unforum

[hunteress1114]

[Trailhead] 138.68.28.247

[catherwood]

if you want us to discuss it here, it's nice to paste the details here.

Binary trailhead:

[sezycei]

http://138.68.28.247/

https://www.reddit.com/r/1386828247/

[hunteress1114]

We have recently been sent an email linking to two images. They have edited EXIF data in these photos. Yet after 9 hours of work we have not been able to figure out what is necessary to move on. Please help us if you'd like.

[catherwood]

again, i'm going to be the cranky old fart here. If you want people here to discuss something HERE, then attach an image or paste a URL and link us to that image. Don't just invite people here to join you on another forum.

[sezycei]

You can be a cranky old fart. We're providing already established and organized sets of information for people here who like this type of thing to find.

You don't have to if you wish not to.

[AmericanWithFreeTime]

Hey there is some stuff to go over so I'm going to be posting a wall
Everything beyond this point is considered a spoiler so consider yourself warned

Discord Chat: https://discord.gg/wTrMPZp
Trailhead: http://archive.4plebs.org/x/thread/17976801/
The trailhead contained binary in AB format, so we decoded that. It was Romans 13:11. We used the verse of Romans 13:11 as a OTP to decrypt the string a the bottom of the document. It brought us to http://138.68.28.247/, The website has Hbnbza Zljvuk, Adluaf-Zpeallu, which is a caesar cipher for "August Second, Twenty Sixteen."
We have been getting periodic updates on the website that disappear and then are referenced to in the source code as HTML comments.
matrix, redherring, pgp
Those are all codes that can be entered that bring you to a Linux Epoch Time (which is Aug 2 2016), the military document being called "redherring", and a public PGP code The PGP code had an email, which miliku emailed and received a response to.
The PM was able to find miliku's snapchat and sent him a disturbing video with gore and the site logo hand drawn over something.
The website also updated with a riddle, "The four dwarves supported its weight, and when it sets in the center of Opportunity, you will have your time."

[AmericanWithFreeTime]

We also noticed "conquest" in the HTML source, but we did not see a clue regarding it.
As of Aug 1 2016, the current agreed upon theory is that the site is being automatically updated by scripts - be it Javascript, cronjobs/bash, or PHP.
http://138.68.28.247/dwarfgold
This was found using the clue "Leprechauns aren't the only short ones with gold." It was checked for steganography which led to a .zip named "HyUOPMsas" and contained a .txt named the same, with the content "Patience is a Virtue".
Page /HyUOPMsas leads to a page with the text, "It isn't time. Patience is a virtue.".
Update 15 minutes later on HyOUPMsas:
Tell us, did you have patience? imsSFUnaA
/imsSfUnaA led to: squiggleman, bigbunny, fencelogo
After solving those three images (squiggleman was a magic eye, bigbunny had the code in the bottom right, and fencelogo top left) we got three strings: "comet, cage, and communication."
This led us to /cagecometcommunication, which has the number 4 in 12 different languages. In the HTML source, we found <dotsandlines>.
After solving those four images, (dotsandlines = power, symbolichistory = toga, boomboom = fire, and bluemen = cyan), we tried a few combinations and ended up with the link /cyanfiretogapower, which automatically HTTP redirected to /blood.

[AmericanWithFreeTime]

On /blood we found:

[blader]

The passphrase page has been replaced with this text:

[JackHayter14]

They changed the date to August 20, which is tomorrow. Let's see what it is

[Moxer123]

anything happen yet?

[GuestUser17]

http://foursociety.com/8.20.2016

A few more pages are available also if you click through the links shown on /declaration page

[Moxer123]

Can't get past the representative page. Can't figure out what it is