# There's been a kidnapping!

Alfred C. Bacon, an avid puzzler, has been kidnapped! Fortunately, we were able to find where he was being held. Unfortunately, he was no longer there. Fortunately, he left us a note, letting us know that he was safe, (although not necessarily happy). Fortunately, he let us know that he had encoded his kidnapper's name in a hidden message. Unfortunately, our intrepid police force has hit a brick wall with how to solve his puzzle. They believe that it's tied to his internet history.

They have sent you, the denizens of https://puzzling.stackexchange.com, the entirety of his browsing history, and are relying on you to figure out who the kidnapper is so that they can once again begin the search for Freddy.

twitch.tv                       10/11/17 11:17 PM   50.112.196.159
microsoft.com                   10/10/17 6:30  PM   191.239.213.197
amazon.com                      10/10/17 10:45 AM   54.239.25.192
gizmodo.com                     10/9/17  9:42  AM   151.101.193.34
kickstarter.com                 10/9/17  5:41  AM   13.33.76.156
discord.gg                      10/8/17  6:19  PM   104.16.60.37
lastpass.com                    10/8/17  6:12  PM   88.221.62.48
instagram.com                   10/7/17  9:45  PM   34.195.2.28
open.spotify.com                10/7/17  12:30 PM   104.199.64.136
southwest.com                   10/6/17  9:45  PM   208.94.153.100
imgur.com                       10/6/17  8:16  AM   151.101.36.193
kotaku.com                      10/6/17  8:12  AM   151.101.129.34
monster.com                     10/6/17  8:07  AM   63.121.30.147
ebay.com                        10/6/17  8:03  AM   66.211.162.12
xkcd.com                        10/5/17  4:30  PM   151.101.0.67
msn.com                         10/4/17  11:11 AM   13.82.28.61
walmart.com                     10/4/17  9:17  AM   161.170.248.20
puzzling.stackexchange.com      10/4/17  7:30  AM   151.101.193.69
reddit.com                      10/2/17  8:31  PM   151.101.193.140
bankofamerica.com               10/2/17  4:15  PM   171.159.228.150
wikipedia.org                   10/2/17  12:35 PM   91.198.174.192
buzzfeed.com                    10/2/17  4:26  AM   13.33.76.217
gmail.com                       10/1/17  9:35  PM   216.58.209.110
aol.com                         10/1/17  6:49  PM   207.200.74.55


Who kidnapped Mr. Bacon?

HINT:

The police have approached you with a piece of new information! They found a piece of paper stuck to the bottom of the otherwise empty trash bin that looks like this:

HINT 2:

It looks like the police were able to successfully recover part of a file from the otherwise empty hard drive! Here's the portion of the file that they recovered:

_ic__t_rter.co_ _CC

You'll notice

_ot__u.co_

some of the sites

_icro_oft.co_ BFEF_C

have letters missing.

___.co_ C

That's because the police

pu__li_g._tac_exch__ge.co_ C

Are police, not the FBI. However, they're very sure that what they have is right, and are also sure that it's got SOMETHING to do with the code. They just don't have any idea what.

As an aside, is it possible to have a block quote with a spoiler? That would have made the answer much easier to type.

Hint 3:

IP Addresses have been added to the original list. They were divined by the police's voodoo magic, and definitely not from phroureo's spreadsheet where he saved them all. I sure hope there's not typos in the list again, because that would be embarrassing.

Fair warning: this puzzle is VERY enigmatic. Hints will come periodically as necessary, but eventually, it should be solvable. I hope. :P To be honest, I thought about adding even more layers, but in the end decided to save them for the next puzzle.

• By quickly scanning and clicking edit I can't find anything... I'm surprised. :P – Quintec Oct 20 '17 at 0:24
• The idea of a message hidden in a browsing history is sublime, well done! – Laska Oct 21 '17 at 8:24
• I just searched puzzling.stackexchange.com users and couldn't find a suitable one matching Alfred, Freddy, or Bacon – eedrah Oct 22 '17 at 1:05
• @Rubio: Yes, but who wants to be accused of tampering with evidence? – M Oehm Oct 23 '17 at 19:14
• @MOehm Ha! Ok, well played, you got me there :) – Rubio Oct 23 '17 at 19:16

The name of our victim (and the first hint => AABBB) suggests that this puzzle has something to do with the Bacon's cipher. The hard thing is to find groups of five letters which were used to encode the message.

The third hint adds IP addresses of the visited websites, which suggests that they were used to encode the message. The second hint (_icro_oft.co_ BFEF_C) tells us, we should transform the IP addresses from the decimal to hex representation:

3270C49F
BFEFD5C5
36EF19C0
9765C122
0D214C9C
68103C25
58DD3E30
22C3021C
68C74088
D05E9964
976524C1
97658122
3F791E93
42D3A20C
97650043
0D521C3D
A1AAF814
9765C145
9765C18C
AB9FE496
5BC6AEC0
0D214CD9
D83AD16E
CFC84A37

The second hint also implies, that we should ignore all digits in the hex representation which gives the following list:

CF
BFEFDC
EFC
C
DCC
C
DDE
CC
C
DE
C

FE
DAC

DCD
AAAF
C
CC
ABFE
BCAEC
DCD
DADE
CFCA

Let's join these letters in chronological order (bottom to top):

CFCADADEDCDBCAECABFECCCAAAFDCD DACFE CDECCCDDECDCCCEFCBFEFDCCF

The groups of letters are all divisible by 5, which means we are really close now. Using some trial and error we can map the six different letters to A and B usually used in the notation of Bacon's cipher (ABC => A, DEF => B):

ABAABABBBABAAABAAABBAAAAAABBAB BAABB ABBAAABBBABAAABBAABBBBAAB

Using the 26 letter variant of the cipher we can find out the name of the kidnapper:

JORDAN T MORTZ

• Well reasoned! Part two coming soonish. – phroureo Oct 30 '17 at 21:26

A very partial answer that would have have been a comment, if it weren't too long:

The numbers on the piece of paper in the hint picture are very likely

the first octets (the parts separated by dots) of the IP addresses of the sites.

They aren't all that well-defined, but here's what we get for all the sites:

 twitch.tv                   52 or 50
microsoft.com               23, 104, 191, or 104
amazon.com                  54
gizmodo.com                151
kickstarter.com             13
discord.gg                 104
lastpass.com                88
instagram.com               52
open.spotify.com           104
southwest.com              208
imgur.com                  151
kotaku.com                 151
monster.com                 63 or 208
ebay.com                    66
xkcd.com                   151
msn.com                     13
walmart.com                161
puzzling.stackexchange.com 151
reddit.com                 151
bankofamerica.com          171
wikipedia.org               91
buzzfeed.com                13
gmail.com                  216
aol.com                    207

A quick analysis of that sequence got me absolutely nowhere.

• (thinking face) – phroureo Oct 24 '17 at 20:12
• It's worth noting that the list appears to have the sites in alphabetical order – Tas Oct 24 '17 at 21:23
• I hope there is nothing based on IP addresses - at least 2/3 of the sites from the list return more then 2 IP addresses, at least 7 return IPs with different first octet (even from different IP address classes) and some return different addresses in different regions of the world. – kamenf Oct 26 '17 at 23:13
• Alright, it looks like my grand scheme failed. I'll provide a list of the IP's he used in a hint soon. – phroureo Oct 27 '17 at 20:29
• @phroureo Probably everyone willing to try to solve this is waiting this list to continue :) Else idea is good to obscure numbers with domains, unfortunately it works only if you can guaranty that IPs never change and mapping is one-to-one always. – kamenf Oct 29 '17 at 14:26