15
$\begingroup$

Alfred C. Bacon, an avid puzzler, has been kidnapped! Fortunately, we were able to find where he was being held. Unfortunately, he was no longer there. Fortunately, he left us a note, letting us know that he was safe, (although not necessarily happy). Fortunately, he let us know that he had encoded his kidnapper's name in a hidden message. Unfortunately, our intrepid police force has hit a brick wall with how to solve his puzzle. They believe that it's tied to his internet history.

They have sent you, the denizens of https://puzzling.stackexchange.com, the entirety of his browsing history, and are relying on you to figure out who the kidnapper is so that they can once again begin the search for Freddy. 

twitch.tv                       10/11/17 11:17 PM   50.112.196.159
microsoft.com                   10/10/17 6:30  PM   191.239.213.197
amazon.com                      10/10/17 10:45 AM   54.239.25.192
gizmodo.com                     10/9/17  9:42  AM   151.101.193.34
kickstarter.com                 10/9/17  5:41  AM   13.33.76.156
discord.gg                      10/8/17  6:19  PM   104.16.60.37
lastpass.com                    10/8/17  6:12  PM   88.221.62.48
instagram.com                   10/7/17  9:45  PM   34.195.2.28
open.spotify.com                10/7/17  12:30 PM   104.199.64.136
southwest.com                   10/6/17  9:45  PM   208.94.153.100
imgur.com                       10/6/17  8:16  AM   151.101.36.193
kotaku.com                      10/6/17  8:12  AM   151.101.129.34
monster.com                     10/6/17  8:07  AM   63.121.30.147
ebay.com                        10/6/17  8:03  AM   66.211.162.12
xkcd.com                        10/5/17  4:30  PM   151.101.0.67
msn.com                         10/4/17  11:11 AM   13.82.28.61
walmart.com                     10/4/17  9:17  AM   161.170.248.20
puzzling.stackexchange.com      10/4/17  7:30  AM   151.101.193.69
reddit.com                      10/2/17  8:31  PM   151.101.193.140
bankofamerica.com               10/2/17  4:15  PM   171.159.228.150
wikipedia.org                   10/2/17  12:35 PM   91.198.174.192
buzzfeed.com                    10/2/17  4:26  AM   13.33.76.217
gmail.com                       10/1/17  9:35  PM   216.58.209.110
aol.com                         10/1/17  6:49  PM   207.200.74.55

Who kidnapped Mr. Bacon?

HINT:

The police have approached you with a piece of new information! They found a piece of paper stuck to the bottom of the otherwise empty trash bin that looks like this:

![a piece of paper

HINT 2:

It looks like the police were able to successfully recover part of a file from the otherwise empty hard drive! Here's the portion of the file that they recovered:

_ic__t_rter.co_ _CC

You'll notice

_ot__u.co_

some of the sites

_icro_oft.co_ BFEF_C

have letters missing.

___.co_ C

That's because the police

pu__li_g._tac_exch__ge.co_ C

Are police, not the FBI. However, they're very sure that what they have is right, and are also sure that it's got SOMETHING to do with the code. They just don't have any idea what.

As an aside, is it possible to have a block quote with a spoiler? That would have made the answer much easier to type.

Hint 3:

IP Addresses have been added to the original list. They were divined by the police's voodoo magic, and definitely not from phroureo's spreadsheet where he saved them all. I sure hope there's not typos in the list again, because that would be embarrassing.

Fair warning: this puzzle is VERY enigmatic. Hints will come periodically as necessary, but eventually, it should be solvable. I hope. :P To be honest, I thought about adding even more layers, but in the end decided to save them for the next puzzle.

Improve this question
$\endgroup$
13
  • $\begingroup$ By quickly scanning and clicking edit I can't find anything... I'm surprised. :P $\endgroup$
    – Quintec
    Commented Oct 20, 2017 at 0:24
  • 1
    $\begingroup$ The idea of a message hidden in a browsing history is sublime, well done! $\endgroup$
    – Laska
    Commented Oct 21, 2017 at 8:24
  • $\begingroup$ I just searched puzzling.stackexchange.com users and couldn't find a suitable one matching Alfred, Freddy, or Bacon $\endgroup$
    – eedrah
    Commented Oct 22, 2017 at 1:05
  • 3
    $\begingroup$ @Rubio: Yes, but who wants to be accused of tampering with evidence? $\endgroup$
    – M Oehm
    Commented Oct 23, 2017 at 19:14
  • 1
    $\begingroup$ @MOehm Ha! Ok, well played, you got me there :) $\endgroup$
    – Rubio ♦
    Commented Oct 23, 2017 at 19:16

2 Answers 2

Reset to default
10
$\begingroup$

The name of our victim (and the first hint => AABBB) suggests that this puzzle has something to do with the Bacon's cipher. The hard thing is to find groups of five letters which were used to encode the message.

The third hint adds IP addresses of the visited websites, which suggests that they were used to encode the message. The second hint (_icro_oft.co_ BFEF_C) tells us, we should transform the IP addresses from the decimal to hex representation:

3270C49F
BFEFD5C5
36EF19C0
9765C122
0D214C9C
68103C25
58DD3E30
22C3021C
68C74088
D05E9964
976524C1
97658122
3F791E93
42D3A20C
97650043
0D521C3D
A1AAF814
9765C145
9765C18C
AB9FE496
5BC6AEC0
0D214CD9
D83AD16E
CFC84A37

The second hint also implies, that we should ignore all digits in the hex representation which gives the following list:

CF
BFEFDC
EFC
C
DCC
C
DDE
CC
C
DE
C

FE
DAC

DCD
AAAF
C
CC
ABFE
BCAEC
DCD
DADE
CFCA

Let's join these letters in chronological order (bottom to top):

CFCADADEDCDBCAECABFECCCAAAFDCD DACFE CDECCCDDECDCCCEFCBFEFDCCF

The groups of letters are all divisible by 5, which means we are really close now. Using some trial and error we can map the six different letters to A and B usually used in the notation of Bacon's cipher (ABC => A, DEF => B):

ABAABABBBABAAABAAABBAAAAAABBAB BAABB ABBAAABBBABAAABBAABBBBAAB

Using the 26 letter variant of the cipher we can find out the name of the kidnapper:

JORDAN T MORTZ

Improve this answer
$\endgroup$
1
  • $\begingroup$ Well reasoned! Part two coming soonish. $\endgroup$
    – phroureo
    Commented Oct 30, 2017 at 21:26
2
$\begingroup$

A very partial answer that would have have been a comment, if it weren't too long:

The numbers on the piece of paper in the hint picture are very likely

the first octets (the parts separated by dots) of the IP addresses of the sites.

They aren't all that well-defined, but here's what we get for all the sites:

 twitch.tv                   52 or 50
 microsoft.com               23, 104, 191, or 104
 amazon.com                  54
 gizmodo.com                151
 kickstarter.com             13
 discord.gg                 104
 lastpass.com                88
 instagram.com               52
 open.spotify.com           104
 southwest.com              208
 imgur.com                  151
 kotaku.com                 151
 monster.com                 63 or 208
 ebay.com                    66
 xkcd.com                   151
 msn.com                     13
 walmart.com                161
 puzzling.stackexchange.com 151
 reddit.com                 151
 bankofamerica.com          171
 wikipedia.org               91
 buzzfeed.com                13
 gmail.com                  216
 aol.com                    207

A quick analysis of that sequence got me absolutely nowhere.

Improve this answer
$\endgroup$
6
  • $\begingroup$ (thinking face) $\endgroup$
    – phroureo
    Commented Oct 24, 2017 at 20:12
  • $\begingroup$ It's worth noting that the list appears to have the sites in alphabetical order $\endgroup$
    – Tas
    Commented Oct 24, 2017 at 21:23
  • $\begingroup$ I hope there is nothing based on IP addresses - at least 2/3 of the sites from the list return more then 2 IP addresses, at least 7 return IPs with different first octet (even from different IP address classes) and some return different addresses in different regions of the world. $\endgroup$
    – kamenf
    Commented Oct 26, 2017 at 23:13
  • $\begingroup$ Alright, it looks like my grand scheme failed. I'll provide a list of the IP's he used in a hint soon. $\endgroup$
    – phroureo
    Commented Oct 27, 2017 at 20:29
  • 1
    $\begingroup$ @phroureo Probably everyone willing to try to solve this is waiting this list to continue :) Else idea is good to obscure numbers with domains, unfortunately it works only if you can guaranty that IPs never change and mapping is one-to-one always. $\endgroup$
    – kamenf
    Commented Oct 29, 2017 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.