext (frontpage) - Modified at 21:10 to be slightly more clear

 

19:04 - New Morse (frontpage)

        CLG BR EMRG IS OVR WE AR OTNB WT AMO STH ATK CMP WA DD N WY OU ALL UNT CD 512Ø EVAC Z Y X YUR NXT

CALLING BLACK ROW, [“EMERGENCY IS OVER,” or “EMERGENCY! IT’S OVER.”] WE ARE [“ON THE NORTH BRIDGEor “OUTNUMBERED”] WITHOUT AMMO. SOMETHING ATTACKED CAMP. WE ARE DOOMED, NO WAY OUT, ALL UNITS [“CONFIRMED DEAD.” or “CODE:“] 5120: EVACUATE. Z Y X, YOU’RE NEXT

  • 5120 is likely referring to -TBNLS 5120- from an earlier cipher
  • ZYX may be reffering to Dec 4th’s cipher? Unsure how, since thats a conversation.

Dec 4th

20:00 - New ciphertext (frontpage)

        ZYX 5625478+7878 - HVCD AYX XOTF LFG IVL EGIBDYU CD RZWVI?

UJY'H VOSC FW SFP'GS POCVK KYVI L UWX IVYGLV. XZAG YU,  DHNY PJFF CCZ! ZM'K NZHP HQ QV.
NAWLV OSS HEJB RGO TVXS HBVD?

  • Key is LOCKHRTSURV, which Iztoli found by typing the numbers 56254787878 on a phone keypad

WHAT THE FUCK ARE YOU LOOKING AT KIDDO? DON'T TELL ME YOU'VE NEVER SEEN A GUN BEFORE. COME ON, MOVE YOUR ASS! IT'S TIME TO GO. WHERE THE FUCK YOU CAME FROM?

  • ZYX meaning unknown; may possibly indicate the sentences should be read in reverse order, as thats a bit more natural conversational order:
    WHERE THE FUCK YOU CAME FROM? IT'S TIME TO GO. COME ON, MOVE YOUR ASS! DON'T TELL ME YOU'VE NEVER SEEN A GUN BEFORE. WHAT THE FUCK ARE YOU LOOKING AT KIDDO?

19:00 - New Morse code (Broken-Harvard-Bridge-2)

        CLG BR CLG BR RPT DY SEV ON HVB PPL AR SCRD LST NGHT WE HRD STR NES FM TI ATM WE SE STR HUM DX Ø2 MIL N SMTH INT RGTH WID TH PL K

Calling Black Row, Calling Black Row. Report: day seven, on Harvard Bridge. People are scared; last night we heard strange noises from The Institute. At the moment we see strange humans distance 2 miles north. Something isn't right with that place, over.

Dec 3rd

19:20 - New Morse code (Broken-Harvard-Bridge)

CLG BR OTST RPT SUSP ACT NER SL TI 1 VTD 02 N 3 UNWN HUM 03 MIL NW [D- or K]

  • Translation consensus:
    CALLING BLACK ROW OUTSTATION. REPORTING SUSPICIOUS ACTIVITY NEAR SECURE LOCATION: THE INSTITUTE...
  • There are two current theories to the second half of the translation:
  • ONE VISUAL THREAT DETECTED 2 --  NO [wait, I made a mistake], THREE UNKNOWN HUMANOIDS 3 MILES NORTHWEST, OVER
  • or, interpreting the first 02 N as “2 miles north”,
  • ONE VAULT DWELLER 2 MILES NORTH; THREE UNKNOWN HUMANS 3 MILES NORTHWEST, OVER
  • IRC user Reyz7 suggests that OTST could mean ‘outpost’
  • ‘D-’ could be a cut off transmission of ‘DX’ - distance or ‘DE’ - from, or a cutoff K - over.
  • IRC user Anorian pointed out that outstation is a term used in radio transmissions
  • OTST/Outstation could be a Morse term for outpost and we will address it as such

Dec 2nd

23:00 - The Bethesda Black Friday/Cyber Monday posters are interpreted by some to look vaguely like a map of boston

  • One interpretation
  • If anyone can make an animated gif or something that better showcases the similarities or differences, please submit it to one of the editors, as we’re so skeptical this is almost in the Red Herring category

19:30 - New page discovered (Imgur Backup)

  • When opened, the message “SY684> OVERRIDING PROTOCOL VT-15812 WITH KEY '7667'” begins to appear letter by letter, as if being typed in to a terminal. Below that, the message “Unknown Enemy Detected” appears with a flashing red background.
  • The animating text is html class “message76”. Deobfuscated javascript
  • The page also contains the hidden message

REV FEAR - MGSS LHM'H EVHV KBIM'R QIUBMU. CB'L Z YYG MN HBM ZQSUB ZZAY

  • SY684 was on the page, and 684 on a phonepad can be NTH, thus the keyword SYNTH
  • Translation with a Keyed Vigniere Cipher (Key = SYNTH, Alphabet = “ZYXW...”)

THEY DON'T KNOW WHAT'S COMING. IT'S A KEY TO THE GREAT GAME

  • Desmond Lockheart (F3: Point Lookout character) mentions travelling north to pursue the “Great Game” of geniuses and billionaires

 

14:20 - New Morse code (TI-529c94d1b9e57.mp3)

CLG BR OTST GX IS SF TL LVL 4 BRE N SRV 899 CRPS WE LVG VT 119 KN

  • CLG = Calling
  • BR = Called station (receiver); BR may stand for “Black Row”
  • GX = Ground
  • KN = Back to you (invites only the called station to respond)
  • Attempted Translation:

CALLING BLACK ROW. OUTPOST; GROUND IS SAFE. TOO LATE, LEVEL 4 BREACH. NO SURVIVORS, 899 CORPSES. WE ARE LEAVING VAULT 119. OVER, BACK TO YOU.

  • Notably, this mp3 returns to the naming convention used for most prior mp3’s. The only mp3’s to have broken this convention are the three “Unknown-7667” mp3’s
  • “TI” in the mp3 filename may refer to “The Institute”, indicating that The Institute is the one sending this message.It is also that The Institute is scouting out the area after receiving the previous Morse transmission (Unknown-3-7667).

03:28 - New Morse code (Unknown-3-7667)

CQ CQ CQ DE VT 119 SOS LVL4 UND ATTK OS IS DEAD II SOS LVL4 UND ATTK OS IS DEAD WE WNT MK I

  • Attempted translation:

CALLING ALL STATIONS, THIS IS VAULT 119, SOS, LEVEL 4 IS UNDER ATTACK, OVERSEER IS DEAD, REPEAT, SOS, LEVEL 4 IS UNDER ATTACK, OVERSEER IS DEAD. WE WON’T MAKE IT.

Dec 1st

21:30-03:20 - The website is non responsive for most people.

22:03 - New Morse code (Unknown-2-7667)

CQ CQ CQ DE VT OS 119 ANB NR QBN SOS V DR BRE II SOS V DR BRE EN UNKN LVL 1 2 3 GONE SRV ON SL LVL 4

  • Attempted translation:

CALLING ALL STATIONS, THIS IS VAULT OVERSEER 119, ANYBODY NEAR QUABBIN? SOS VAULT DOOR BREACH, REPEAT, SOS VAULT DOOR BREACH, ENEMY UNKNOWN, LEVEL 1, 2, AND 3 GONE, SURVIVORS ON (SERVICE LIFT? SEALED? SECURE LOCATION?) LEVEL 4

21:10 - New Morse code (Unknown-7667)

CQ CQ CQ DE OVS 119 EMRG EN UNKN SOS SOS SOS VT 119 QBN 7667 II SOS SOS SOS VT 119 QBN 7667 EN UNKN

  • qc: Calling all stations
  • sos: General distress call. It does NOT stand for anything specific.
  • Translation attempted:

CALLING ALL STATIONS, THIS IS OVERSEER 119 EMERGENCY ENEMY UNKNOWN, SOS. VAULT 119 QUABBIN 7667, REPEAT, SOS, VAULT 119 QUABBIN 7667 ENEMY UNKNOWN.

  • Unusually, this MP3 breaks the file naming convention. It is named Unknown-7667.mp3, breaking the Location-timestamp.mp3 naming convention.

20:35 - The timer expires, site struggles under heavy load, New message:

KVNGR REV ALPHA PPS VT    PIZ UHMYLPVOQ CM XHWMZP. NBJB SPI'F BYQS QT D'Y BYFGEOB FI VQDYL MAQ. -NGQHT 5120-

  • Attempted Translation:

THE INSTITUTE IS SEALED. THEY WON'T HELP US. I'M HEADING TO BLACK ROW. -NGQHT 5120-

  • It’s a reversed (REV ALPHA) keyed Vigénere cipher (KVNGR), using passphrase “VAULT TEC” (PPS VT)
  • It is still unclear what -TBNLS 5120-  is-possibly a sign off.
  • This is the first time “Vault Tec” has been mentioned in the ARG.
  • “Black Row” may refer to Merchant’s Row, which is is in Boston

20:24 - The timer has been fixed. Set to expire in 11 minutes.

20:08 - IRC users discover some mirror websites. The website is unlikely to be an official mirror.

19:55 - Site sputters up, running an updated nginx 1.4.4 and PHP 5.4.21, with a timer change (added 12 hours)

  • The site now serves (via PHP) a number of seconds till the countdown’s end, rather than serving Unix time.
  • This may be to ensure everyone sees it end simultaneously, rather than relying on local clocks.
  • The timer will now expire on Dec 2nd, 8:30AM UTC.
  • It appears that the old 404 page is down.

18:00 - Site goes down, possibly under load.

Nov 28th-30th

No updates, possibly because Zenimax’s offices are closed for the Thanksgiving holiday. The ARG may have been planned such that the final pre-Apocalypse message (Boston is gone. No hope.) would be sent shortly before Thanksgiving, so that the lack of activity during the week of Thanksgiving could be explained by the falling of the bombs.

Nov 27th

22:44 - Folks at a pirate radio forum notice odd transmissions on 3450Hz near Boston.

  • All radio transmissions are currently considered to be red herrings and fake.
  • The frequency, 3450kHz, is an aviation frequency and there was no record of any flight test being registered for that frequency under any name. In addition, what was broadcasted, which included an air raid sirens and an EAS alert noise, is highly illegal under FCC regulations. No company would risk a $25k fine and a huge PR hit for that kind of stunt.
  • An Arg broadcast would likely be looped for a few hours, not just once or twice
  • Redditors were able to translate the DTMF (phone) tones in the transmission above to IMSECURE (I’m secure?), probably in response to the last morse code provided in the front page (“return transmission”).
  • Concerns have been raised that 3450 is an illegal frequency to use, however fiberkanin suggests possibly otherwise.
  • A woman's voice said at one point “the next transmission is at 0200 UTC”. Nothing was heard.
  • Over the next 6 hours, an air raid siren is occasionally heard, and uninterpretable voices, may not be legit

20:30 - Front page has new morse code (prov):

CQ CQ CQ BST IS GONE II BST IS GONE N HPE FREQ 3450 RT GB AMERICA

  • Attempted translation:

CALLING ALL STATIONS, CALLING ALL STATIONS, CALLING ALL STATIONS. BOSTON IS GONE, I REPEAT, BOSTON IS GONE. NO HOPE. FREQUENCY 3450 RETURN TRANSMISSION. GOD BLESS AMERICA.

  • The frequency 3450 lead to the ~20:44 discovery of an odd transmission on 3450Hz.
  • File is named Prov; no confirmation of what it means yet. Some suggest Providence, RI, which is close to Boston.

19:32 - IRC user threedog_ points out the favicon, when opened as a text file, reads “V119-QR”.

  • This may stand for Vault 119 - Quabbin Reservoir.
  • The favicon’s date modified is Nov 26th, 01:26
  • The iOS favicon file also reads V119-QR

Nov 26th

00:14 - http://thesurvivor2299.com/radio/ is now a 403, whereas previously it was simply an empty page.

23:21 - http://thesurvivor2299.org and http://thesurvivor2299.net are registered. Both redirect to the .com domain. Oddly, whois information for both are hidden, but a DNS record search indicates that the domains are, in fact, directly connected to the main site (they share nameservers) as well as Zenimax (the support email)

19:02 - Front page has new morse code (hanscom-msg):

CQ CQ CQ DE VT 2510730 ONE SIX EMRG VT SHLT FER SURV QBN NR 119 ii EMRG VT SHLT FER SURV QBN NR 119 K

  • Attempted Translation:

CALLING ALL STATIONS, CALLING ALL STATIONS, CALLING ALL STATIONS, THIS IS VAULT TECHNICIAN 2510730 ONE SIX EMERGENCY VAULT-TEC SHELTER FOR SURVIVORS IN QUABBIN, NUMBER 119, REPEAT, EMERGENCY VAULT-TEC SHELTER FOR SURVIVORS IN QUABBIN, NUMBER 119, OVER

  • VT could stand for “Vault”, “Vault Terminal”, “Vault-Tec”, “Vault Technician”, or a location (town?)
  • NR could mean ‘NUMBER’ or ‘NEAR’
  • Number 119 is the Boston radio code for Fire Detail
  • Number 119 could also refer to Vermont 119, a road that passes near Quabbin
  • (This is not the first message to end in a ‘K’, see Nov. 24th. Please don’t add again)

Nov 25th:

19:34-19:40 - thesurvivor2299.com struggles, sometimes returning 500 server error’s.

19:21 - Fallout: New Vegas updated, officially stating “Fixed cloud saves.”

  • IRC User LT_Albrecht, a member of the ‘Tale of Two Wastelands’ team, has confirmed that the changes are unrelated to the ARG. The updated files are minimal, and do not contain any information.
  • Confirmed by multiple users in IRC.

19:02 - Front page plays new morse code (longfellow):

NCRA UNIT BST 314 7 EMRG MSG NEW YORK STAGE 7 WASHINGTON STAGE 7 LOS ANGELES STAGE 7 AUSTIN STAGE 7 CHICAGO STAGE 7 NEW ORLEANS STAGE 7 LAS VEGAS UNKNOWN MIAMI STAGE 7 DALLAS STAGE 7 DENVER STAGE 7 SAN DIEGO STAGE 7 SAN FRANCISCO STAGE 7 BOSTO-

  • It appears the message was cut off part way through saying ‘Boston’, before giving it’s stage number
  • The ‘Stage 7’ refers the the International Nuclear Event Scale, ‘Stage 7’ being the most severe.
  • The morse ends just before Boston is given a stage level, possibly indicating the senders location was hit
  • ‘Las Vegas - Unknown’ is most likely a result of Mr. House’s actions to prevent the city from being directly hit
  • NCRA is possibly an acronym for National Catastrophe Relief Auxiliary, a group that was dispatched the day before the Great War to various locations in case of emergencies
  • ‘UNIT BST 314 7’ may be referring to a military or science unit stationed in Boston, and/or giving it’s current scale level (e.g. Unit 314 Boston - Stage 7?) as it is uncommon to use breaks in a military detachment or science team without the use of a hyphen

Nov 24th:
22:00 - IRC user ‘dsmndlckhrt’ suggests a possible Fallout 4 map, based on locations in the ARG.

20:44 - Front Page has changed (fall-river):

  • New front page countdown: “Nuclear winter is coming in #days #h #m #s” (Dec 1st)
  • New countdown is named “art-count”, possibly to concept art release? If so, previous countdown is “vid-count”, possibly to video release?

OZ DE SZ MSG + EF IS HIT II EF IS HIT K

  • Common morse code shorthand says: De = “this is” or “from”, Msg = “message: “
  • Based on the (now 404’d) /525478, we can read OZ as BGP (Bridgeport??), SZ as CNC (Commander in Chief?? Concord (Massachusetts)? USS Connecticut?), and EF as Quabbin Reservoir
  • CNC is probably Concord MA, given its proximity to the Quabbin Reservoir
  • Attempted translation:

BRIDGEPORT, THIS IS CONCORD (MA), MESSAGE: QUABBIN RESERVOIR IS HIT, REPEAT, QUABBIN RESERVOIR IS HIT, OVER.


20:00-20:18 - New links/activity discovered (404’d 30 minutes later):

17:10 - Redditor allgoodnamestakin ran a brute force of pages with names 7 digits long and got /5625478/.

  • 1740 update - Now 404
  • 1715 update - UNSOLVED new contents say: “ONE”
  • UNSOLVED contents say: "2510730 PLEASE STAND BY"

00:58 - Redditor Bullshii finds /22472855 which shows “VT137BST7667-LCKHRT: FILE NOT FOUND”

  • Found by typing LLUB (from Nov 23 - 11:48PM) on a mobile keyboard (5582), then reversing it to get 2855
  • Punching “LOCKHRT” on a mobile keyboard gives 5625478, which leads to the Nov 24 - 17:10 discovery.
  • STILL UNCONFIRMED that it may refer to Desmond Lockhart, from Point Lookout
  • According to the Wiki, “(...) he will mention traveling north to pursue his next rival (...)”
  • Boston is northeast of Point Lookout.

Nov 23rd:

23:48 - IRC user ETDellums posts new link leading to /23710-7667-1660/. “19.04 || 2247 LLUB”

20:30 - New page /7042299 found, based on the date in the recent translated cipher.  “GBG #23710-7667-?”

  • GBG is Granary Burying Ground. It was established in 1660, which goes into the ? part, leading to the 23:48 LLUB discovery

19:30 - Cipher (Beaufort) added to frontpage, translates to:

THE QUABBIN RESERVOIR 7 04 2299

  • “BFT” is the Beaufort, “CASE/S” is crossed-out, and believed to mean it is not “case sensitive”, “UPPR” may mean “uppercase”.
  • Deciphered message: The dates from the previous cipher (11/25, monday) and (12/27, friday) are the key “mondayfriday”. Passing through a Beaufort decoder, it reads “enineninowtowtruoforeznevesriovresernibbauqeht”. Reading it backwards, you get the quabbin reservoir seven zero four two two nine nine. Quabbin Reservoir is in Massachusetts.

19:00 - /u/maeestro links the phone number from the site update to a woman called Cindy Tallent who works for ZeniMax. The same phone number is also registered to a company called ‘Vir2l Media’, a company that specialises in ‘interactive media and interactive marketing’. Upon calling the number, a ‘ZeniMax’ (needs confirmation, how do you know it was ZeniMax’s and not Vir2l Media’s) answering machine replied: ‘Vir2L Studios has applied design innovation and creative solutions to a broad variety of platforms and media. In addition, Vir2L has developed for tall technical challenges in cross-platform media, with a strong history in high impact web sites, multiple-platform games, CD-ROMs, DVD-ROMs, interactive advertising, and full-motion video.’

1800 - IRC users note that Bethblog.com, thesurvivor2299.com and vir2l.com all use nginx 0.6.76, a version that has been outdated for already 5 years (a reverse proxy server) with bethsoft.com and zenimax.com also using nginx, but their versions are not stated.

17:00 - It is noticed that the site and bethblog use the same (5 year old) version of nginx

00:30 - StevePirates notices the two dates are equidistant from 12/11/2013.

00:00 - Cipher changed on site’s frontpage, (Vigenere) translates to:

VGNR   [CAP] - ***? - LET- “12/27/2013 || 11/25/2013

The VGNR is believed to refer to it being a Vigenere cipher. CAP = Cipher Analytical Protocol The keyword SEVEN was gotten from the morse code at the end of the phone call (Nov 21 11:00PM) which translated to “CODE7667” with the “***?” indicating that we should use the 4th number.

Nov 22nd:

15:30 - New cipher (Caesar) added to frontpage, translates to:

MY DEAR SISTER. I’M HEADING TO THE INSTITUTE. GOD KNOWS WHAT HAPPENED TO THIS PLACE NOW. THIS OLD BASTARD WILL HELP US. HE MUST HELP US. –0321–

00:45 - Site frontpage changed:

Nuclear winter is coming. Reserve your future home today! ###PERMISSION DENIED BY OVERSEER (15334) ###


?? - Page /V137 found by guessing based on the .mp3 name of the third (current) morse code, unsure how it relates to things yet

Nov 21st:

23:00 - Site frontpage added:

Nuclear winter is coming. Reserve your future home today! 877-260-2299

20:20 - Frontpage’s morse code has changed. The new code is:

CQ/CQ/CQ/DE/OZ/PSE/AS

CALLING ANY STATION. CALLING ANY STATION. CALLING ANY STATION. THIS IS OZ. PLEASE STAND BY.

19:00 - Mp3 is found by accident that sounds a lot like a Fallout trailer’s soundtrack.

Nov 19th:

The Tumblr/Twitter are confirmed by their authors to be fake

Nov 14th:

http://thesurvivor2299.com/ (henceforth referred to as ‘the site’) is first found by a redditor who was watching all domain registrations by Zenimax. It was broadcasting morse code that translated to “11.12.13”. Shortly after discovery, the morse code was changed to mean “11.12.13 12.11.13”, which is both the European and US date formats for the end of the javascript Countdown.


Unsolved Riddles:

Ciphers & Codes:

  • Nothing right now...

Loose Ends:

  • Nov 24 - 20:00 - “ONE” and “SIX”
  • Nov 24 - 17:10 - “2510730 PLEASE STAND BY” (may have just meant we had to wait for the 20:44 morse code)
  • Nov 23 - 23:48 - The meaning of “19.04” (could possibly branch off from the LLUB riddle)
  • Nov 22 - 15:30 - Who “–0321–” is (an Android??)
  • Nov 22 - 12:45 - No use yet for the Overseer (15334) number
  • Dates: 11/25, 12/1, 12/11, 12/27


Note: at around 20:45 on Nov 24th, all subpages with accessible content went 404 (excluding mp3s)

Known URLs:

URL

Found by

Status

Significance

/VT119

404

SY684> OVERRIDING PROTOCOL VT-15812 WITH KEY '7667'

UNKNOWN ENEMY DETECTED


Hidden Message:

REV FEAR - MGSS LHM'H EVHV KBIM'R QIUBMU. CB'L Z YYG MN HBM ZQSUB ZZAY

/V137

Guessing based on the .mp3 name of the third (current) morse code

404

The first discovered link, originally said “VT137-7042299-V119BST : PERMISSION DENIED BY OVERSEER”

/7042299 is a page

/5725478

404

Originally said “SIX”

/525478 

404

Originally said “QBN = EF | BGP = OZ | CNC = SZ”

/5625478

Redditor ran a brute force of pages with names 7 digits long; subsequently  also found by typing LOCKHRT on a phone

404

Originally said “2510730 PLEASE STAND BY”

Then said “ONE”

/22472855

Redditor Bullshii, found by typing LLUB (from /23710-7667-1660) on a mobile keyboard, then reversing it to get 2855

404

Originally said “VT137BST7667-LCKHRT: FILE NOT FOUND”
led to
/5625478

/23710-7667-1660

Buessing from GBG; Granary Burying Ground was established in 1660

404

Originally said “19.04 || 2247 LLUB”
led to
/22472855

/7042299

Based on the date in the recent translated cipher (Nov 23 - 7:30PM)

404

Originally said “GBG #23710-7667-?”
led to
/23710-7667-1660

/877260

Guessing based on the first six digits of the phone number

404

Originally 403

/age

403

/assets

403

Probably just a directory for js

/flash

403

/doc

yeah

403

Anything typed after ‘c’ leads to a 403 page as well

/radio

403

Probably just a directory for mp3s

country.html

Currently found in the source code of the front page

Empty

Associated with the cookie age verify

noentry.html

Currently found in the source code of the front page

Empty

If the age check fails, should go here

/css

Bruteforce

Empty

Probably just a directory for css related files


An index file was recently added.

stream.

Redirect

Points to bethsoft.com

cdnstatic.

Redirect

Redirects to the nearest CloudFront CDN server

ns1. & ns2.

Google searching site:thesurvivor2299.com

Redirect

Just the hosting name server

A 403 error code (Forbidden) means that the content is there, but the server has no permission to display it. It might have permission in the future. A 500 error code is a generic error message having to do with the files that make up the page.

“File not found.” appears for all files ending in .php

An empty page means that the directory is there, but someone created an empty “index.html” file inside it. It’s probably the simplest way to block a directory listing while allowing access to the contents in that directory.

If you find any other errors, look here.

Known MP3s

Note: Since thesurvivor2299.com often removes old mp3’s, these links are to a mirror site, owned by Padd00o

URL

Found by

Status

Translation / [Significance]

bridgeport-5284ec0d1b93c.mp3

Thu, 14 Nov 2013 15:28:13 GMT

Initial Morse code on the background of front page

404

11.12.13, 12.11.13

V137-528ce4417e27d.mp3

Wed, 20 Nov 2013 16:33:05 GMT

Second Morse code on the background of front page. Has since been removed

404

CQ CQ CQ DE OZ PSE AS



Calling Any Station, Calling Any Station, Calling Any Station, This is From OZ (Oscar Zulu?), Please Wait

fall-river-52862d007e8ab.mp3

Fri, 15 Nov 2013 14:17:36 GMT

Commented in the .js, has since been removed



Third morse code on the background of front page. Has since been removed

404

“OZ  DE  SZ Msg + EF Is Hit II EF Is Hit K”



OZ(BGP), this is SZ(CNC), msg EF(QBN) is hit, repeat, EF(QBN) is hit


[Fall River is ~52mi from Boston]

longfellow-52939ac559777.mp3

Mon, 25 Nov 2013 18:45:25 GMT

Forth Morse code on the background of front page. Has since been removed

404

...NEW YORK STAGE 7, WASHINGTON STAGE 7..., etc



[
Longfellow Bridge connects the Institute(MIT) to Granary Burying Ground]

hanscom-msg-52862c3e7a30e.mp3

Fri, 15 Nov 2013 14:14:22 GMT

Commented in the .js, has since been removed


Fifth Morse code on the front page. Has since been removed

404

Calling all stations, calling all stations, calling all stations, this is (vault tec?) 2510730 one six emergency (vault tec?) shelter for survivors in quabbin, no.119, repeat, emergency vault tec shelter for survivors in quabbin, no.119, over



[Hanscom AFB is ~22mi from Boston]

Prov-5296576f14c63.mp3

Wed, 27 Nov 2013 20:34:55 GMT

Sixth Morse code on the front page. Has since been removed

404

Calling all stations, calling all stations, calling all stations. Boston is gone, I repeat, Boston is gone. No Hope. Frequency 3450 Return Transmission.  God Bless America.


[Providence is the capital city of Rhode Island. Providence is also the closest major city to Boston, located ~50mi away]

Unknown-7667.mp3

Date unknown

Seventh Morse code on the front page. Has since been removed

404

Calling all stations, this is overseer 119 emergency enemy unknown, SOS. Vault 119 Quabbin 7667, repeat, SOS, Vault 119 Quabbin 7667 enemy unknown.

Unknown-2-7667.mp3

Thu, 14 Nov 2013 20:00:00 GMT

*May be lying, suspicious time

Eighth Morse code on front page. Has since been removed

Active

Calling all stations, this is Vault Overseer 119, anybody near Quabbin? SOS Vault door breach, repeat, SOS Vault door breach, enemy unknown, level 1, 2, and 3 gone, survivors in secure location on level 4

Unknown-3-7667.mp3

Thu, 14 Nov 2013 20:00:00 GMT

*Approximate time

Ninth Morse code on the front page. Has since been removed

Active

Calling all stations, this is Vault 119, SOS, Level 4 is under attack, Overseer is dead, repeat, SOS, Level 4 is under attack, Overseer is dead. We won’t make it?

TI-529c94d1b9e57.mp3

Mon, 02 Dec 2013 14:10:25 GMT

Tenth Morse code on the front page. Has since been removed

Active

Calling Black Row(?). On the site(?); ground is safe. Too late, level 4 breach. No survivors, 899 corpses. We are leaving Vault 119. Over, back to you.

Broken-Harvard-Bridge-529e38ca8b92b.mp3

Tue, 03 Dec 2013 19:20:00 GMT

Eleventh Morse code on the front page. Has since been removed

Active

Calling Black Row. On the site. Reporting suspect activity near secured location The Institute. 1 (Vault Dweller/Visual Target Detected); 02 (and/no); 3 unknown humans 3 miles north-west. D/K-



[Harvard Bridge connects Back Bay, Boston to Cambridge. It also carries Massachusetts Ave. across the river; the same avenue that holds Harvard University and MIT(the Institute)]

Broken-Harvard-Bridge-2-529f7ac2ce9d7.mp3

Twelfth Morse on frontpage

Active

Calling Black Row, Calling Black Row. Report: day seven, on Harvard Bridge. People are scared; last night we heard strange noises from The Institute. At the moment we see strange humans distance 2 miles north. Something isn't right with that place, over.

Broken-Harvard-Bridge-3-52a0cd2479d9e.mp3

Thirteenth Morse

The mp3 filename endings appear to be from PHP’s uniqid, which is the unix time in hex (5 digits are after the decimal)


Useful Links:

Morse Code:

Ciphers & Codes:

Web Codes & Errors:

Red Herrings (bad leads, ignore):

  • Piotr Ostrowski: Some poor guy who may have worked with Bethesda in the past. The name came from an email address vaguely related to the site, and he was found hosting Fallout and Skyrim DLCs on a Polish torrent website. A witch hunt ensued, resulting in him deleting everything with his name on it (G+, etc), and now Reddit won’t leave him alone.
  • Erik Todd Dellums: The voice actor for Three Dog. Has stated he’s “just a fan”, and doesn’t know any more than we do. He’s maintained a Twitter account broadcasting daily Fallout themed music for a year. It is encouraged not to pester Erik as even if he did know something, he is bound to a Non Disclosure Agreement with legal repercussions if broken, he won’t break it just because some fanboy on the internet asked nicely. Just like to point to my post about ETD, covering his antics the past few months
  • Cindy Tallent, Executive Vice President and Chief Financial Officer at ZeniMax has the 877-260-2299 number the site teased currently registered to her name. She has links to Bethesda’s marketing department, ‘Vir2l Media’. It’s emphasised that the site owner, whoever that may be, had access to this number in order to shut it down after we had gained the code. This is all she will be relevant for as she will also be bound by an NDA, and as she is on the corporate side of the company, she might not actually know much about Fallout 4 at all other than finances and in-direct marketing.
  • THIS IS THE OVERSEEVTF [sic] VAULT 137  REQESTING [sic] HELP VE [sic] ARE FREEZING AND RUNNING OUT OF FOOD

  • vaultofthefuture.net doesn’t fit the art style of Fallout whatsoever, and the html is questionable. It links to the official twitter, yet not the official facebook? Additionally, IRCers believe it is connected to Malware.
  • Most, if not all of the HAM radio transmissions have been concluded to be fake.
  • vault119.com is fake, as it was registered Nov 29 by namecheap.com
  • KID KEY is quite far fetched
  • ThePropheteer appears to be unrelated

IRC Basics:

  • Please ctrl-f through this Doc before asking questions/offering additions about the arg!
  • IRC Channels:
  • ##fallout4hype - General
  • #fallout4arg - Serious Codebreaking Please keep all discussion here on-topic!
  • #fallout4discussion - Possible Game Features, Plot, Setting, and Characters Discussion:
  • To join a channel, type “/join #channelname”. You can be in several at once.
  • Some clients let you click on #channel links to join them
  • Please be respectful of the topic of the channel.
  • To open a private message with someone, type “/query Username”
  • Some clients allow you to click (right click?) their name
  • You will need some type of IRC client - freenode has one online.

Screen Caps

Front Page after end of 1st Countdown        

/VT119/

/VT119/ hidden message

Editors:

PM us on IRC if you have anything to submit/correct

  • Nebual
  • VaultOfDaedalus - Robert
  • acidx - Leandro
  • MDirt - Emm Dirt
  • abermuffin - Dan
  • dsmndlckhrt
  • afischer15/fischer
  • hitops
  • sortiecat
  • Chazzen01

VAULT-TEC CONFIDENTIAL