Fake puzzles

This article or section documents unconfirmed claims
In general, information sources should normally be verified or PGP-Signed by Cicada.
Please keep this in mind when reading this page.

This article documents a collection of historically relevant puzzles, seemingly related to Cicada 3301, but which are to this day confirmed to be fakes or lack sufficient information to be verifiable.

845145127.tk

Description

During the 2012 puzzle, "845145127.tk" was a fake puzzle. It was a registered domain name^[1], and tried to mislead solvers by taking advantage of 3301's vagueness when announcing the second chance:

Follow the "Numbers dot TK" hint to find it.

The domain name references the legitimate "845145127.com" website from the 2012 puzzle. Its existence can be traced back to the 16th January. It contained an image in an HTML document:^[2]

<html>
<title>845145127</title>
<body>
<center>
<img src="chance.jpg" alt="Do you need some?" width="309" height="425" />
</center>
</body>
</html>
<pre>          	  	  	 		 	 	  	  	 	   	 	 			 	  	 	  	   	  	  	 	 			 	  	  	  	 	 									 	  	  	  	 			 	  	  	  	  										  	  	 	  				 	  	 		 	   	  	  	  			 			 	 		
 	 	 	
</pre>

The HTML document contained a sequence of spaces and tabs, perhaps encoding a message. It is similar to the last "845145127.com" update, but using the same decoding method fails for this message. Whether or not the whitespaces decode to any meaningful information is unknown.

This is an archive of change.jpg. It contained a whitespace binary outguess message, which when converted to ASCII gives:^[3]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here's your last chance:
How many roads must a man walk down, before I will call him a man?
How many seas must a white dove sail, before she drowns in the sand?
How many times must the old lies fly, before they are forever banned?
The answer, my friends...

[Some of you submitted an email address. You have received a key, and you 
knew where to find the lock. But do not feel proud; all doors lead to one 
room, and this task was easiest of all.]


13 to everyone.

- -MUTE
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJPE3q+AAoJEAfLguPQ6KJsBuUH/AutLUk/tazP2z3ZRNGxzJug
32/OVGXiuWVNuqkl0i+9RdQpUox2f7ABl5cCBb/RRFmWYVyAwBq69lSZhnMYQsZ8
dfBodXvG3fp10Oz+x865dsP5PlzxkuDKAzKyjoNaLc/2aNFq4ihE64tqDOfID/dm
yUMv6rvYp9hRIUe3VS324zAYwJls4qlnRXQzbN4TYbPjKjmfJgG3lLSc718YylHL
G7+3Uyc7+zd7ZDeg2p1Kmq57obtLguXooOFIDoV+Nl433ajWcm3xaWKZ13tDulda
hcw2u9ohuZlDxk934HiwtyQ0FqpvoqoD8x2mX3dQ/6RENaKhCMn9noyWYkaPsvU=
=O+n6
-----END PGP SIGNATURE-----

This PGP message was signed by the key 07CB82E3D0E8A26C ("Wind 3301"). This is not 3301's key, which proves this puzzle not to be legitimate.

Origin

Later, a PGP message signed using the same key appeared. Its author claims to be behind many fake puzzles from 2012: https://pastebin.com/V62m76fN

In a writeup about the 2012 puzzle, tekknolagi (one of the public 2012 winners) says:

At this point, our story takes a darker turn. Our elite IRC group of 8 people deceived the rest, and led them on a wild goose chase. We created a branch off the puzzle, and led them solving unsolvable things. We distracted them so we would progress and they would not. We’re sorry to announce that, but it’s a necessary part of the story.

The "branch off" he mentions might be the fake '845145127.tk' puzzle.

Not long after, a user named n_ posted the correct "Numbers Dot TK" URL to the n0v4 IRC channel. As it lead to a PGP-signed message from 3301, it presumably invalidated the "845145127.tk" website. n_ was a well-known solver from that time, who were working in a small team with tekknolagi. On his writeup, tekknolagi claims the user that posted the lead wasn't the n_ he knew. Could 3301 be behind this impersonation?

Wind

"Wind" was an IRC user active during the 2012, 2013 and 2014 puzzles. She claims to be a member of 3301, but never provided proof and it is commonly agreed that she wasn't. Although IRC usernames cannot be used to uniquely identify an individual, she always used the Michigan (US) IP address 24.247.129.78. She was famous for giving vague hints to solvers as she claims to have been tasked to monitor the IRC channels by 3301.

Despite nowadays consensus that she probably was not being a 3301 member, Wind had a somewhat important influence on the community, especially in 2012. She claimed that her IP was "fake" and thus wasn't actually located in Michigan.

2012

It's not exactly clear when Wind first joined the IRC chat in 2012. Many interactions with Wind were lost, only a few instances of such discussions were found^[4]. She interacted both in the solving IRC channel #cicada3301srs as well as the off-topic channel #cicada3301-offtopic.

Mashima is another IRC user that shared the same IP as Wind. He claimed to be on a "different shift" than Wind.

Fake puzzles

Wind (and Mashima) were known to give cryptic clues, never PGP-signed. They have never been solved and it's not known (nor important) whether they even have a solution. Some examples of such clues are:

lpvrx pg zo hrunv.
fmb r jhi wzslemr.
cefl zn laowe
ohqfv rg urn ahg frwap.
zrvymi tahb m bwad, 
rfr'l biiyss an ee.
m gymh ezle aowe qog
ossnm khx zsm.
sambzv ek byam tok swey
kv qwie wahh ie kak
oeh hqtk poc ie veqa.

5181401.

Posted on pastebin with the title "n1D1U1G1A4Q1A2J1"^[5]:

378og340vhq3wnva078ghv04wheqg354h
54uwrhew5hw45ehw45jhwn45ejw45ejwe5
nDUGAAAAQAAJqe5je5jqe5j5qejeqj5ejqe5j
w5eSHW$JHW$JW$JW$JW$JW$JW$JW$JW$JW$J
gbr6nw46ri46rnfgsr6jw6m6sms6ms6jm6rmsr
we5b43hw54jn46nw6rnw64rkw6rjw6rjw6rj
uwhe5uhwe5hwe5hwe5ueqws6mr6m6sms6ms

Example memes from 2012

2013

In 2013, interest spurred once again regarding Wind, when solvers realized that some weird quotes from Wind in 2012 could related to some aspect of the 2013 puzzle. During the 2013 puzzle, two mysterious files named folly and wisdom with the exact same content were found in the Cicada OS. In 2012 puzzle, Wind referenced "folly" multiple times, such as:

<Mahisha> The highly intelligent do not possess Thomas' folly

<Mahisha> I am not Topiary, your folly will lead you from the face.

Solvers thought "Thomas" referenced Thomas More, who wrote "The Praise of Folly".

Wind joined once again during the end phase in 2013^[6]. Interestingly, we claimed to have been signed up in 3301, rather than being one of the original 5 creators (what we said in 2012). She also mentions that she has no say of contacting 3301, which is contradictory with the fact that she previously physically met up with other 3301 members.

2014

NEW VISIT BY WIND:

Few days ago wind was in channel again, IP matched:

Wind hinted that arg 77days and 3301 could be connected. But they probabyl are NOT.

At same time there was /x/ trhead suggestign same thing. We dont know if tha thread was made by wind or did wind saw it and decide to stop in our channel.

http://archive.4plebs.org/x/thread/13461417/

15:38 -!- Wind [18f7814e@gateway/web/freenode/ip.24.247.129.78] has joined #33012013
15:38 < Wind> Hello.
15:45 < Wind> Why are you all still here?

More in logs: http://spiers.usr.sh:808/%2333012013.log

Basicly wind quoted few things from 77days. Mentioned team.forsvarsmakten.se/english/ as part of sequrity question. IP was from Traverse City as usual.

She mildly trolled us with quotes like:

15:45 < Wind> Why are you all still here?
15:58 < Wind> A lot has happened since my last visit.

16:13 < Wind> Change.
16:15 < Wind> -------------
21:14 < Wind_> ce5.
21:15 < Wind_> -------------

20:50 < NiceLurk> >Cicada 3301, a secret society
20:52 < Wind_> A society of 10 is hardly a society at all.
20:54 < masso> why only 10?
20:56 < Wind_> Only 10 exist.
20:24 < Wind_> What is the difference between a tree and a ball of twine?
20:25 < asqw> what is the difference between Wind and Cicada 3301?
20:26 < Wind_> Wind whispers to all.
14:05 < Wind> Do things left alone and clues never found change over time, or are they simply as static as ends never tied?

At same time she was logged in channel ##77days usign nick Alice__

18:15 < hitsujiTMO> /whowas wind
18:15 < NiceLurk> [00:15]	===	Wind 18f7814e gateway/web/freenode/ip.24.247.129.78 * 24.247.129.78 - http://webchat.freenode.net
18:16 < NiceLurk>  /whowas alice__
18:16 < NiceLurk> [00:16]	===	Alice__ 18f7814e gateway/web/freenode/ip.24.247.129.78 * 24.247.129.78 - http://webchat.freenode.net

Few posts related to wind:

20:24 < borken> (6:05:35 PM) Wind: Everything comes to an end.
20:24 < borken> (6:05:39 PM) Wind: -------------
20:11 < thearrowflies_> wind was a troll, right?
20:15 < borken> dunno
20:15 < borken> she talks quite a bit like the talk i had 2 years ago with her
20:16 < borken> but I did get this out of her.
20:16 < borken> (5:38:51 PM) borken: So are you on shift, or are you here of your own volition and interest, independant of direction from above?
20:16 < borken> (5:39:35 PM) Wind: I am here on my own agenda.
20:16 < borken> is that pasting html still?
20:17 < thearrowflies_> no
20:17 < thearrowflies_> the wiki said she was a troll
20:17 -!- thearrowflies_ is now known as thearrowflies
20:18 < borken> Doesn't matter what the wiki says.
20:18 < borken> The wiki is full of disinformation to throw followers off the trail.
20:19 < thearrowflies> ah
20:19 < borken> Be your own determining factor.
20:19 < borken> "3301 seeks self motivated people"
20:20 < thearrowflies> what exactly, or as exact as you can get, is 3301?
20:20 < borken> Those who know don't tell and those who tell don't know.
20:21 < borken> That is the sum of 3301.
20:21 < thearrowflies> I have this thought that its just recruiting for something rather lackluster
20:21 < thearrowflies> If it was anything major, I don't think they'd be recruiting so publicly
20:24 < borken> (6:05:35 PM) Wind: Everything comes to an end.
20:24 < borken> (6:05:39 PM) Wind: -------------

Some older Winds IPs:

[23:32] ->> wind is 602a99b6@n0v4-9DB6A6F.dhcp.trcy.mi.charter.com (n0v4 qWebIRC)

http://pastebin.com/UTBcVixL

http://pastebin.com/82tQiYjd

http://pastebin.com/E77hyEG8

http://pastebin.com/fYLYA0Qt

[04:20] <Anon7> wind, what's it like in Michigan?
[04:20] <wind> No, we aren't.
[04:20] <Anon7> You are.
[04:20] <wind> I'm not in Michigan, it's a fake IP.

18:03 < NiceLurk> [03:42] == wind [602a99b6@n0v4-9DB6A6F.dhcp.trcy.mi.charter.com]
18:03 < NiceLurk> Wind (602aa30a@gateway/web/freenode/ip.96.42.163.10)
18:03 < NiceLurk> this are winds previous IPs

[1] ttps://research.domaintools.com/research/whois-history/search/?q=845145127.tk

[2] ttps://web.archive.org/web/20120117063249id_/http://845145127.tk/

[3] ttps://www.allmystery.de/themen/it83189-9

[4] [1] [2] [3]

[5] [4]

[6] [5] [6]

[1]

[2]

[3]

[4]

[5]

[6]