investigation · updated 2026-05-15

PROJECT_SKYSCRAPER

A breakdown of project-skyscraper.com: a year-long ARG running quietly on WordPress, surfaced to a wider audience on May 14 by an admin-removed Reddit post in r/NoMansSkyTheGame.

background

On May 14 the account u/Project_Skyscraper posted a glitched image to r/NoMansSkyTheGame titled "Connection detected : Access denied". Reddit's admins removed the post within minutes. The user profile now returns 404, but the image stays reachable at its Reddit CDN URL. Searching the username surfaces a small WordPress site at project-skyscraper.com.

The site is an in-progress alternate reality game scoped to run for a full year, themed around No Man's Sky lore (Atlas, the Architect, simulation iterations). Production is real: hand-crafted artwork, deliberate typographic choices, accurate Windows event IDs, and a second WordPress site already reserved by the same author. The whole thing is being written by one person, in French, over UTC+1.

This page documents what is currently known. Dead ends are included so future investigators can skip work that has already been ruled out.

current state

Six numbers that frame the situation.

0 / 365
memory blocs restored
26
posts on the main site
4
deliberate anomalies planted
1
reserved second site (unlaunched)
FR
author writes in french
UTC+1
site timezone, no DST

key findings

timeline

Every public event on the site, in order. Yellow markers are deliberate anomalies. Purple is the currently-active puzzle. Teal is a story reveal.

1970-01-01 · post id 117
ORIGIN — "HELLO, WORLD"
/origin/ memory bloc 0: no/value · Sky is not the limit
A Unix-epoch joke for a first post. Bloc zero. The system has no data yet.
2026-03-24 → 2026-04-30 · 16 posts
SLEEP MODE — system dormant
Sixteen identical posts spaced 2–3 days apart, each reading SLEEP MODE / status=nominal █. The site is asleep for five weeks before anything happens.
2026-04-01 · post id 136
Sleep-mode post with a malformed slug
/2026/04/01/sleep-mode-4613/
Every other sleep-mode post uses a 5-digit number — 46105, 46108, 46110, 46115, etc. This one is 4613. The expected value was 46113; the author dropped one digit on purpose. extracted digit: 1
2026-05-03 08:04:13 · post id 259
SECURITY LOG — the system wakes up
/2026/05/03/sec-log-080413/
First real post after five weeks of dormancy. A companion full-log page documents Windows Event 5157: a Wake-on-LAN magic packet from 192.168.1.100 hit 192.168.1.255:9 and was blocked by the firewall. Something just tried to wake the system, and the system pushed back.
2026-05-05 19:07:46 · post id 263
SECURITY LOG — another block
/2026/05/05/sec-log-190746/ · Connection detected / Access denied. Background noise.
2026-05-08 06:11:19 · post id 267
SECURITY LOG — first text-level typo
/2026/05/08/sec-log-061119/
Body reads Connect1on detected instead of "Connection detected." The letter i is the digit 1. extracted digit: 1
2026-05-10 17:14:52 · post id 269
SECURITY LOG — standard
/2026/05/10/sec-log-171452/ · standard format, no surprises.
2026-05-10 17:14:53 · post id 1626
Twin post one second later, with a format break
/2026/05/10/security-log-171453/
One second after the previous post, a second post drops. This time the slug uses security-log- instead of sec-log- — the only post on the site with that prefix. The body changes to TRACE on hold · Update: Full log. Post ID jumps to 1626 — a 1,300-leap from the sequential 273. WordPress.com uses global user-wide post IDs, which means the author was active on another of their sites between these two posts. format break · trace begins
2026-05-11 · the trace artifact
TR4CE.jpg uploaded
/tr4ce/
An image that looks like a corrupted transmission gets uploaded. The body of the page declares the puzzle's scope for the first time: Memory_bloc_restoration: 0/365 Completed. Photoshop EXIF on the file confirms a human author at the desk. The image's hidden text is dissected below.
2026-05-12 · the bypass event
An autonomous system process BYPASSES the firewall
/sec-log-094127-full/ + /2026/05/12/sec-log-120000/
The full log details a Windows Event 6276: a process called atlas-65.system independently reviewed the previously-blocked transmission and authorized it. The log notes a 91.7% probability of "Skyscraper bleed" and explicitly flags the decision as anomalous. The barrier just dropped. Bonus pun: atlas-65 decodes to atlas-A — ASCII 65 = "A".
2026-05-12 · review timestamp anomaly
A missing digit in the review date
Inside the full log, the review timestamp reads [12/5/206 12:00:00 PM]. The year should be 2026. One digit short. extracted digit: 2
2026-05-13 04:18:25 · post id 271
SECURITY LOG — filler
/2026/05/13/sec-log-041825/ · placeholder while the next big drop incubates.
2026-05-14 17:28:32 · post id 1669 · 3 hidden revisions
SECURITY LOG — THE ACTIVE PUZZLE
/2026/05/14/sec-log-172832/
System: r/
User: u/Project_Skyscraper
Shadow_integrity: unknown
Action required: Determine_security_status
Echo: « They can see the tower… but not the one inside. »
Report ID: shadowcheck-1912
The post points outward to a Reddit account. The Reddit JSON for that thread reports "removed_by_category": "reddit": admin removal, not a moderator action, not a suspension. The account exists but is invisible to the public. That is the "shadow integrity" the puzzle is asking to be verified. active unresolved: shadowcheck-1912
2026-05-15 15:21:58 · post id 273
SECURITY LOG — holding pattern
/2026/05/15/sec-log-152158/ · filler post. The story doesn't advance. Whatever comes next is being staged.

hidden content in TR4CE.jpg

The May 11 image is the most concentrated clue in the archive.

TR4CE.JPG · four phrases recovered

The file looks like a static-noise glitch. Isolating the red channel and pushing the contrast exposes four text bands behind the noise. Each phrase appears twice horizontally: the left rendering is destroyed by overlay glitch, the right rendering survives. Designed to be findable, but only after effort.

Connection detected
site-wide mantra
Access denied
site-wide mantra
Vision
the architect's "brilliant idea"
Architect
the wp author's display name
Why these two words matter. "Architect" is the WordPress display name of the user running the site (slug theskyscraperarchitect). "Vision" matches the French placeholder text on their reserved second site ("Une idée brillante, bientôt disponible": "A brilliant idea, coming soon"). TR4CE.jpg is the author identifying themselves inside their own ARG.

planted typographic anomalies

Four deliberate breaks in the otherwise-uniform format. Each one yields a single character.

April 1 — slug

4613

Should be 46113. One digit short. Extracted: 1

May 8 — body text

Connect1on

Letter "i" replaced with digit "1." Extracted: 1

May 10 — slug prefix

security-log-

Every other slug is sec-log-. Format break, no digit. Marker only.

May 12 — body text

12/5/206

Should be 12/5/2026. One digit short. Extracted: 2

Read in order, the extracted digits spell 1, 1, 2. That is 112, the European emergency number and France's line for police/fire/ambulance. A thematic stamp from a French author signalling the system is in distress, planted across multiple posts so the pattern only emerges after reading the whole archive.

the author

Inferred from the WordPress REST API, EXIF on uploaded images, and linguistic tells in the writing.

WordPress identity

display name
The Architect
slug
theskyscraperarchitect
user id
279180095
gravatar
empty (default identicon)
primary site
project-skyscraper.com
secondary site
…-ywvhk.wordpress.com · unlaunched · 1 subscriber

Regional fingerprint

language
French. Default category named Non classé; non-breaking space before punctuation; French "coming soon" page on the secondary site
timezone
UTC+1 year-round, no daylight savings. Points to Morocco, Algeria, Tunisia, or a French speaker with manually-disabled DST.
tools
Adobe Photoshop (confirmed via APP13 IPTC blocks in image headers)
prep time
Master image exported 2026-03-03; site went live April 25. Seven weeks of preparation.

Authorship · human-led, high confidence

Several details rule out AI authorship. The Windows event IDs (5157 for the May 3 firewall block, 6276 for the May 12 review) are real and used correctly: AI tends to hallucinate plausible-but-wrong IDs. The atlas-65 = atlas-A ASCII pun is the kind of joke a sysadmin plants intentionally. French typographic conventions are locked-in muscle memory, not language-model mimicry. And the 365-day commitment with a consistent in-character voice across weeks of posts is a planning load that AI does not carry. Best fit: a single French or Maghrebi developer with a security or sysadmin background, probably also an NMS player. AI assistance for filler posts is plausible; the puzzle beats are planned by hand.

unsolved

Open leads, ranked by likely productivity.

1 · second site launch

incoming

The unlaunched theskyscraperarchitect-ywvhk.wordpress.com is the most likely staging area for the next phase. A page-change monitor (e.g. Visualping) on the URL is the cheapest watch.

2 · the +1,300 post-id jump

1353

Sequential post IDs run 259–273, then leap to 1626 / 1640 / 1669 for the May 10b, May 12, and May 14 anomaly posts. WordPress.com uses globally-incrementing user-wide IDs, meaning the author created roughly 1,300 posts elsewhere in that gap. Likely drafts on the secondary site, or content on a third site that has not yet been found.

3 · the next character anomaly

1·1·2·?

The breadcrumb sequence so far is 1, 1, 2. If each new anomaly-post plants one more character, watching the next post is the cheapest way to extend it.

4 · shadowcheck-1912

1912

The only number on the May 14 puzzle not yet decoded. Strongest candidates: case-file number (implying 1,911 prior reports somewhere), year reference (1912 was the Titanic), or 19+12 = S+L in the alphabet.

5 · reserved tags

unstable · unverified

Two WordPress tags exist with zero posts attached: unstable (id 16089) and unverified (id 16090). Pre-staged taxonomy. Future posts will likely be tagged with one of these states as memory blocs progress through restoration.

6 · 1,516 cropped pixels

3916→2400

EXIF on the master skyscraper image claims the original Photoshop document was 2400×3916 pixels. The published version is 2400×2400. There are 1,516 vertical pixels of content the author chose not to publish. Probably gone for good, but worth flagging.

already checked, no signal

These angles have been exhausted. Skip them.

Expand the list
  • LSB / bit-plane steganography on either image
  • Audio extraction from image rasters at every sample rate
  • Spectrogram inversion (image isn't an audio spectrogram)
  • 2D FFT looking for hidden periodic content
  • RGB-shift correction at every reasonable offset
  • Thumbnail downscale / collapse
  • Posterization at 2, 4, 8, 16 colors
  • High-pass + low-pass filters
  • Median-filter despeckling + sharpening
  • JPEG embedded-file signature search (binwalk-style)
  • JPEG comments, APP13 IPTC content (all empty boilerplate)
  • EXIF / XMP / ICC custom fields (standard Adobe defaults)
  • URL slug brute-forcing — custom 404 template hides misses
  • Gravatar profile (empty)
  • WordPress comments (zero across all posts)
  • Post revisions endpoint (admin-locked, 401)
  • Wayback Machine snapshots (too new)
  • Tag archive page for glitching-reality (404)
  • Older sized image variants — just leftover WordPress thumbnails
  • Master image's TR4CE-recipe red-channel isolation (no hidden text in the master)
  • Homepage visitor counter — confirmed live "currently viewing" count, not a puzzle clue

sources

All findings above are sourced from public endpoints. Raw links for independent verification:

Open the canonical URL list