Author Topic: Creepy messege from E? [must read]  (Read 3540 times)

0 Members and 1 Guest are viewing this topic.

Offline V Commander

  • Major(1)
  • Posts: 32
Creepy messege from E? [must read]
« on: November 14, 2007, 09:12:45 pm »
Ok guys... I have been tired of retard hackers wannabe annoying noobs ( no I don't mean the newbies on soldat or anyone on soldat ) .

I was busy on the Re servers looking for something while noticing the posts from E?

I managed to get some pretty messed up warning or should I say the bastard is actually planing a massive attack as far as I can think off...

I have studied the asswhipe and found that he hates soldat for some reason and has been around us...

this is what I've gotten sofar.

Watch closely.
Blink and you'll miss it
did you think
it was ove?r
watch as I am watching you
http://img158.imageshack.us/img158/1395/nextmy1.gif
time
how long has it been?
watch closely
skull blocking the way showing only 5 on the and 24 - My pawns still remain, waiting blocked by skull again showing only - (circle showing as blank) months and (circle again ) days
Thursday may 24, Friday 16 November
watch closely
watch closely
watch closely
timeanddate.com
E?
E?=
did you miss me?
216.147.236.61
58.225.36.145
76.95.47.172
75.73.236.83
7.61.141.87
83.226.38.12
68.228.253.47
83.0.253.102

So I believe the bastard has selected server to attack or players to attack. Not only that but he also posted the dates of the attacks so I would like to ask not to play soldat and pass on some info...
I got some old hacker friends looking for the source of the bastard so once I get a pin point on his location report him to the authorities due to attempt of a cyberattack on a game which also the source of income for a person and it MM would like to he could report that to the international authorities...

I'm not sure yet due to the work I've done and plus I cant do much work on it cuz I got my hands hurt as my leader knows...
I'm a captain of the TW division on Re and I'm gonna fight back...

(hope this doesn't break any rules or get me banned... )
-V

PS: I'll do some updates on anything I can find if I'm not banned by then..>>;

Offline a-4-year-old

  • Veteran
  • *****
  • Posts: 1918
Re: Creepy messege from E? [must read]
« Reply #1 on: November 14, 2007, 09:22:09 pm »
watch he tries to hax and gets battleyed.
If we hit the bullseye the rest of the dominoes will fall like a house of cards. Checkmate. -Zapp Brannigan

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: Creepy messege from E? [must read]
« Reply #2 on: November 14, 2007, 09:30:44 pm »
http://forums.soldat.pl/index.php?topic=22183.0


We were dissecting that GIF file in #soldat.devs for a while

edit: and all of those IPs are residential connections, not server IPs (I searched the lobby for those IPs and also noticed that the reverse DNS of each of those is typical of home connections, not server connections)
« Last Edit: November 14, 2007, 09:35:41 pm by FliesLikeABrick »

Offline V Commander

  • Major(1)
  • Posts: 32
Re: Creepy messege from E? [must read]
« Reply #3 on: November 14, 2007, 09:57:53 pm »

this is the one I'm talking about ... I dled it from the forum he posted it.. the other you are talking about its the one mentioned on the stuff within this gif.

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: Creepy messege from E? [must read]
« Reply #4 on: November 14, 2007, 10:18:27 pm »

this is the one I'm talking about ... I dled it from the forum he posted it.. the other you are talking about its the one mentioned on the stuff within this gif.

yes, I'm talking about that one too.  We were talking about it on IRC, even though it isn't mentioned in the other thread (at least not much)

Offline chrisgbk

  • Inactive Staff
  • Veteran
  • *****
  • Posts: 1739
Re: Creepy messege from E? [must read]
« Reply #5 on: November 14, 2007, 11:37:38 pm »
If you notice, May 24th of this year has already gone by; this may have been the date of the last "attack", because this isn't the first time it's happened. Time between that day, and November 16th, the day of the supposed next attack, is 176/177 days, depending on if you include the whole of the 16th. That is also 5 months and 23/24 days. All possible clues. Also amusing if you include the last day, because the 24th day of the 5th month is May 24th. Which was probably deliberate.


So essentially it's someone thinking they are oh so clever, posting crap and stirring up drama.

Date Posted: November 14, 2007, 11:30:09 pm
http://forums.soldat.pl/index.php?topic=22183.0


We were dissecting that GIF file in #soldat.devs for a while

edit: and all of those IPs are residential connections, not server IPs (I searched the lobby for those IPs and also noticed that the reverse DNS of each of those is typical of home connections, not server connections)

Not all of them; 7.61.141.87 in particular belongs to the DoD (they own the entire 7.0.0.0 - 7.255.255.255 block; 7.0.0.0/8)

Offline V Commander

  • Major(1)
  • Posts: 32
Re: Creepy messege from E? [must read]
« Reply #6 on: November 14, 2007, 11:46:12 pm »
According to Bootz the 24th was the day ARC died and the 16 is when all the TW clans are to be dead... So for those who are using IE I would recommend not going to the forums till someone using firefox or another web browser to check on the forums... Also keep your files up to date make a backup and system restore check just in case too.. As for Any virus I got my phone and I'm gonna check my forums from there since it has an antivirus installed and its not affected the same way a virus made for a computer...

I'm saying it just in case and create backups of the forums too ...

Since the forums could be damaged or filled with viruses that they must be deleted and restored.

Wish me luck on finding that asshole.

-V

Offline FliesLikeABrick

  • Administrator
  • Flamebow Warrior
  • *****
  • Posts: 6144
    • Ultimate 13 Soldat
Re: Creepy messege from E? [must read]
« Reply #7 on: November 15, 2007, 12:01:37 am »
Chris, 7/8 is supposedly an Internet bogon (not routed on the public Internet) and is only used internally by the DoD (like how RFC1918 space is used) http://www.irbs.net/internet/nanog/0704/0412.html

Offline Sarge.us

  • Major(1)
  • Posts: 28
Re: Creepy messege from E? [must read]
« Reply #8 on: November 15, 2007, 12:08:25 am »
Well, if you want to know where the ip's are located, go to http://www.ip2location.com...

Just type ips into there and you get their location. I don't know why I posted this...  :P (I feel stupid for agging it on)

Ex:

58.225.36.145 ->   Korea       LATITUDE/LONGITUDE = 37.567 , 127

83.0.253.102 ->   Poland       LATITUDE/LONGITUDE = 52.25 , 21

Four of them are in the US, which shows the city and zip code also. (Comes in handy for stalkers. :-\)

PS:  E is just a little kid who wants attention, don't give him the attention and he'll be gone!
« Last Edit: November 15, 2007, 12:34:51 am by Sarge.us »

Offline Kagesha

  • Flagrunner
  • ****
  • Posts: 702
  • cunts
Re: Creepy messege from E? [must read]
« Reply #9 on: November 15, 2007, 12:19:08 am »
Lol this is like a Soldat Forum Crime scene investigation :P

Would the image by any chance be...a Virus/trojan/spyware or w/e?

Offline Sarge.us

  • Major(1)
  • Posts: 28
Re: Creepy messege from E? [must read]
« Reply #10 on: November 15, 2007, 12:31:11 am »
Lol this is like a Soldat Forum Crime scene investigation :P

Would the image by any chance be...a Virus/trojan/spyware or w/e?

Um, well... It's a .gif file. Honestly, it's just an image file hosted on imageshack, I don't think it would be very easy to host viruses on imageshack.

You won't be getting any viruses for looking at it. So you don't have to worry unless you get a phone call in 7 days!  :o
« Last Edit: November 15, 2007, 12:35:52 am by Sarge.us »

Offline V Commander

  • Major(1)
  • Posts: 32
Re: Creepy messege from E? [must read]
« Reply #11 on: November 15, 2007, 06:54:51 am »
There's no way to get a virus from a .gif file... since even if you haven't clicked on it, its already loaded on the web browser.

And I don't care if the bastard is just another kid as for those kids need a good teaching about the rules.

So far we've found several different IPs he's used. I would still recommend just using a range banning.

-V

Offline blackdevil0742

  • Veteran
  • *****
  • Posts: 1061
  • Don't Panic
Re: Creepy messege from E? [must read]
« Reply #12 on: November 15, 2007, 07:32:31 am »
I do not know about that. There was a link to a .jpg file(redirect maybea) on msn a while back that friend of mine got and if you clicked it it would download an application with a virus of somesort.
« Last Edit: November 15, 2007, 07:34:32 am by blackdevil0742 »

OBEY!!!

Offline -Major-

  • Veteran
  • *****
  • Posts: 1419
Re: Creepy messege from E? [must read]
« Reply #13 on: November 15, 2007, 10:03:19 am »
have I missed something about thsi guy "E?"? I have never heard of him before. could you please list all of the things that have happened and when, also possible tech info. finding his location maybe hard since you dont know his ip, he may use other computers or gates to cover his IP. then you have to trace him all the way back.

Offline BombSki

  • Flagrunner
  • ****
  • Posts: 927
    • Climbing-soldiers.net
Re: Creepy messege from E? [must read]
« Reply #14 on: November 15, 2007, 10:10:34 am »
.. cough.
i thought our conslusion in the other thread was not to give him too much attention. and now everyones looking up IPs everywhere? IPs from a damn gif file hosted on IMAGESHACK? gee, dont you have anything better to do? obviously this kid is having the time of his life reading this thread.

Offline Daimarus

  • Soldier
  • **
  • Posts: 136
  • Believe me, I can kill you with my Spas...
    • SC forums
Re: Creepy messege from E? [must read]
« Reply #15 on: November 15, 2007, 10:17:26 am »
first of all, look before you post another fucking retarded thread.

You're not the first one that woked it out.

Those IPs belong to leaders of 8 TW clans - we indentified 3 of them. One is mine, one it Bob's, on belongs to Gippal.

The only thing is, that there are more inside...
My SPAS-12 doesn't like most of people. He can mistakenly shoot your brain out of your head and splash it on the nearest wall.

Offline -Major-

  • Veteran
  • *****
  • Posts: 1419
Re: Creepy messege from E? [must read]
« Reply #16 on: November 15, 2007, 10:18:46 am »
ehm everything comes from one source. you cant really get into something and clean all the traces. and this mustn't be a kid :) just one with "hacking" knowlage and wants to have some fun. but ofc not caring about this may make him stop or make him want to have more fun going for bigger goals.

Offline BombSki

  • Flagrunner
  • ****
  • Posts: 927
    • Climbing-soldiers.net
Re: Creepy messege from E? [must read]
« Reply #17 on: November 15, 2007, 10:21:42 am »
if its really the IPs of clanleaders then its obviously someone with admin or mod access to a TW forum or server.

Offline Daimarus

  • Soldier
  • **
  • Posts: 136
  • Believe me, I can kill you with my Spas...
    • SC forums
Re: Creepy messege from E? [must read]
« Reply #18 on: November 15, 2007, 10:24:29 am »
Major, as you wanted, here is whole story...

Quote from: Daimarus
I was talking to Daimarus about those strange messages that got spammed everywhere. If you don't know about it, someone calling themselves "Messenger" spammed this message in ARC forums and TW forums:

(http://img443.imageshack.us/img443/6548/areyouwatchingcloselynt5.gif)


So like I said I was talking to daim and he started to think maybe there was more to the message, and slowed it down to look. I started doing the same. We found some weird frames and I looked into them in photoshop. I heard about people writing things in colors close to the background, so that when you turn up the brightness or contrast they appear. We found some troubling things. It was a long process of checking the frames but we found three messages and figured out what they meant.

The first one says "E? WILL BE THE END" the end part spelled using the E?
http://img442.imageshack.us/img442/336/ewillbetheendjt0.png

The second one we figured out that it says letter? above these numbers, one being 5. If you match the number ot the letter in alphabet like it suggests you get E. So it says E? because of the question mark added. Also those other numbers were circled, we're certain its a date. 5/24 because of how the 2 and for are connected.
http://img102.imageshack.us/img102/2333/headdateis2.png

The final one we found was in a frame that I had all ??????????. When I upped the contrast I found these weird dots, and under them it said "will be the death of you. Daim suggested morse and it turns out it spells "D A R C N E S S". So the message is D A R C N E S S will be the death of you.
http://img372.imageshack.us/img372/4108/morse2nj9.png

If you look at these in order, it gives you a date, then it says "D A R C N E S S will be the death of you" and at th end when it flashes up E? it says E? will be the end, using the E? to spell end. Theres is the mysterious E? in each hidden message, even the morse code one. Above the bump for E which is just a dot, it has a question mark, and uses the dot for the . part of ?.

This isn't the worst news. We found out that the other animations didnt have the messages. I had saved the animation when I first saw it in the ARC announcements. It was the first time this messenger person had posted it. Gippal deleted it but left the ones in the non members only section. So only one of the messages was meant to warn us. And it was in the members only section. We think that this person is targeting ARC, and something will happen May 24th. Its a miracle that we even thought to find this out. But the original message with the warning was deleted.

Daimarus has some additional info on the origins of this message:
----------------------------------------------------------------------------------------------------------------------------------------------------
UPDATE=============================================================================
----------------------------------------------------------------------------------------------------------------------------------------------------
Daimarus is relentless, he poked and prodded me to look over EVERY frame of that animation. But lo and behold we found more. And its the scariest yet.

While looking through the frames, including all the doubles, I found a distorted frame with a tiny bit of out of place white. So I upped the contratst and found what appeared to be a URL. It took me a good half hour to zoom in and finally write down what it said, here is the image (you can't read the URL without zooming in, but you can see it):

http://img258.imageshack.us/img258/3954/urlwj6.jpg

So we followed the URL to this...

http://img441.imageshack.us/img441/4268/deathofyouyj2.gif

f**k. Freaky. Daim finally considered us safe, and we could almost feel the weight coming off our shoulders (sorry ARC but we were happy it wasn't us). But then I got to thinking, theres no way thats it. Its not their style. So i had the idea to check THOSE frames. What we found sent us back to square one, but on a whole new playing field.

First off, whoever is responsible for these is a genius. It took me so long to find the messages because instead of using the brightness/contrast trick, he used something I dont even know. It seems impossible to have thought it out this well. Basically I went through all the different adjustments until I got to the "Replace color". Now heres where I got lucky, because if I hadn't I wouldn't have found anything. The way he set this up, I had to set it to the EXACT right hue and saturation for it to show up. But heres the genius part, it doesn't show on the ACTUAL image, only in the PREVIEW image for the color replacement. So I had to screenshot, and I can never get it to the exact same hue/saturation again. Whoever we're dealing with, they are smart.

I found a message in the second frame:

(http://img76.imageshack.us/img76/6957/onlythefirstpy0.jpg)

I showed it to Daim and needless to say we were freaked. And we also couldn't figure how he had hidden this so geniously. I continued adjusting the the hues and whatnot on the next frame. It took me even long.

I found the next message:

(http://img58.imageshack.us/img58/8186/threstwillbeslowbw5.jpg)

We quickly realized he meant the other clans. We almost weren't going to tell anyone for fear of what would happen, but then we found what we believe to be his intentions:



This is what he wants, he wouldn't have left the road map and clues unless he wanted someone somehow to find them. I believe the messenger person is a pawn for someone bigger. We decided to tell you, or else we'd be doing what he wants, backstabbing each other. WE have become his messengers. WE are his pawns. And his message is simple. Tear each other apart. He said it, ARC will only be the first, the rest will be slow, TRUST NO ONE. He wants us to be suspicious of everyone, fear the unknown. And honestly, maybe we should, because it could be anyone.

But then he spelled it out for us in the last frame...

(http://img260.imageshack.us/img260/7104/fearefx5.jpg)

We've done exactly what he wants, we thought maybe we were a step ahead knowing all this. But again the truth is he wanted us to know. He wanted us to fear. And I don't know about you guys, but this genius...E? or messenger, or whoever, or WHATever...they've done their job.




Big note from old TW forums.

As he said, THE REST WILL BE SLOW. He is back, right after 5 months and 24 days since the ARC death.

This isn't a kid - a 13 old wouldn't bother (or even wouldn't be able to) to make so complicated message.


And it is not that hard to get somebody's IP, BombSki. That guy doesn't ahve to be an admin of any server (which doesn't mean he isn't.)
« Last Edit: November 15, 2007, 10:27:44 am by Daimarus »
My SPAS-12 doesn't like most of people. He can mistakenly shoot your brain out of your head and splash it on the nearest wall.

Offline Avarax

  • Veteran
  • *****
  • Posts: 1529
    • Official Hexer & MMod site
Re: Creepy messege from E? [must read]
« Reply #19 on: November 15, 2007, 10:46:47 am »
It's another forum riddle Chakra made up!
I like to have one Martini
Two at the very most
Three I'm under the table
Four I'm under the host