202 999 3335/Investigation

From otp22 db
Jump to: navigation, search
Investigation This is an investigation subpage.

The information found here includes bleeding-edge updates, information dumps, and speculation.
The factual/summarized article for this page is: 202 999 3335
Be sure to separate different subjects here using a new section and subtopics using ===Subsections===.





<dmh> for clarification, I didn't touch the number
<dmh> I only queried it in NPAC so I think its coincidence or someone on [[IRC]] http://i.imgur.com/8pRse.jpg

Iridium Message - October 8th 2012


Hawaiian message

Briefly in the early hours of Friday 12th October UTC the message changed to this http://dialer.otp22.com/2012-10-12%2001-48%20UTC%20-%20202-999-3335%20-%200.wav referencing Hawaiian Iridium gateway. The message change back to Tempe shortly after. Hawaii is in the list of drops planned from the 15th October.


Authorization failure.
You have reached the Iridium satellite Tempe gateway, your access to the Iridium global network. Welcome! (3x)



New messages on 30th October 2012

It changed to "We're sorry, an application error has occured, goodbye". The 303 number made the same change at the same time. Approximately four hours later the message changed again to say 'two'. 303 number changed to 'three' at the same time and the polish number to 'concern'.

Beeps and noises - October 31st

FrankenPhone.jpg On 09:00 UTC October 31st, both 202 and 303 began to play the following message. It contains various sounds including a busy signal, a wooshing sound (and feedback), and towards the end one buzz of the Emergency Broadcast System surrounded by two other sets of tones.

  • Whistle (CQ):
   From: HQ To: CQ -- "please confirm"
  • SAME:
   bell code required

Please discuss in this section/in subsections -- Crash demons (talk) 09:57, October 31, 2012 (UTC)


This "whistle" appears around 0:08 and has been decoded. -- Crash demons (talk) 01:46, November 2, 2012 (UTC)

<Vargomax> got something out of the chirp but so far it looks like gibberish
<Vargomax> $ minimodem -M 2225 --startbits 1 --stopbits 2 -f 3_whistle_narrowband.wav 300 > output
<Vargomax> ### CARRIER 300 @ 2250.0 Hz ###
<Vargomax> ### NOCARRIER ndata=22 confidence=1.780 ampl=0.349 bps=304.50 (1.5% fast) ###
<Vargomax> then
<Vargomax> 00000000  55 55 55 55 55 94 ff aa  aa 96 aa 65 ff 7d 9c cf  |UUUUU......e.}..|
<Vargomax> 00000010  76 17 c6 27 cf 4a                                 |v..'.J|
<cshepherd> heh okay, that's what i got too

-- Crash demons (talk) 03:03, November 2, 2012 (UTC)

I managed to get a pretty good spectrogram on Sonic Visualizer (link) and manually decoded the following bits (there could be errors):


One thing I noticed is that there are two identical sequences in the beginning and the end (000000001).

To reproduce this, use the settings visible on the screenshot above.

-- Rahm (talk) 00:28, November 3, 2012 (UTC)

<Ymgve> ok, that AX25 message only contains "please confirm"
<Ymgve> the first "modem-like" sounds at the 202 and 303 numbers at around the 9 second mark is and AFSK-encoded AX25 message
<Ymgve> http://en.wikipedia.org/wiki/AX.25
<Ymgve> the address field also contains the strings "CQ" and "HQ"

-- Crash demons (talk) 01:11, November 3, 2012 (UTC)

AX25: http://en.wikipedia.org/wiki/AX.25 http://www.tapr.org/pdf/AX25.2.2.pdf

SAME Header

The emergency buzz (around 0:30) appears to be a SAME Header from the Emergency Alert System. Nobody has tried to decode it as of yet, but if the recording has enough quality, it should be of interest since it specifies an origin ID, FIPS location code, station callsign. However, it may just be a recording the PM copied. -- Crash demons (talk) 06:21, November 1, 2012 (UTC)

An example SAME transmission can be heard here -- Crash demons (talk) 06:22, November 1, 2012 (UTC)

User cshepherd was able to provide the following bytes with very interesting results, but it is not clear which bytes are associated with which SAME Fields:

[00:49] cshepherd small paste:
[00:49] cshepherd isolated SAME burst from frankenwav
[00:49] cshepherd High pass filter @ 1000Hz
[00:49] cshepherd Low pass filter @ 2100Hz
[00:49] cshepherd fed output through minimodem, got output:
[00:49] cshepherd minimodem -f afsk4.wav same > output4
[00:49] cshepherd ### CARRIER 521 @ 2083.3 Hz ###
[00:49] cshepherd ### NOCARRIER ndata=33 confidence=2.057 ampl=0.407 bps=518.79 (0.4% slow) ###
[00:49] cshepherd hex dump of output:
[00:49] cshepherd woops
[00:49] cshepherd didn't mean to privmsg lurker69
[00:49] cshepherd here's hexdump of output
[00:50] cshepherd hexdump -C output4
[00:50] cshepherd 00000000 62 65 6c 6c 20 b1 37 b2 0c 44 ae c5 d5 a5 c9 ca |bell .7..D......|
[00:50] cshepherd 00000010 c8 |.|
[00:50] cshepherd 00000011
[00:50] cshepherd it seems unlikely that the lowercase letters 'bell' would be there by some sort of chance
[00:45] cshepherd i managed to get some data out of the NOAA SAME burst using 'minimodem'
[00:51] cshepherd maybe i'll retry the afsk at 0:08 as well, with filters on both sides. minimodem seems to work better with that
<cshepherd> i read through minimodem src, it doesn't chop ZCZC
<cshepherd> that just isn't SAME-formatted data, it's just modulated the same way


<Vargomax> $ hexdump -C output
<Vargomax> 00000000  62 65 6c 6c 20 63 6f 64  65 20 72 65 71 75 69 72  |bell code requir|
<Vargomax> 00000010  65 64  |ed|
<Vargomax> bell code required
<Vargomax> bingo

-- Crash demons (talk) 03:07, November 2, 2012 (UTC)


The "beeps" after background B could be a bits (if decoded similarly to previous horns):

   01000110100100 or 10111001011011

Rahm (talk) 16:17, November 2, 2012 (UTC)

23:00, November 6, 2012 - Bell Code Entered, new message "Victory SFX"

See http://otp22.referata.com/wiki/48_22_307_1061/Investigation#Bell_agent_found New message plays which is a clear indication of success.

'Peaches' message 13:00 November 8, 2012

Overview of the call:

<two 450Hz tones>
your call is being forwarded, please do not hang up. <click>
your call is being forwarded, please do not hang up.
<three songs play>
<alternating alarm tones>
<100Hz? buzz>
<interrupting clicks>
<two tones>
your call is being forwarded, please do not hang up. <click>
your call is being forwarded, please do not hang up.
You've reached the Iridium Satellite Wahaiwa(sp?) Gateway. Your access to the Iridium global network. Welcome.
You've reached the Iridium Satellite Wahaiwa(sp?) Gateway. Your access to the Iridium global network. Welcome.
You've reached the Iridium Satellite Wahaiwa(sp?) Gateway. Your access to the Iridium global network. Welcome.

The clip was recorded only once. Then the message went back to "Victory SFX".

Link to the 'Peaches' message http://dialer.otp22.com/2012-11-08%2013-58%20UTC%20-%20202-999-3335%20-%200.wav



3 Songs: 1) "Take your shoes off" 2) "First love" 3)"F*** the pain away"

Cheeky Girls - Take Your Shoes Off (with lyrics) https://www.youtube.com/watch?v=N2q-zMX4h0w

Uffie - "First Love" http://www.youtube.com/watch?v=5PYzwdbbgF8

Peaches - F*** the Pain Away (Uncensored) - With Lyrics http://www.youtube.com/watch?v=TzFxPEMXYIY

Overlying data (deep sound)

Ymgve solved it, it was the same cipher as the horns (ITA2)


In full without abbreviations: Dialing..(C error?) Glad you are still alive Agent A.I. Bouerges. Activating system, but for a new emergency assignment. Be careful. You are being watched. End of message.

   Ymgve	encoded the same way as the horns
   Ymgve	very low coding rate, the bits are of length 28000 and 22000 samples
   Ymgve	also, might have fucked up a few places, no idea why there's CGLAD and AI
   Ymgve	http://pastebin.com/ZLxNcL1j
   Ymgve	and http://pastebin.com/QHbpCk9u is the referenced ita2.txt
   Ymgve	spectrogram I used: imgur

Iridium redirection


See also