Cicada 3301 2014 Main articles and Subpages

Subpages, tools, splinter groups, other sources...

Open leads, untied, loose ends from previous page

Do things left alone and clues never found change over time, or are they simply as static as ends never tied?

Everything Changes

Check also: Primes mentioned in 2014 puzzle


Iiiustrious zip files archives:

[04:20] <iII|out>  Originals  | outputs of images


'UNUSED CLUES  - Please stick to clues from cicada'2014Flipped cicada in 1033.jpg of onion1 -> 1033 is flipped and the whole image is flipped. Three hex strings from onions. Maybe the delays between the bytes on onion2 and onion3 Text of page 3, 4 and(half of 5 and) 6 of liber primus. four lines in the decrypted text of page5 & 6 which don't add up to primes The Square matrix. -> 1033// the magic square, you mean? for a lot of reasons, not a true magic square ok, a 5x5 matrix, yes? yeah! true.the matrix construed as a matrix or the words therein? (the possible letters on 1033.jpg if you believe it's not artifacts). (MXXXIII / MMMCCCI, but not sure if this was the best possible interpretation) MXXXIII was upside down right? Confirmed. Additional 0x35 0x37 / 57 on onion3-longString. It was 0x57 in my opionion <-- The server response grew by two bytes, 0x35 0x37. When viewed (as ASCII) this shows up as 57. If included in the hex-bin conversion it turns into W (0x57/87 decimal). Primes in HTML comments - 761, 1033, 3301 The primes: the palindrome prime of cicadas twitter account @1231507051321 the date 6 Jan of the twitter post which started this year -> 61 = prime embedded Roman/Latin numbers in the image are 1033 in Arab. Therefore, it could have something to do with the Roman/Julian and Georgian calendar change (  or, with the image depicting Newton , which may lead to Gallileo  </head> and <head> misformatting of the webpages of the onions, though it is not evident which tag was used wrong at what onion -> could tie the onions together or give a structure for some other element   2013Wisdom/folly (This is a copy of Folly, but they're identical) The parable and the parable number: 1,595,277,641 2012The ps string 2012, and its factors: P.S.: 10412790658919985359827898739594318956404425106955675643739226952372682423852959081739834390370374475764863415203423499357108713631 P= 99554414790940424414351515490472769096534141749790794321708050837*Q= 104593961812606247801193807142122161186583731774511103180935025763 

missing < /head> from onion 1 and beginning of  onion 4 with < /head>

[06:55] <Pilgrim> what was the first onion with the missing </head>:

onion 4 had </head> for beginning:

JPGs with no outguess:

We have two jpgs with no legit outguess:

  • One of bottom mirrored jpg from onion3 string, that produces garbage
  • Page 4 (5x5 magic square) from server-status string on onion 3

List of strings to look for:


Read also:

We all know that last jpg we got apparentyl has no OUTGUESS

  • on the bottom of the link you have log explaining how outguess can be visually detected

You can retrieve data from an image in the following way:

$ outguess -k "my secret key" -r out.jpg hidden.txt
Reading out.jpg....
Extracting usable bits:   40059 bits
Steg retrieve: seed: 7225, len: 1839

You can also use keyfile instead of a password:

outguess -r -k "password"  input.jpg output.txt

Beware! Outguess produces random garbage as false positive in many cases!

no passowrd is same as 'Default key'

outguess -k "Default key" -r 2012.jpg outdefault.txt   produces same result as
outguess  -r 2012.jpg outnokey.txt

line 801 of outguess.c
char *key = "Default key", *key2 = NULL;

More exampes:

Some log:

[02:28] <masso> Guys, we found out there is most likely some outguess in the rune-pic from the server, encrypted with password or keyfile...
[02:28] <masso>
[02:28] <masso>
[02:29] <masso> pics show definitely the same pattern that outguess does

[02:37] <masso> Outguess changes the RGB color values to hide information in jpgs.
[02:39] <masso> With colour correction and by changing brightness/contrast you can see this modified pixels.
[02:40] <masso> Usually outguess doesn't change plain white px,but only modifies the coloured ones.
[02:41] <masso> The rune picture from the server has clearly this modifications in the runes, as seen after doing some colour/contrast magic in PS.
[02:42] <masso> Means, most likely there is some outguessed message in the pic, but protected with a keyfile or password.


missing n in onion address in book code


mistakes on page 5 and 6 of the book


html comments 761, 1033, 3301, for everyting that lives is holy.....


post numbers raising for ever onion (see absences post on bottom of page 3)


57 second string on onion 3 v 3


Cicada uses different port for every onion
Apache Server at auqgnxjtvdbll3pv.onion Port 5240
Apache Server at cu343l33nqaekrnw.onion Port 5241
Apache Server at fv7lyucmeozzd5j4.onion Port 5242
Apache Server at avowyfgl5lkzfj3n.onion Port 5243

To see PORT number just enter nonexisting link after valid onion url


Maybe the same Server? Would make sense from cicadas view


<cydoniac> Something to note, is that on the new onion, the html source 
           contains a sole < /head> tag, along with the < !--3301--> 
           (spaces for Wikia)
<cydoniac> At first glance this appears to be a mistake, but remember that
           the source of the onion (1033.jpg) page has an opening head tag
           but no closing:
<cydoniac> < html >< head > < title >For Every Thing That Lives Is Holy
           < / title> < body >< img src="1033.jpg" />< / body>< / html >  
<cydoniac> This does seem to indicate that there is a direct relation here
           that we have yet to make between the onion pages, and seems to 
           be a continuation of the first page in some form. Related to 
           1033.jpg? Uncertain.
<cydoniac> Some additonal things to note;
<cydoniac> Gematria Values:
<cydoniac> "Patience is a virtue" - 761
<cydoniac> "For Every Thing That Lives Is Holy" = 1033
<cydoniac> ??? = 3301
<cydoniac> It would seem to indicate that a particular phrase matches 3301
           that we have either already seen or yet to be revealed. It would
           probably be a long-ish phrase, so if anyone finds a phrase and
           thinks it might fit, you can check with to confirm.



Open Lead 1

.onion 3 http://fv7lyucmeozzd5j4.onion/

<1033> counts with gematria [every thing that lives is holy] 87de5b7fa26ab85d2256c453e7f5bc3ac7f25ee743297817febd7741ededf07ca0c7e8b1788ea4131441a8f71c63943d8b56aea6a45159e2f59f9a194af23eaabf9de0f3123c041c882d5b7e03e17ac49be67cef29fbc7786e3bda321a176498835f6198ef22e81c30d44281cd217f7a46f58c84dd7b29b941403ecd75c0c735d20266121f875aa8dec28f32fc153b1393e143fc71616945eea3c10d6820bd631cf775cf3c1f27925b4a2da655f783f7616f3359b23cff6fb5cb69bcb745c55dff439f7eb6a4094bd302b65a84360a62f94c8b010250fcc431c190d6ed8cc8a3bfce37dddb24b93f502ad83c5fa21923189d8be7a6127c4105fcf0e5275286f2

.onion 2 http://cu343l33nqaekrnw.onion/

<761> counts with gematria [patience is a virtue] 634292ba49fe336edada779a34054a335c2ec12c8bbaed4b92dcc05efe98f76abffdc2389bdb9de2cf20c009acdc1945ab095a52609a5c219afd5f3b3edf10fcb25950666dfe8d8c433cd10c0b4c72efdfe12c6270d5cfde291f9cf0d73cb1211140136e4057380c963d70c76948d9cf6775960cf98fbafa435c44015c5959837a0f8d9f46e094f27c5797b7f8ab49bf28fa674d2ad2f726e197839956921dab29724cd48e1a81fc9bab3565f7513e3e368cd0327b47cf595afebb78d6b5bca92ba021cd6734f4362a0b341f359157173b53d49ea5dff5889d2c9de6b0d7e8c615286ce596bfa83f50b6eeabd153aaf50cd75f39929ba11fb0f8e8d611442846

'.onion 4 'https://avowyfgl5lkzfj3n.onion :

< / head >< body >< !--3301-- > bf1d5574ca36efd524e6c34c26cbd628b19aa835aceb94ea7f2ca7f33d1b8f51476bc597d4bf9ad5111d8f39ef5351b3b090bce47f023002fe69928e79f6f8147f6fe051f2f159041f932f5190308d7441fc3cecead0851662d3217485827e640a4183fa5bc8cef5ff7d1473d2746a37fbc8b94318ff0d3aeb467017c0ea5cb33b3e6967453986e1450b35ad47861f679cf7db5a6c170bcfb67544983ec1e36b27ee8c5721da39d27dbfa0cdc15ba3cbaa425e8a8b96b81ab665f3ebc41563a0e9270695d3d68887cfab2c07b290718307f764afba684b17fcfd71323f64206e5fa378b4ee89e80885733080065dd34a5c838898906b8d43de9f1d8eb6922bad < hr > < address >Apache Server at Port 5243< /address > < / body> < / html>

All things should be encrypted, 5x5 magic square jpg

Open Lead - Rune Image - Maybe Outguess with password protection

Please add original here

I havent checked those two files if they are original, but i think imgur one is NOT,

Please do not use IMGUR for original Cicada images, reason is that IMGUR resamples jpgs, more here:

~ Lurker

jpg from onion 3 server status



Wat do?:

The happening We need to add all loose ends here, this page is not finished

Community content is available under CC-BY-SA unless otherwise noted.