VAULT-TEC

Recent Developments


December 7 0300 UTC - As many of you already know, thesurvivor2299.com has now officially been revealed to be a hoax. It has been an absolute pleasure to have worked on this project with all of you, even if it did end in disappointment. I will always fondly remember the time spent on IRC trying to break codes and postulating as to what it all means; I hope you will as well. I wish all of you a happy, safe, and productive life. On behalf of Nebual, sortiecat, MDirt, VaultofDaedalus, acidx, SixthArmySod, Kanade, Nerval, Water48, fischer, Chazzen01, myself, and all of the other OPs, good night and good luck. And remember-- tick tick tickity means run your ass out of there, and pop some rad away for good measure ; )

Your friendly neighborhood Overseer,

hitops


Table of Contents

General Info:


Chronology:

November 2013

S

M

T

W

T

F

S

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

December 2013

S

M

T

W

T

F

S

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

Dec 7th

03:00 - Welp, thats all folks! The site has officially outed itself.

Dec 6th

22:20 - Bethesda tweets “PSA: If you don’t hear it through an official channel like this, assume all rumors and speculation are false.” IRC has mixed feelings.

22:02 - New morse code:

PSE AS

Please stand by

22:00 - Cipher removed, now just says “PLEASE STAND BY” in clear text

21:45 - Site updated!

REV 3120 PAB UNAT BA XVQ, VG'F ABG BIRE LRG

VG YBBXF ONQ

XRRC GURZ OHFL, V'YY TRG UVZ GB GUR FURYGRE

CNO(?) HANG ON KID, IT'S NOT OVER YET

IT LOOKS BAD

KEEP THEM BUSY, I'LL GET HIM TO THE SHELTER

CQ CQ CQ BR AA EMRG MSG WE R UR ATK FREQ 2250 II AA EMRG MSG WE R UR ATK FREQ 2250 II AA EMRG MSG WE R UR ATK FREQ 2250

Calling all stations, calling all stations, calling all stations. Break.

Attention all. Emergency Message. We are under attack. Frequency 2250. I say again.  
Attention all. Emergency Message. We are under attack. Frequency 2250. I say again.  
Attention all. Emergency Message. We are under attack. Frequency 2250.

Dec 5th

21:11 - favicon.ico changed from “V119-QR” to read “EJYOBA 75”, meaning unknown

21:10 - Ciphertext modified slightly, adding the {}’s

        AK: {REV _____ 5120} [CPS] PASS {LOC BB YEAR LET} - | H EY XHWHD OF GXSIHS EVE, ZFR G'K ATGEVY ROCL'JM QEOX.GTJX ZSFF QRETYHA HWEUHG WG VKKP HHWE. MCCCZNU SQ UUE VMXECEDCZ. MFE BNMC NEGE QLZCR TP MZ MR YUOG ACBSM. |

I AM SORRY TO INFORM YOU, BUT I'M AFRAID THEY'RE DEAD. YOUR LIFE SUPPORT SYSTEM IS JUST FINE. WELCOME TO THE INSTITUTE. THE ONLY SAFE PLACE TO BE IN THIS WORLD.

20:00 - New Ciphertext (frontpage) - Modified at 21:10 to be slightly more clear

 

19:04 - New Morse (frontpage)

        CLG BR EMRG IS OVR WE AR OTNB WT AMO STH ATK CMP WA DD N WY OU ALL UNT CD 512Ø EVAC Z Y X YUR NXT

CALLING BLACK ROW, [“EMERGENCY IS OVER,” or “EMERGENCY! IT’S OVER.”] WE ARE [“ON THE NORTH BRIDGEor “OUTNUMBERED”] WITHOUT AMMO. SOMETHING ATTACKED CAMP. WE ARE DOOMED, NO WAY OUT, ALL UNITS [“CONFIRMED DEAD.” or “CODE:“] 5120: EVACUATE. Z Y X, YOU’RE NEXT

Dec 4th

20:00 - New ciphertext (frontpage)

        ZYX 5625478+7878 - HVCD AYX XOTF LFG IVL EGIBDYU CD RZWVI?

UJY'H VOSC FW SFP'GS POCVK KYVI L UWX IVYGLV. XZAG YU,  DHNY PJFF CCZ! ZM'K NZHP HQ QV.
NAWLV OSS HEJB RGO TVXS HBVD?

WHAT THE FUCK ARE YOU LOOKING AT KIDDO? DON'T TELL ME YOU'VE NEVER SEEN A GUN BEFORE. COME ON, MOVE YOUR ASS! IT'S TIME TO GO. WHERE THE FUCK YOU CAME FROM?

19:00 - New Morse code (Broken-Harvard-Bridge-2)

        CLG BR CLG BR RPT DY SEV ON HVB PPL AR SCRD LST NGHT WE HRD STR NES FM TI ATM WE SE STR HUM DX Ø2 MIL N SMTH INT RGTH WID TH PL K

Calling Black Row, Calling Black Row. Report: day seven, on Harvard Bridge. People are scared; last night we heard strange noises from The Institute. At the moment we see strange humans distance 2 miles north. Something isn't right with that place, over.

Dec 3rd

19:20 - New Morse code (Broken-Harvard-Bridge)

CLG BR OTST RPT SUSP ACT NER SL TI 1 VTD 02 N 3 UNWN HUM 03 MIL NW [D- or K]

Dec 2nd

23:00 - The Bethesda Black Friday/Cyber Monday posters are interpreted by some to look vaguely like a map of boston

19:30 - New page discovered (Imgur Backup)

REV FEAR - MGSS LHM'H EVHV KBIM'R QIUBMU. CB'L Z YYG MN HBM ZQSUB ZZAY

THEY DON'T KNOW WHAT'S COMING. IT'S A KEY TO THE GREAT GAME

 

14:20 - New Morse code (TI-529c94d1b9e57.mp3)

CLG BR OTST GX IS SF TL LVL 4 BRE N SRV 899 CRPS WE LVG VT 119 KN

CALLING BLACK ROW. OUTPOST; GROUND IS SAFE. TOO LATE, LEVEL 4 BREACH. NO SURVIVORS, 899 CORPSES. WE ARE LEAVING VAULT 119. OVER, BACK TO YOU.

03:28 - New Morse code (Unknown-3-7667)

CQ CQ CQ DE VT 119 SOS LVL4 UND ATTK OS IS DEAD II SOS LVL4 UND ATTK OS IS DEAD WE WNT MK I

CALLING ALL STATIONS, THIS IS VAULT 119, SOS, LEVEL 4 IS UNDER ATTACK, OVERSEER IS DEAD, REPEAT, SOS, LEVEL 4 IS UNDER ATTACK, OVERSEER IS DEAD. WE WON’T MAKE IT.

Dec 1st

21:30-03:20 - The website is non responsive for most people.

22:03 - New Morse code (Unknown-2-7667)

CQ CQ CQ DE VT OS 119 ANB NR QBN SOS V DR BRE II SOS V DR BRE EN UNKN LVL 1 2 3 GONE SRV ON SL LVL 4

CALLING ALL STATIONS, THIS IS VAULT OVERSEER 119, ANYBODY NEAR QUABBIN? SOS VAULT DOOR BREACH, REPEAT, SOS VAULT DOOR BREACH, ENEMY UNKNOWN, LEVEL 1, 2, AND 3 GONE, SURVIVORS ON (SERVICE LIFT? SEALED? SECURE LOCATION?) LEVEL 4

21:10 - New Morse code (Unknown-7667)

CQ CQ CQ DE OVS 119 EMRG EN UNKN SOS SOS SOS VT 119 QBN 7667 II SOS SOS SOS VT 119 QBN 7667 EN UNKN

CALLING ALL STATIONS, THIS IS OVERSEER 119 EMERGENCY ENEMY UNKNOWN, SOS. VAULT 119 QUABBIN 7667, REPEAT, SOS, VAULT 119 QUABBIN 7667 ENEMY UNKNOWN.

20:35 - The timer expires, site struggles under heavy load, New message:

KVNGR REV ALPHA PPS VT    PIZ UHMYLPVOQ CM XHWMZP. NBJB SPI'F BYQS QT D'Y BYFGEOB FI VQDYL MAQ. -NGQHT 5120-

THE INSTITUTE IS SEALED. THEY WON'T HELP US. I'M HEADING TO BLACK ROW. -NGQHT 5120-

20:24 - The timer has been fixed. Set to expire in 11 minutes.

20:08 - IRC users discover some mirror websites. The website is unlikely to be an official mirror.

19:55 - Site sputters up, running an updated nginx 1.4.4 and PHP 5.4.21, with a timer change (added 12 hours)

18:00 - Site goes down, possibly under load.

Nov 28th-30th

No updates, possibly because Zenimax’s offices are closed for the Thanksgiving holiday. The ARG may have been planned such that the final pre-Apocalypse message (Boston is gone. No hope.) would be sent shortly before Thanksgiving, so that the lack of activity during the week of Thanksgiving could be explained by the falling of the bombs.

Nov 27th

22:44 - Folks at a pirate radio forum notice odd transmissions on 3450Hz near Boston.

20:30 - Front page has new morse code (prov):

CQ CQ CQ BST IS GONE II BST IS GONE N HPE FREQ 3450 RT GB AMERICA

CALLING ALL STATIONS, CALLING ALL STATIONS, CALLING ALL STATIONS. BOSTON IS GONE, I REPEAT, BOSTON IS GONE. NO HOPE. FREQUENCY 3450 RETURN TRANSMISSION. GOD BLESS AMERICA.

19:32 - IRC user threedog_ points out the favicon, when opened as a text file, reads “V119-QR”.

Nov 26th

00:14 - http://thesurvivor2299.com/radio/ is now a 403, whereas previously it was simply an empty page.

23:21 - http://thesurvivor2299.org and http://thesurvivor2299.net are registered. Both redirect to the .com domain. Oddly, whois information for both are hidden, but a DNS record search indicates that the domains are, in fact, directly connected to the main site (they share nameservers) as well as Zenimax (the support email)

19:02 - Front page has new morse code (hanscom-msg):

CQ CQ CQ DE VT 2510730 ONE SIX EMRG VT SHLT FER SURV QBN NR 119 ii EMRG VT SHLT FER SURV QBN NR 119 K

CALLING ALL STATIONS, CALLING ALL STATIONS, CALLING ALL STATIONS, THIS IS VAULT TECHNICIAN 2510730 ONE SIX EMERGENCY VAULT-TEC SHELTER FOR SURVIVORS IN QUABBIN, NUMBER 119, REPEAT, EMERGENCY VAULT-TEC SHELTER FOR SURVIVORS IN QUABBIN, NUMBER 119, OVER

Nov 25th:

19:34-19:40 - thesurvivor2299.com struggles, sometimes returning 500 server error’s.

19:21 - Fallout: New Vegas updated, officially stating “Fixed cloud saves.”

19:02 - Front page plays new morse code (longfellow):

NCRA UNIT BST 314 7 EMRG MSG NEW YORK STAGE 7 WASHINGTON STAGE 7 LOS ANGELES STAGE 7 AUSTIN STAGE 7 CHICAGO STAGE 7 NEW ORLEANS STAGE 7 LAS VEGAS UNKNOWN MIAMI STAGE 7 DALLAS STAGE 7 DENVER STAGE 7 SAN DIEGO STAGE 7 SAN FRANCISCO STAGE 7 BOSTO-

Nov 24th:
22:00 - IRC user ‘dsmndlckhrt’ suggests a possible Fallout 4 map, based on locations in the ARG.

20:44 - Front Page has changed (fall-river):

OZ DE SZ MSG + EF IS HIT II EF IS HIT K

BRIDGEPORT, THIS IS CONCORD (MA), MESSAGE: QUABBIN RESERVOIR IS HIT, REPEAT, QUABBIN RESERVOIR IS HIT, OVER.


20:00-20:18 - New links/activity discovered (404’d 30 minutes later):

17:10 - Redditor allgoodnamestakin ran a brute force of pages with names 7 digits long and got /5625478/.

00:58 - Redditor Bullshii finds /22472855 which shows “VT137BST7667-LCKHRT: FILE NOT FOUND”

Nov 23rd:

23:48 - IRC user ETDellums posts new link leading to /23710-7667-1660/. “19.04 || 2247 LLUB”

20:30 - New page /7042299 found, based on the date in the recent translated cipher.  “GBG #23710-7667-?”

19:30 - Cipher (Beaufort) added to frontpage, translates to:

THE QUABBIN RESERVOIR 7 04 2299

19:00 - /u/maeestro links the phone number from the site update to a woman called Cindy Tallent who works for ZeniMax. The same phone number is also registered to a company called ‘Vir2l Media’, a company that specialises in ‘interactive media and interactive marketing’. Upon calling the number, a ‘ZeniMax’ (needs confirmation, how do you know it was ZeniMax’s and not Vir2l Media’s) answering machine replied: ‘Vir2L Studios has applied design innovation and creative solutions to a broad variety of platforms and media. In addition, Vir2L has developed for tall technical challenges in cross-platform media, with a strong history in high impact web sites, multiple-platform games, CD-ROMs, DVD-ROMs, interactive advertising, and full-motion video.’

1800 - IRC users note that Bethblog.com, thesurvivor2299.com and vir2l.com all use nginx 0.6.76, a version that has been outdated for already 5 years (a reverse proxy server) with bethsoft.com and zenimax.com also using nginx, but their versions are not stated.

17:00 - It is noticed that the site and bethblog use the same (5 year old) version of nginx

00:30 - StevePirates notices the two dates are equidistant from 12/11/2013.

00:00 - Cipher changed on site’s frontpage, (Vigenere) translates to:

VGNR   [CAP] - ***? - LET- “12/27/2013 || 11/25/2013

The VGNR is believed to refer to it being a Vigenere cipher. CAP = Cipher Analytical Protocol The keyword SEVEN was gotten from the morse code at the end of the phone call (Nov 21 11:00PM) which translated to “CODE7667” with the “***?” indicating that we should use the 4th number.

Nov 22nd:

15:30 - New cipher (Caesar) added to frontpage, translates to:

MY DEAR SISTER. I’M HEADING TO THE INSTITUTE. GOD KNOWS WHAT HAPPENED TO THIS PLACE NOW. THIS OLD BASTARD WILL HELP US. HE MUST HELP US. –0321–

00:45 - Site frontpage changed:

Nuclear winter is coming. Reserve your future home today! ###PERMISSION DENIED BY OVERSEER (15334) ###


?? - Page /V137 found by guessing based on the .mp3 name of the third (current) morse code, unsure how it relates to things yet

Nov 21st:

23:00 - Site frontpage added:

Nuclear winter is coming. Reserve your future home today! 877-260-2299

20:20 - Frontpage’s morse code has changed. The new code is:

CQ/CQ/CQ/DE/OZ/PSE/AS

CALLING ANY STATION. CALLING ANY STATION. CALLING ANY STATION. THIS IS OZ. PLEASE STAND BY.

19:00 - Mp3 is found by accident that sounds a lot like a Fallout trailer’s soundtrack.

Nov 19th:

The Tumblr/Twitter are confirmed by their authors to be fake

Nov 14th:

http://thesurvivor2299.com/ (henceforth referred to as ‘the site’) is first found by a redditor who was watching all domain registrations by Zenimax. It was broadcasting morse code that translated to “11.12.13”. Shortly after discovery, the morse code was changed to mean “11.12.13 12.11.13”, which is both the European and US date formats for the end of the javascript Countdown.


Unsolved Riddles:

Ciphers & Codes:

Loose Ends:


Note: at around 20:45 on Nov 24th, all subpages with accessible content went 404 (excluding mp3s)

Known URLs:

URL

Found by

Status

Significance

/VT119

404

SY684> OVERRIDING PROTOCOL VT-15812 WITH KEY '7667'

UNKNOWN ENEMY DETECTED


Hidden Message:

REV FEAR - MGSS LHM'H EVHV KBIM'R QIUBMU. CB'L Z YYG MN HBM ZQSUB ZZAY

/V137

Guessing based on the .mp3 name of the third (current) morse code

404

The first discovered link, originally said “VT137-7042299-V119BST : PERMISSION DENIED BY OVERSEER”

/7042299 is a page

/5725478

404

Originally said “SIX”

/525478 

404

Originally said “QBN = EF | BGP = OZ | CNC = SZ”

/5625478

Redditor ran a brute force of pages with names 7 digits long; subsequently  also found by typing LOCKHRT on a phone

404

Originally said “2510730 PLEASE STAND BY”

Then said “ONE”

/22472855

Redditor Bullshii, found by typing LLUB (from /23710-7667-1660) on a mobile keyboard, then reversing it to get 2855

404

Originally said “VT137BST7667-LCKHRT: FILE NOT FOUND”
led to
/5625478

/23710-7667-1660

Buessing from GBG; Granary Burying Ground was established in 1660

404

Originally said “19.04 || 2247 LLUB”
led to
/22472855

/7042299

Based on the date in the recent translated cipher (Nov 23 - 7:30PM)

404

Originally said “GBG #23710-7667-?”
led to
/23710-7667-1660

/877260

Guessing based on the first six digits of the phone number

404

Originally 403

/age

403

/assets

403

Probably just a directory for js

/flash

403

/doc

yeah

403

Anything typed after ‘c’ leads to a 403 page as well

/radio

403

Probably just a directory for mp3s

country.html

Currently found in the source code of the front page

Empty

Associated with the cookie age verify

noentry.html

Currently found in the source code of the front page

Empty

If the age check fails, should go here

/css

Bruteforce

Empty

Probably just a directory for css related files


An index file was recently added.

stream.

Redirect

Points to bethsoft.com

cdnstatic.

Redirect

Redirects to the nearest CloudFront CDN server

ns1. & ns2.

Google searching site:thesurvivor2299.com

Redirect

Just the hosting name server

A 403 error code (Forbidden) means that the content is there, but the server has no permission to display it. It might have permission in the future. A 500 error code is a generic error message having to do with the files that make up the page.

“File not found.” appears for all files ending in .php

An empty page means that the directory is there, but someone created an empty “index.html” file inside it. It’s probably the simplest way to block a directory listing while allowing access to the contents in that directory.

If you find any other errors, look here.

Known MP3s

Note: Since thesurvivor2299.com often removes old mp3’s, these links are to a mirror site, owned by Padd00o

URL

Found by

Status

Translation / [Significance]

bridgeport-5284ec0d1b93c.mp3

Thu, 14 Nov 2013 15:28:13 GMT

Initial Morse code on the background of front page

404

11.12.13, 12.11.13

V137-528ce4417e27d.mp3

Wed, 20 Nov 2013 16:33:05 GMT

Second Morse code on the background of front page. Has since been removed

404

CQ CQ CQ DE OZ PSE AS



Calling Any Station, Calling Any Station, Calling Any Station, This is From OZ (Oscar Zulu?), Please Wait

fall-river-52862d007e8ab.mp3

Fri, 15 Nov 2013 14:17:36 GMT

Commented in the .js, has since been removed



Third morse code on the background of front page. Has since been removed

404

“OZ  DE  SZ Msg + EF Is Hit II EF Is Hit K”



OZ(BGP), this is SZ(CNC), msg EF(QBN) is hit, repeat, EF(QBN) is hit


[Fall River is ~52mi from Boston]

longfellow-52939ac559777.mp3

Mon, 25 Nov 2013 18:45:25 GMT

Forth Morse code on the background of front page. Has since been removed

404

...NEW YORK STAGE 7, WASHINGTON STAGE 7..., etc



[
Longfellow Bridge connects the Institute(MIT) to Granary Burying Ground]

hanscom-msg-52862c3e7a30e.mp3

Fri, 15 Nov 2013 14:14:22 GMT

Commented in the .js, has since been removed


Fifth Morse code on the front page. Has since been removed

404

Calling all stations, calling all stations, calling all stations, this is (vault tec?) 2510730 one six emergency (vault tec?) shelter for survivors in quabbin, no.119, repeat, emergency vault tec shelter for survivors in quabbin, no.119, over



[Hanscom AFB is ~22mi from Boston]

Prov-5296576f14c63.mp3

Wed, 27 Nov 2013 20:34:55 GMT

Sixth Morse code on the front page. Has since been removed

404

Calling all stations, calling all stations, calling all stations. Boston is gone, I repeat, Boston is gone. No Hope. Frequency 3450 Return Transmission.  God Bless America.


[Providence is the capital city of Rhode Island. Providence is also the closest major city to Boston, located ~50mi away]

Unknown-7667.mp3

Date unknown

Seventh Morse code on the front page. Has since been removed

404

Calling all stations, this is overseer 119 emergency enemy unknown, SOS. Vault 119 Quabbin 7667, repeat, SOS, Vault 119 Quabbin 7667 enemy unknown.

Unknown-2-7667.mp3

Thu, 14 Nov 2013 20:00:00 GMT

*May be lying, suspicious time

Eighth Morse code on front page. Has since been removed

Active

Calling all stations, this is Vault Overseer 119, anybody near Quabbin? SOS Vault door breach, repeat, SOS Vault door breach, enemy unknown, level 1, 2, and 3 gone, survivors in secure location on level 4

Unknown-3-7667.mp3

Thu, 14 Nov 2013 20:00:00 GMT

*Approximate time

Ninth Morse code on the front page. Has since been removed

Active

Calling all stations, this is Vault 119, SOS, Level 4 is under attack, Overseer is dead, repeat, SOS, Level 4 is under attack, Overseer is dead. We won’t make it?

TI-529c94d1b9e57.mp3

Mon, 02 Dec 2013 14:10:25 GMT

Tenth Morse code on the front page. Has since been removed

Active

Calling Black Row(?). On the site(?); ground is safe. Too late, level 4 breach. No survivors, 899 corpses. We are leaving Vault 119. Over, back to you.

Broken-Harvard-Bridge-529e38ca8b92b.mp3

Tue, 03 Dec 2013 19:20:00 GMT

Eleventh Morse code on the front page. Has since been removed

Active

Calling Black Row. On the site. Reporting suspect activity near secured location The Institute. 1 (Vault Dweller/Visual Target Detected); 02 (and/no); 3 unknown humans 3 miles north-west. D/K-



[Harvard Bridge connects Back Bay, Boston to Cambridge. It also carries Massachusetts Ave. across the river; the same avenue that holds Harvard University and MIT(the Institute)]

Broken-Harvard-Bridge-2-529f7ac2ce9d7.mp3

Twelfth Morse on frontpage

Active

Calling Black Row, Calling Black Row. Report: day seven, on Harvard Bridge. People are scared; last night we heard strange noises from The Institute. At the moment we see strange humans distance 2 miles north. Something isn't right with that place, over.

Broken-Harvard-Bridge-3-52a0cd2479d9e.mp3

Thirteenth Morse

The mp3 filename endings appear to be from PHP’s uniqid, which is the unix time in hex (5 digits are after the decimal)


Useful Links:

Morse Code:

Ciphers & Codes:

Web Codes & Errors:

Red Herrings (bad leads, ignore):

IRC Basics:


Screen Caps

Front Page after end of 1st Countdown        

/VT119/

/VT119/ hidden message

Editors:

PM us on IRC if you have anything to submit/correct

VAULT-TEC CONFIDENTIAL