Hello fellow nerds, today I have decided to write a little article about my journey in resolving the Red Triangle ARG. So here we are !
Once you open the link you are prompted with a Red triangle on top, some hex encoded text below, a nice music played and 3 images:
- Two of them have some weird looking symbols
- And the last one have some Roman numerals
Hex encoded Text
I started with decoding the hex and got the following:
A God may walk among mankind, but mankind may never walk among the Gods.The journey you seek can only be discovered by those who are capable of withholding such knowledge. Be wary of your surroundings, not everything you expect is to be expected.Only The Most Intelligent Advance Forward
Ok, just the basic story that you would expect for every ARG.
Moving forward, I have downloaded the images and the audio that plays in the background. But, I really was very curious about the 2 images with the strange symbols so I started to look closer to them. Taking a look at the metadata, with the hope that I could get something out of it but ,unfortunately, found nothing.
(I know, I could also look if it is some hidden data in the images, but I have thought that if no metadata is present maybe the creator doesn’t focused on those parts and more on the symbols)
After a few minutes, I have noticed that in the first image are 5 symbols and then ://. Hmm… this looks like a https URL, so I have assumed that the first symbol is a H , the > symbol is a T and so on.
Thus, resulting this part:
- - - - - - - - - - - - - - - - - > HTTPS
Now have a look at the other part:
This sequence have 2 dots, which I assume:
- The first 4 symbols translates to a subdomain
- The next 6 are the domain itself
- The next 3 are the top level domain.
I just assumed, that the top level domain is .com.
(I know it could be .org or others like that… but hey, that’s why it’s called an assumption)
Now we have another 3 symbols to work with:
- - - - - - - - - - - - - - - - - > .COM
If we look at the subdomain , you should see that we almost have all the symbols for it, we just don’t know the first one, but let’s just replace them.Resulting in : ?ocs.
Hmm… I need a subdomain that terminates in ocs… My first thought when thinking about this was docs so I assumed ,again, that it’s correct.
After replacing the others symbols that we know in the main domain we have: https://docs.?oo???.com
First thing that popped into my head when I was staring at this was docs.google.com, because google have a subdomain docs and also fits perfectly with what I have missing.
Let’s recap what we have until now:
- - - - - - - - - - - - > https://docs.google.com
I tried replacing all the other symbols that I know with what was left, but got nothing… Because I didn’t know a lot of the symbols.
At this point, I got stuck and started thinking that I was going on the wrong path. After hours of stretching my brain , I started browsing the internet for this alphabet and found this:
Translating the 2 images concatenated together we get this URL : https://docs.google.com/document/d/19SPOqsg1kFiy0s3KgnUo0zq6xqqfV0opDZ1GKd2vMbw/edit which has the red triangle symbol and underneath the next link to the puzzle: https://paxt4n6urwx7uiah.onion.link/
I was happy and sad at the same time, because I wanted to manage to do this one by myself without internet support , but I still got the symbols right tho .
I tried to see if it is something in the audio file as well, but found nothing.
This was a very amazing experience for me and hope you guys liked it.
Looking forward to continue this series if you support it and want more.
Thanks for your time and hope I see you in the next one.
I’m out !