Cicada 3301 — The Internet Mystery

Image for post
Image for post

There’s no shortage of mysterious puzzles on the Internet. Most of the time, codebreakers both amateur and professional are able to work out the meaning of the puzzle and trace it back to its origins. But for one puzzle, put out into the online world by a group or organization calling themselves Cicada 3301, the mystery has yet to come to a satisfying conclusion or maybe it never will.

The most elaborate and mysterious puzzle of the internet age. — The Washington Post

What is a Cicada ?

Cicadas are insects, best known for the songs sung by most, but not all. Once the cicada hatches from the egg it will begin to feed on the tree fluids. At this point, it looks like a termite or small white ant. Once the young cicada is ready, it crawls from the groove and falls to the ground where it will dig until it finds roots to feed on. It will typically start with smaller grass roots and work its way up to the roots of its host tree. The cicada will stay underground from 2 to 17 years depending on the species. Cicadas are active underground, tunneling and feeding, and not sleeping or hibernating as commonly thought.

After the long 2 to 17 years, cicadas emerge from the ground as nymphs. Nymphs climb the nearest available tree, and begin to shed their nymph exoskeleton. Free of their old skin, their wings will inflate with fluid and their adult skin will harden.

Now why did I give you the idea of Cicada and whats my motive behind it. So it’s kind of a rhetorical theory but its upto you , whether you want to accept it or not. Few pointers here

  1. Cicadas are insects, best known for the songs sung by most
  2. it will begin to feed on the tree fluids
  3. smaller grass roots and work its way up to the roots
  4. will stay underground from 2 to 17 years
  5. Cicadas are active underground, tunneling and feeding, and not sleeping or hibernating as commonly thought
  6. cicadas emerge from the ground as nymphs
  7. Cicadas come out in summer to mate(increase in population) and take control of trees

Now think for a minute about the above topics and maybe. I tell again maybe you will get a bit closer to the though process behind this.

What’s Cicada 3301?

It is no secret that Western intelligence agencies are actively trying to recruit agents via the Internet. In this case, the most important thing is to filter out a bunch of slag and find really worthy candidates. To do this, often conduct online competitions, offering candidates to solve some puzzle. The next competition started a division of the us Navy, which yesterday published an interesting puzzle on [only registered can see it. ]

The challenge, called Project Architeuthis like a puzzle, which offered a group of [Only registered can see it. ], also held competitions on the Internet for an unknown purpose.

The first round of selection of Cicada 3301 with crypto-puzzles began on January 5, 2012 and ended with the fact that several winners were selected, who were given individual tasks and forbidden to tell the public about them. The community was left in disbelief.

The second round of the competition began on January 4, 2013-also quite unexpectedly. A mysterious organization has published an announcement that again begins recruiting. Everything happened according to the same scenario and also ended with the selection of winners with the distribution of individual tasks. Again, the public has not received an answer, who is behind this activity.

The US Navy cryptographic contest is similar to Cicada 3301 because the puzzles are also very complex, but the award to the winner is not announced. It is logical to assume that the winners will be offered a job in the Navy. But this is just an assumption, because this is not officially declared.

The Cicada 3301 Timeline Part 1

Before diving into the details, let me clear what it’s on the very surface level. It’s a puzzle which is posted on the Internet with the intentions of recruiting “highly intelligent individuals”.

Solving which supposedly gets you recruited to the NSA, MI6, Hacker groups and the speculations go on and on; although no official prize has ever been announced.

The Puzzle is centred around Steganography, Cryptography and Data security. In laymen’s terms- computer stuff. But hey, the Cicada 3301 2017 isn’t limited just to the digital sphere, rather the clues to the solution are actually hidden in the real world! (We will explain in detail in the later sections).

It’s one of the creepiest mysteries existing on the Internet today; that’s so because no one knows who’s behind the puzzles, or what rewards solving the Cicada 3301 2017 puzzle actually bestows upon one.

It all started on January 4th, 2012. An elaborate puzzle appeared on message boards and forums which read:

This image when opened using a text editor gives out a Caesar cipher string of semi-readable text, which when deciphered leads to a Image URI

Someone surmised that the use of the words “out” and “guess” suggested that the duck image should be run through another text editor named OutGuess. Sure enough, running the image through OutGuess revealed yet another URL.

This image when passed through Outguess:


That link led to a subreddit containing Mayan numerals, a mishmash of letters, and two images that were labeled “WELCOME” and “PROBLEMS.”

Each one contained an OutGuess message. Welcome’s was this:

and Problems’ was this:

Both of them were signed with PGP signatures, which are basically a completely secure method of ensuring that the message has come from the confirmed sender.

But in the subreddit In the header here, there was the following string given:

Later was found that key was derived from King Arthur text. Translate each digit to a letter (from alphabet starting with A = 0) and you get kcohtgsmhirathosotnabca. Each letter is first letter in lines of decrypted text.

This was the ‘key’ that Problems mentioned, being the code to the shift cipher to be applied to the lines of text in the subreddit. If this is confusing, it basically means that each letter in each string was meant to be shifted by the number corresponding to it’s location in the text. This produced the following story.

The Number

These all led to a phone number. Which in the Cicada community is now termed as The Number. The code in the original message, as mentioned to be a book code, was applied here. If you’re not familiar with book codes, the first number is the line, and the second number is the character in that line. Applying the book code to the text with the full stops removed gave the following string of text:

This was obviously a telephone number, specifically 2143909608 . This number has since deactivated. Calling this number initially gave the following message:

The original image had the dimensions of 509 and 503, both of which are prime numbers. These when multiplied with 3301 is equalto 845145127, which gave us http://845145127.com . Note that 845145127 is also in brackets in the GPG key’s name.

The Website

Going to this website led to an image of a cicada and a countdown. Using OutGuess on the image produced the following message:

And so the solvers waited. And waited. And waited. And finally, after what seemed like years, the website changed. Reapplying OutGuess on the cicada image produced a new message, containing co-ordinates, as well as two which were written on the website itself:

These returned locations across the globe, meaning that unless you had access to all these locations, you’d be forced to collaborate with other users, like the main IRC channel on n0v4. At each of these locations, brave solvers found a sheet of paper stuck to a telegraph pole, with a QR code and an image of a cicada.

It took a while for this to sink in with the community, that this wasn’t just a talented neckbeard in a basement, that this was actually a global organisation of some very very talented people.


Upon scanning these QR codes 2 different messages were revealed. These are:


Which the solvers knew to be book codes along with a description of each book. They also included a warning about too much collaboration, saying that only the first few, or the active few, that make it to the end will receive entry.

The second code was found to have led to the poem Agrippa by typing in keywords from the description. This poem, found here, spat out the following after the book code was applied:

Which most will know to be a hidden service on the Tor network. By entering this page into a tor-equipped browser, users found the following message:

Finally the website closed with a line saying “We want the best, not the followers”. Soon there was a month of silence and then this Image was posted on the subreddit on Cicada.

According the Cicada they have found the people they were looking for. But the community out there was not satisfied because of the lack of ending to what was this all about. And many termed it as a wild goose chase and waste of time. But did we know, this was just the beginning?


A theory of a user on subreddit claims he might have a clue. Read Below

“In twenty-nine volumes, knowledge was once contained. How many lines of the code remained when the Mabinogian paused? Go that fair in from the beginning and find my last name.” So I went and I searched for a Mabinogian.pdf, downloaded it, and did a highlight search for pause. At about line 255 with around 1242 lines left, might be different in translation, there was the word pause. So when you subtract 255 from 1242 you get 987. From here I went to the first sentence 29 volume book which stored knowledge. This is an encyclopedia. I then went to my bookshelf and opened up the A volume. What then happens took me a good 10–15 minutes to do, and that was count every individual line from A. At line 987 the word is Arthur. Meaning the writers name in Arthur. This is interesting for a few reasons. 1. Arthur mentions King Arthur a few times a few clues back. 2. In context of the Mabinogion the king is the one who pauses. 3. This means the person that wrote has a god complex.

The guys name is Arthur unless you can prove otherwise.

Tune in to know what happened next in Part 2 of Cicada 3301.

Written by

I am a professional Backend and DevOps Developer I mainly work on NodeJS and Python based Backend. On Cloud I have my forte on AWS and Azure.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store