VYACHESLAVKONCHITS

Case File · ARG · Bullet Echo · 2023–2024

Sterling’s Quest: Turning Bullet Echo Players Into Investigators

How a hero reveal became a multi-week community investigation — and a 170+ page player-written case file.

In late 2023, I designed and ran a live ARG for Bullet Echo that started with a strange holiday short, a QR code, and a warning: don’t trust Sterling. What followed was a multi-week community investigation across a hidden website, Discord, social posts, in-game hints, encoded messages, music, and promo codes — all leading toward Project Amaryllis and the reveal of Vi, a new hero.

Live ARGCommunity storytellingTransmedia campaignPuzzle designLore revealBullet Echo2023–2024

What I did

  • Designed the ARG structure, pacing, and story beats
  • Planned the clues, ciphers, and hidden messages
  • Created the names and lore hooks — several later became actual in-game names
  • Built and evolved the hidden website over the campaign
  • Made the art, music, and video for the campaign myself
  • Connected puzzles to real upcoming game content
  • Turned the hero reveal into an investigation instead of an announcement

01 The setup: “Don’t trust Sterling”

Dec 26, 2023 A holiday short appears on YouTube and Instagram

The ARG began with what looked like an ordinary holiday video: a sequence of community fan art, festive music, warm wishes. But players who paused it found more. Mister Sterling — the mysterious owner of the game’s Arenas — flashed on screen with the words “help me”. Behind him, a binary string: 01010110 00111111. Decoded, it read V? — a question nobody could answer yet. Then a QR code, and a repeating domain: mrsterling.quest.

Even the hashtags were part of the message: #donottruststerling, #sterlingshouldntbetrusted, #whoisthis.

Clue QR code hidden in the launch video
The QR code from the launch short. Scanning it led to mrsterling.quest — the front door of the whole investigation.

Why this worked

The first clue looked like a normal social post — but it rewarded players who paused, zoomed, decoded, and scanned. That first interaction taught players the language of the ARG: nothing is accidental, screenshots matter, and you’ll get further together.

02 The hidden website

The QR code led to mrsterling.quest — a dedicated mystery site that behaved less like a landing page and more like a living crime scene. Pages appeared, changed, and got “hacked” over time: a Confidential Transmission from Sterling, corrupted CCTV images, a saccharine Life Inc. “Happiness Message”, cybersecurity takedown notices, hidden pages that only existed if you guessed their address. Some clues sat in plain sight; others hid in page source, file names, or audio files.

Evidence The original front page of mrsterling.quest: a single Enter button on black
Day one, the entire front page: one button, no explanation — under a page title made of symbols, ?@!#*.%^#$. Preserved in the original site source.

Explore it yourself

The original site has been restored and is live again on this domain — every page, hidden ones included, with an archive map to guide you. Restored pages may not function perfectly, but the clues are all still there.

Players responded by doing something I hoped for but couldn’t force: they started mapping the site themselves, treating every redirect, filename, and broken page as potential evidence.

Evidence Early community-made site map showing mrsterling.quest linking to ctao and cctv pages
An early community-made site map: the entry page, Sterling's confidential transmission (ctao), and the CCTV gallery.
Evidence Later community-made site map with numbers, censored, cache and neverfadeaway branches
Weeks later the same map had grown branches: censored pages, a password-protected cache, the numbers dashboard, and the hidden neverfadeaway page.
The site was never static. Text mutated, links appeared after reloads, pages got defaced — and returning players were the first to notice. The website itself was a character.

03 Sterling’s message

The first major story beat was a Confidential Transmission addressed to “all Echo Operatives” — the players themselves. Sterling claimed he had intercepted information from Life Inc., a corporation nobody had heard of before, and received four corrupted CCTV images he’d reconstructed with an AI tool. He asked Operatives to decode two phrases he’d caught on a radio frequency.

ctao.html — CONFIDENTIAL TRANSMISSION
CONFIDENTIAL MESSAGE TO ALL ECHO OPERATIVES

Operatives,
This is Sterling. I've managed to intercept some intriguing
information from Life Inc. through our secure communication
channels. [...] I also received four images from CCTV, but
they were all corrupted.

Additionally, I've tapped into a radio frequency and caught
two phrases:
  "My .--. .- - .. . -. -.-. . is .-- .- -. .. -. --."
  "Is this . -. - . .-. - .- .. -. .. -. --. ?"

Hopefully, I will get back on December 30th.
Sterling out.
Decoded

The Morse code resolved to “My patience is waning” and “Is this entertaining?” — a lyric from Imagine Dragons’ Bones. Players immediately started arguing about whose patience, and who was being entertained. That ambiguity was the point: was Sterling warning them, manipulating them, or being watched himself?

The framing did the heavy lifting. Players weren’t reading an announcement — they had been given a role, a codename, and a job.

04 CCTV images and the first investigation loop

The CCTV page held four “reconstructed” surveillance images — outside, backyard, house, underground — showing armed squads reacting to strange streaks cutting through the air. Players ran them through text editors, contrast tools, and metadata viewers. Some findings were real; plenty weren’t. Deciding what was signal and what was noise became part of the game.

CCTV image: outside
outside.png
CCTV image: backyard
backyard.png
CCTV image: house
house.png
CCTV image: underground
underground.png

The four “corrupted” CCTV frames. Players hunted the static for hidden digits — the log dryly records most of them as artifacts, not answers.

Behind the images, the page generated an endless stream of questions: Can anyone see the truth? Is trust ever justified? Who really controls Sterling? What lies in the shadows? The bolded words, read in order, formed their own sentence:

Clue Scattered questions with individual words highlighted in different colors
The question cloud as an asset from the site source — each question drifting on the page with one word quietly emphasized.
Decoded

“Anyone trust in Sterling conceal the hidden truths.” — the page itself was contradicting its owner.

Clue The donotlook.png image — a face made of vertical scan lines staring at the viewer
A hidden link labeled donotlook led to this. If an Operative looks at an image that doesn't want to be looked at — it looks back.
False lead

Noise as a feature

Players adjusted brightness, inspected the file’s code, and tried to read it as a barcode. Nothing. Some clues existed to keep everyone honest — the community had to decide what mattered, and dead ends made the real discoveries feel earned.

05 Life Inc. takes over

Dec 30 – Jan 3 The tone of the site changes — corporate, multilingual, and wrong

Then Sterling went quiet, and the site stopped sounding like him. His transmission page began redirecting to a Life Inc. Happiness Message: a blurred, hand-drawn TV test pattern with a corporate logo, cycling cheerful phrases in Polish, Indonesian, Chinese, Hindi, Russian and Ukrainian — “Customer satisfaction is our priority. Live. Love. Laugh.” — next to lines like “Trust to this website has been revoked by the Life Inc. network. Please wait.”

Clue Hand-drawn TV test pattern with the Life Inc. logo in the center
The source file of the Life Inc. test pattern — the live page showed it blurred. Hidden in its circles: the numbers 158.87.212, and a doubled digit 6 — VI — in the center. Nobody knew what either meant yet.
Evidence The Life Inc. Cybersecurity Message page with a blurred logo and scattered poem lines
The actual Cybersecurity Message page: 'Web-elements were removed by Life Inc. Cybersecurity', a blurred logo — and lines of a poem about three kings of color drifting around it.

The corporate language of safety and happiness made the pages feel more threatening, not less. And the story gained its central tension: Sterling said his site was hacked, Life Inc. claimed everything was fine, and a third party — someone leaving kaomoji, purple paint, and taunts in the page source — was clearly playing with both of them.

The Life Inc. logo — a hand holding a heart
Life Inc.: a hand, a heart, and absolutely nothing to worry about.

Life Inc.’s security also earned its reputation the hard way. A “cached version — Life Inc. Cybersecurity access only” page demanded a password. The password was, literally, A PASSWORD TO THE LIFE INC CACHED PAGE — and the page source explained why:

Clue Life Inc. Security password prompt
The cache page's password prompt. The hacker had just called their security 'laughable' — the joke checked out.
cache.html — view-source
<!-- Gordon, before you take the train to work,
     change the darn security measure and cipher it!!
     Do not just leave the password as
     A PASSWORD TO THE LIFE INC CACHED PAGE,
     or you-know-who will come again!! -->

06 Never Fade Away, Violet Whisper, and the color trail

On New Year’s Eve, the mysterious third voice dropped a hint: “There is a secret place where things never fade away. Find it.” Overnight, the phrase in the page text quietly changed from “never fade away” to neverfadeaway — one word. Players knew every page on the site followed the same URL pattern, typed it in, and found the hidden NFA page: a Life Inc. corporate seal (“Implants · Drones · Cybergate · Neuroware · Biotechnologies · Nanomites”) with an audio file in the middle.

Clue The Life Inc. corporate seal — a metallic disc engraved with division names
wecare.jpeg: the Life Inc. seal on the hidden page. Its outer ring teased a blurred US state and a founding year — details players would argue about for weeks.
Decoded Spectrogram of neverfadeaway.wav revealing the word VIOLETWHISPER
The actual audio from the hidden page — six seconds of what sounds like random noise. Run it through a spectrogram and it spells VIOLETWHISPER. This render was regenerated for this page from the original neverfadeaway.wav.
Decoded Color picker showing RGB 158, 87, 212 — a violet purple
A poem about 'three kings of color' pointed at RGB. The numbers from the test pattern — 158.87.212 — resolved to this exact violet: the color of the Renegades faction.

This was the campaign’s spine: a color as a narrative thread. Purple connected the test pattern numbers, the spectrogram, the vandal’s paint, the Renegades faction — and eventually Vi herself. The purple trail wasn’t aesthetic. It was the answer, hiding in plain sight for a month.

Both discovered phrases also turned out to be promo codes. neverfadeaway and violetwhisper rewarded in-game currency — small amounts, but with oddly specific numbers. Players noted them down. That bookkeeping instinct paid off later.

Clue HTML source comment reading: Nothing here, truth seeker. Though, wanna listen to some tunes?
For players who read page source, the ARG read them back. This comment later became the breadcrumb to the music layer.

The archive also holds two prototype pages that never appear in the community log — one with an amaryllis haiku that surfaced Base64 fragments depending on the background color, another shouting “Numbers, VI! What do they mean?” in five languages along invisible SVG paths. The violet trail was designed to go deeper still.

07 Music as a clue: Bionic Nomads

Jan 4 – 18 A hacked page starts asking about music — and a band that doesn't exist yet releases a single

By January the hidden page was being openly vandalized — Life Inc.’s seal painted over in purple, corporate values crossed out, and a new note in the corner: “P.S. Do you like music?” followed by SGZaelA5TTN6b2M=. The English-speaking side of the community cracked it: Base64 for a YouTube video ID. It led to a 40-second fragment of a song.

Evidence Six states of the hidden page from January 3 to January 18, progressively vandalized
Sixteen days of vandalism, recovered from the site's own version history. Jan 3: first paint on the seal. Jan 4: the hacker's full opinion of Life Inc. Jan 8: 'P.S. Do you like music?' Then, day by day, the paint parts to reveal a figure at a wall of monitors — with words hidden in the color channels along the way: find, decrypt, poursuivre, eliminar.

Then the source revealed itself: Bionic Nomads, a fictional band with a YouTube channel and the bio “making music circa 2047”. Their full track, Shadowed Echoes, dropped mid-January — and it wasn’t decoration. The lyrics were a manifest and a puzzle index at once: violet whisper, flowing mayhem, never fade away, amaryllis glows under violet vines, shadow step quickens, your life is incorporated. Nearly every phrase was either a promo code, a future ability name, or a story beat that hadn’t happened yet.

Community theory Shadowed Echoes cover art: a woman with a long braid in purple neon, built into the word ECHOES
The Shadowed Echoes cover: a woman with a long braid, purple neon. The community clocked it instantly — too many purple women to be a coincidence.
Evidence Frame from the Shadowed Echoes lyric video
The lyric video staged every line with color and repetition — players catalogued each variation, convinced the typography itself was a cipher.
The fictional music layer made the ARG feel bigger than a website. It gave players another artifact to decode — and another way to feel the world of Bullet Echo.

08 Project Amaryllis and the numbers page

Jan 19 The Bionic Nomads video description changes: leave ur feedback at mrsterling.quest/numbers.html

The numbers page reframed the whole campaign as a live operation. Titled Infiltration: Progress Dashboard, headed Project Amaryllis, it listed mission code names with progress bars — poetic covers for the promo codes players had been redeeming all along. The bars crept up over the following days. Players watched them like a stock ticker.

Evidence The Project Amaryllis progress dashboard with mission progress bars
The numbers page itself, archived in its final state — every mission complete, including the once-secret Surveillance Disabling at 10000/10000. Mid-campaign, players watched these bars crawl up day by day.
Decoded

The community matched every code name to a promo code: Vector Whisperer → violetwhisper, Network Frame Anomaly → neverfadeaway, Firmware Mage → flowingmayhem, Binomial Nomenclature → bionicnomads, Aegis Buffer → amaryllisblade, Unseen Binary → undyingblaze — the last two found through datamining and brute-forcing song lyrics. Redeeming codes wasn’t just a reward anymore. It was, in-fiction, helping someone break into something.

Evidence A dark figure at a wall of monitors, the word STERLING scrawled in red
Over weeks, the vandalized page slowly rendered a scene: a lone figure at a wall of monitors. The community watched it complete, frame by frame, update by update.

09 The reveal: Vi

Jan 30, 2024 The game updates. The trailer speaks directly to the investigators.

By the time Vi was officially revealed, players had already touched almost every part of her identity without knowing it: the binary V? from the first video, the VI in the test pattern, the violet color, the shadow language in the lyrics, the datamined description of a woman with an assault rifle and a shadow dash. Vi — a hacker, a Renegade, the woman with the katana — was the third voice the whole time. The one who defaced Life Inc.’s pages, loved music, and recruited the Operatives without ever asking permission.

Confirmed later Bullet Echo 'Heroes and Villains' season art with Vi holding a katana
Vi's season art. Purple hair, katana, corporate suit — every visual promise of the previous month, kept.

The reveal trailer, set to Shadowed Echoes, showed Vi raiding a corporate tower — and then it did something I’m still proud of: on the monitors, she read out the promo code reward numbers players had been collecting for weeks. “One hundred… forty… fifty-three… fifteen… and fifty. The sum is the key.” A Base64 string flashed: U1RFUkxJTkdEQVRBSTERLINGDATA — one final promo code, live before the trailer even ended.

Confirmed later Trailer frame: a hand pulling a Life Inc. data card from a server tray
The stolen Life Inc. data card from the reveal trailer. In her closing line, Vi thanks the Operatives: 'They helped a lot with these numbers.'
Decoded In-game promo code redemption screen
Decoding the trailer's Base64 on the spot, players redeemed STERLINGDATA while the update was still rolling out.

Names that shipped

This is the part I’d put on a slide: names created inside the ARG became actual game content. Amaryllis Blade, Violet Whisper, and Shadow Step shipped as Vi’s real ability and concept names. Bionic Nomads went from a fake YouTube channel to the credited artist on an official trailer. Project Amaryllis threaded from a hidden dashboard into the update’s content. The ARG didn’t just tease the game — it helped shape the language the game shipped with.

10 The community did the real work

None of this works if players consume it passively. They didn’t. A core team formed around a shared investigation document and ran it like a case file: every date logged, every page diff recorded, every theory argued. They translated messages across a dozen languages, decoded Morse, binary, Base64, Caesar shifts, RGB values, and spectrograms, watched videos frame by frame, compared color channels of defaced images, built nine successive site maps, and cross-referenced new clues against years of Bullet Echo lore.

170+pages in the shared investigation log
9site map revisions drawn by players
7+cipher types decoded: Morse, binary, Base64, RGB, Caesar, spectrogram, bold-word acrostics
12+languages players translated and cross-checked
Evidence Official Discord post inviting players to mrsterling.quest
When the official channels finally acknowledged the quest — greeting players in eight languages — the investigation team had already been inside for ten days.
Community theory ASCII art of a silhouette at a wall of monitors
The ASCII art attached to the announcement. Players later realized the paint blobs appearing on the hacked page were redrawing this exact silhouette by hand.
The real result was not the solution. It was the investigation culture players built around it — the log itself opens by crediting every participant, “even those who never made it to the finale”.

11 Why it worked

Players got a role, not a feed

They weren’t an audience — they were Echo Operatives, addressed directly, given jobs, and eventually thanked by name in an official trailer.

Clues had a difficulty curve

A QR code hooks anyone. A spectrogram, a Base64 string in vandalism, or a bolded-word acrostic across eight languages rewards the specialists — and forces collaboration between the two groups.

The website changed over time

Pages evolved, got hacked, and healed. Returning daily was rewarded, and “what changed tonight?” became a community ritual.

Ambiguity was load-bearing

Can Sterling be trusted? Is Life Inc. lying? Is the hacker helping us or using us? The story never answered early, so the theories never stopped.

Rewards confirmed progress

Promo codes weren’t just prizes. A working code was proof you were on the right path — the ARG’s way of saying “warmer”.

It connected to real content

The trail led to an actual hero, actual ability names, and an actual update. Players’ work mattered in the shipped game, not just in the fiction.

Room to overthink

False leads, artifacts mistaken for codes, dead-end theories — all part of the fun. An ARG where every detail pays off feels like homework; one where players argue about noise feels alive.

12 Production notes — and what misfired

The credits are short. Concept, story, puzzles, art, music, video, and the hidden website — mine, hands-on. The in-game side — content and promo codes in the update — was implemented by a game designer working from the ARG’s material, and I signed the campaign off myself. The one hard constraint was the calendar: the update’s release date was fixed, so every page change, clue, and story beat had to resolve before Vi shipped on January 30.

Honest footnote

The difficulty curve needed live tuning

Not everything landed as designed. A few puzzles overshot — the investigation stalled on them, and I had to drop quiet hints to get it moving again. And the opening ramp was flatter than intended: two easy riddles in a row early on, so the “tutorial” stretch taught experienced players nothing. Both are the same lesson: a live ARG’s difficulty curve isn’t something you set once — it’s something you steer.

13 Outcome

The biggest win was that players did not consume the campaign — they documented it, argued with it, translated it, broke it apart, and rebuilt it together.

14 Final reflection

Sterling’s Quest is the clearest expression of how I approach community work: give players something worth investigating, respect hardcore fans’ ability to dig deeper than you expect, build mysteries that work across platforms, and let the community’s collaboration become part of the content itself. Marketing, lore, live ops, and game design — one experience, not four departments.

The whole ARG was openly inspired by music, movies, and games — Cyberpunk 2077 (Never Fade Away is a Samurai song, and the violet neon followed), Valve’s own Portal ARG, RoboCop’s brand of corporate dystopia behind Life Inc., and plenty more. Spotting the references became a meta-game of its own.

Sterling’s Quest worked because it treated the community as smart, curious, and capable. The ARG did not explain everything upfront. It gave players fragments — and trusted them to build the case.