A series of advertisements on various forums (including Craigslist) that could possibly be part of the ARG. This has been confirmed to be part of the ARG.
Here is a list of the advertisements found (though not a full list, for there are many, many more):
Windows Live Expo, Los Angeles, CA
Windows Live Expo, Boston, MA
Windows Live Expo, Seattle, WA
Windows Live Expo, New York, NY
Windows Live Expo, San Francisco, CA (1)
Windows Live Expo, Chicago, IL
Windows Live Expo, San Francisco, CA (2)
Windows Live Expo, San Francisco, CA (3) ("hiring" ad)
Craigslist, San Francisco Bay Area, "Surplus Equipment" Ad
Oodle.com "Surplus Equipment" Ad, San Francisco, CA
Craigslist, New York, NY
Oodle.com Ad, Brondesbury, UK
Yahoo Classifieds, Ankeny, IA
Yahoo Classifieds, Los Angeles, CA
Yahoo Classifieds, Boston, MA
Yahoo Classifieds, Seattle, WA
Yahoo Classifieds, New York, NY
Yahoo Classifieds, Chicago IL
Yahoo Classifieds, San Francisco, CA
This picture is attached to nearly every advertisement:
Coordinates listed on the links' "Get Driving Directions" pages were believed to be of importance originally, but these locations proved fruitless.
There is also a phone number attached to every advertisement:
When called originally, the following message played: Pressing * during the message allowed the caller to enter a password.
On July 7, 2007, at approximately 8:16 AM PST, the phone message changed. Either someone got the password right, or it was changed by its owner: Here is the message as transcribed by WikiBruce and CompoundIntelligence. It has been interpreted to the best of their abilities, though may possibly contain some mistakes:
Op (British Female, heavy echo): Welcome to the Strema Conferencing center. Please enter pin number followed by the--
"Caller": [(beeps of ####)][(131#?)]
Op (British Female, heavy echo): Password accepted. Now accessing conference archive number one-six-one-eight-zero, participant one-two.
Male voice 1 (clear): ...is necessary, and neither is the doc download.
Male voice 2 (clear): I agree. This isn't going to be a public resource. Uh, pass on the document number so I can delete it.
(Pause, 3 seconds)
Male voice 1 (clear): There's no way to tell yet, but ("Jamie" or "Jimmy")'s looking into the records to find out how many closed sites there are, but as for active clean up, somewhere around three, four thousand?
Oh here it is. Uh, Hold on. Four-oh-two, K, zero-seven-zero-zero-two. And in terms of numbers most of these are past the PPE stage.
(Pause, 4 seconds)
Male voice 2 (clear): With a few exceptions: site 34. . . .
Op (American Female, clear): --Thank you for calling. Goodbye.
As of 6:23 PM PST, Iris followers from many-a-forum believe they see numbers in the AdPicture posted above. These numbers are speculated to lead to an IP address. Some numbers believed to be viewed are: 15, 102 (or 104), 129 (or 120), 105, 50, and 107. Whether these are numbers or just interesting cracks in the walls is still being debated.
On July 8, 2007, at approximately 1:08 AM PST, the message from the phone number changed:
At around 9:15 AM PST, the message was updated with a second part of the first conversation.
Here's an MP3 recording of part 2. Here's a transcript from Bungie.net (may contain mistakes):
Man #2: ...Sites 4, 107, and 37. The Center usually goes in before we do, thats been my experience.
Man #1: By the time we have the site clean...they have more pressing needs, after all we've had some extremely unpredictable seasons lately.
Man #2: No need, their rep is available any time we need her.
Man #1: On everything we still need to look into.
Man #2: Well we're working on it, for the moment we're simply hiding the data behind a false menu item.
Man#1: Security will be updated before the next system approaches.
Man #2: Ok Great. Bye Bill.
Man #1: Thanks.
OP Female: Thank you for calling, Goodbye.
At 11:06 PM PST, the message was replaced.
On July 9, 2007, at approximately 7:52 AM PST, the audio changed to "Bill's" side of the conference call: Here are the messages when spliced together. A perfect fit: On July 10th, 2007 around 4:30 PM PDT, the fourth and final message was released. Here is the entire conversation with the 4th message included:The number you dialed is temporarily unavailable. (Constant busy signal)
Man 1: ...is necessary, and neither is the doc download.
Man 2: I agree. This isn't going to be a public resource. Uh, pass on the document number so I can delete it.
Man 3 (Bill?): So where does that put us in terms of the numbers then?
Man 1: There's no way to tell yet, Jimmy's looking into the records to find out how many closed sites there are, but as for active clean up, somewhere around 3-4 thousand.
Female 1: Roughly.
Man 1: Oh here it is. Uh, Hold on. 402-K-07-002 and in terms of numbers most of these are past the PPE stage.
Female 1: And out of that 4000 or so we are expecting to close shop on the bulk by the end of the month.
Man 2: With a few exceptions: site 34, site 4, 107, and 37.
Man 3: Even with CDC involvement?
Man 2: The center usually goes in before we do, that's been my experience.
Man 1: By the time we have the site clean, they've moved on to more pressing needs. After all, we've had some extremely unpredictable seasons lately.
Female :1 Should we be integrating the NIOSH database?
Man 2: No need, their rep is available to us any time we need her.
Man 3: That gives us stats on all the active locations?
Man 1: On everything we still need to look into.
Man 3: What about security?
Man 2: Well we're working on it. For the moment we're simply hiding the data behind a false menu item.
Man 1: Security will be updated before the next system approaches
Male 3: And access?
Female 1: Enter the access code after our site.
Male 3: IP-slash-three-four-six-three or something?
Female 1: Yeah, slash-five-four-six-seven-K, actually. It should be operational any time.
Male 3: Great, I'll pass it on. I have to drop. Thanks, everyone.
Female 1: Thanks, bye.
Man 2: Okay, great. Bye Bill.
Man 1: Thanks.
The "3463" and "5467k" were very important: "3463 5467k" converted via phone pad into "FIND KIOSK." After going to Halo3.com and adding 5467k as an extension (http://www.halo3.com/5467k/), a map was revealed in which you select your state. Upon doing so and clicking the button, store locations began popping up. Beneath the store location was random text:
Upon visiting one of the store locations named and visiting an Xbox 360 kiosk, one would find this false menu item: During the Starry Night Commercial, this message was revealed: The video is located here.KltfvbljclecwuqlYnmerwvqhrplavyjantz
After a quick Wikipedia-ing of the Vigenère cipher, the quoted jibberish above was decrypted:
From what I (Avateur) have gathered from here is that ii otnemem ii cracked the code and Unr3alChi3f found the site that contained the 100 keys that would eventually unlock Server 2.ReporttwozerosixEverysixteenhoursano