11B-X-1371 is a 2015 viral video sent to GadgetZZ.com, the Swedish tech blog that publicized it. The black-and-white segment is two minutes in length; its title came from the plaintext of a base64 string written on the DVD. It depicts a person wearing what appears to be a plague doctor costume walking and standing around in a dilapidated abandoned building, with a forest visible through former window openings in the wall behind it. Accompanied by a soundtrack of loud, discordant buzzing noise, the masked figure holds up a hand with an irregularly blinking light. The film did not have any credits or claims to authorship.

Messages, many in commonly used ciphers and encryption systems, have been found hidden in the video and its sound spectrogram, as well as images of tortured and mutilated people. Most of the messages have been decoded by participants in an ongoing Reddit thread, and the images sourced to notable murder investigations such as the Boston Strangler. They have been interpreted as implying a threat of bioterrorism against the United States, although it has also been speculated that the video is in reality a prank, a viral marketing stunt for an upcoming film or video game, or a student film.

After it first came to light in October 2015, it was found that it had been posted to YouTube several months earlier, along with a similarly threatening message in binary code. The poster of that video, known as AETBX, has suggested to inquiring journalists that GadgetZZ is not telling the truth about how it came to possess the video. Internet investigators managed to establish that it was filmed in the former Zofiówka Sanatorium outside Otwock, Poland, sometime between November 2013 and the video's release.

Three months after the initial controversy, an individual going by the name of Parker Warner Wright claimed to have created the video. He told The Daily Dot that it was intended as an art project, and released a sequel video, "11B-3-1369". As a way of proving his identity, he challenged viewers to create an exact duplicate of his plague doctor mask.

The video begins with shaky footage showing a figure mostly concealed in the shadow between two window-sized openings in a brick wall, through which leaves in trees can be seen blowing in the wind. These images are accompanied by indistinct electronic buzzing and hissing sounds. The figure holds their right hand to the window, signaling with three fingers, then one, and finally two.

The figure remains in shadow, with an insert showing it with cloaked arms spread, as the camera moves farther away and slowly circles to the right. After a jump cut, the lighting around the figure improves, revealing that the figure is wearing an outfit that resembles a plague doctor costume, a long dark long-sleeved hooded cloak with its face masked by a long, downward-pointing dark leather beak and goggles. The figure holds up their right hand, palm facing outward at shoulder height, to reveal a blinking light in the center of the palm. Beeping noises appear on the soundtrack in coordination with the blinks.

The figure eventually turns to its right to look at the hand. By this time, the leaves outside are still. The figure turns to look at the camera, now steady, again briefly, then back to its hand. After a series of jump cuts in which they turn rapidly back and forth between the two positions, the figure looks directly at the camera and points to it.

A quick cut later, the costumed character is looking at the camera again with hands at its sides. After a few more jump cuts in which they turn to the right and back again, the figure stands still, then looks to its left slowly. The figure looks down to where a box with various triangular sections appears, then to their right as the image seems to fragment briefly. For the remainder of the video, the cloaked figure stands still with its back to the wall, with the camera apparently handheld again and occasional video effects briefly doubling the image.

On October 12, 2015, John-Erik "Johny" Krahbichler, founding editor of the Swedish tech blog GadgetZZ, posted about a "creepy puzzle" that had been sent to him via the mail, perhaps in June. An envelope, postmarked in Warsaw and addressed to "Johny K.", care of the site's post office box in Helsingborg, with no return address, contained "a really weird CD" (actually a DVD). On it was written an alphanumeric string long enough to require two lines. At first he assumed it was a product key.

He assumed it was some software someone had sent him to review. He tested it out in a spare laptop, and instead found the video. "I was unsure what to think of it, but I found it very odd", he told The Washington Post. He said that he "later reexamined it and started noticing the 'codes' and letters hidden all around the video".

After making a minimal effort to decode it himself, he gave up and posted about it to his blog, complete with images of the disc and envelope. A few days later Gizmodo ran a story on the discovery. Lily Hay Newman of Slate described the experience of watching it for the first time as "creepy" and "unsettling", likening it to the experience of watching the cursed videotape from the 2002 film The Ring.

Early investigations soon found that Krahblicher was not the first to make the video public. In May, a user account identified as "AETBX" had posted it to YouTube, the account's only post to the site. There, it had been identified and described in binary code, with a string of 0s and 1s. As other users began commenting on it, AETBX returned to ask why there was suddenly so much interest in his five-month-old posting. Some commenters speculated that he had, in fact, created it himself; he vigorously denied it.

The Washington Post contacted him by email. He identified himself only as "Daniel from Spain" and said he had been sent the video in the mail as well. His version, he said, was also sent to him, via email from a girl he did not know, who told him she found it on a park bench. In an update to his original post, Krahblicher reported that someone found that even earlier than the YouTube posting, it had been posted to the paranormal board on 4chan. Later, in The Daily Dot, AETBX cast doubt on Krahblicher's account, saying "Anyone can fake a DVD".

Two other leads on possible creators proved false. Around the time Krahblicher first posted about the video, the blog of Triton TV, a student film group at the University of California, San Diego, posted a screenshot of the video along with a title and description in binary. Reached for comment, the group said it no longer used that website and it had been hacked a few weeks earlier; The Daily Dot said the image appeared to have been one of many posted by the hacker at random. A man named Parker J. Wright replied to a reporter's query on Twitter by saying he was not the Parker Wright who had posted the video to YouTube on September 30 with the note "Are you listening?"

While the identity of the video creator remained unknown, the location at which it was filmed has been identified. A Polish Internet user who was following the story went to the former Zofiówka Sanatorium, near Otwock, a short distance south of Warsaw. One of the rooms there had the same fenestration and graffiti seen in the video. The latter were not present in a photo of the room taken in November 2013, suggesting the video was made between then and April 2015.

In late November, after most of the initial talk and speculation about the video, its creator and purpose had died down, a Twitter account was opened under the name Parker Warner Wright. Its owner claimed to have made the video; Wright was not the only person on the Internet actively claiming the same thing at the time and throughout the last months of 2015 others posted their own videos in attempt to authenticate themselves.

At the end of the month, Wright announced that the next video would be released "in exactly 1.444 metric hours" on his YouTube channel. At the appointed time, a new video, titled 11B-3-1369, in black and white with occasional effects and inserts, was published, with "Their lies unlock our dissent", underneath in the description. In it, the figure in the plague doctor costume returned, shown outside the sanatorium in the forest at first, and later within. The soundtrack was quieter than that of the first video and included some electronic tinkling noises which were synchronized with the blinker on the figure's hand. Later in the video, the plague-doctor figure is joined by a woman in a white dress with her face covered in bandages.

Three weeks later, The Daily Dot published an interview with Wright. He told reporter Mike Wehner that he was a U.S. citizen who lives in Poland, and that the videos were meant as an art project. After finishing the video, in May 2015, he had left three copies, two on discs in a subway and park in Poland, and the last one posted to 4chan. Reporter Mike Wehner concluded thus that the YouTube user AETBX had no involvement in the video's creation. As a way of authenticating himself, Wright challenged visitors to his Facebook page to replicate the plague doctor mask, which he claimed to have designed and built himself.

Some commenters on Wright's Facebook page were skeptical of his claims, pointing to differences in the costume between the two videos; Wright explained the differences by saying he wanted, and made, a better cloak for the second video. Krahbichler accepted Wright's claims. "It would be too much of a hassle just to play along for this long, and making up stories that fit so well," he wrote shortly after the second video was posted. "I believe it is very safe to say that PWW is indeed the creator". In an early-December exchange on Facebook, Wright had told him he had chosen him as the recipient since he had "won the business card lottery ... you handed me your business card, at some point". Krahbichler speculated that Wright had probably attended at least one of the many tech shows where he had had a booth.

The Reddit users who responded to Krahbichler's post found other coded messages hidden in the video. An encoded inscription on the disc's menu was found to be "11B-X-1371", which has been treated as the video's title. James Billington of the International Business Times wrote that "some reported [that the video's audio] sound[ed] like 'I would love to kill you' being repeated over and over". Another user created a spectrogram of the sound and found both text and images concealed within. The former had one in plaintext saying "You Are Already Dead"; the rest were enciphered. The images depicted women being mutilated and tortured; early fears that the creator of the video might be a serial killer were allayed when later research discovered that one of the stills was from the horror film The Bunny Game, one was from the German film Slasher and another was a picture of a victim of the Boston Strangler.

Most messages had a generally threatening tone. A sound spectrogram of the DVD's menu yielded a picture of a skull and more coded messages. The binary title of AETBX's YouTube posting was "Muerte", Spanish for "death", and the description similarly resolved to Spanish text—"Te queda 1 año menos", rendered in English as "you have one less year". The triangle-and-square message near the end of the video was found to read "Ad oppugnare homines" in Pigpen cipher—Latin for "To attack or target men".

The plague doctor costume led other readers to see the video's threats as related to bioterror. One message's plaintext read "The eagle=infected will spread his disease. We are the antivirus will protect the world body"; another read "Strike an arrow through the heart of the eagle". The year 1371, it was also suggested, was one in which the Black Death was ravaging Europe.

Single-frame inserts were found to have Morse code and other texts in common ciphers. The Morse's plaintext was the phrase "RED LIPS LIKE TENTH". A sequence of 20 pairs of two-digit characters was found to be the latitude and longitude of the White House in Washington; it was later noted that the "RED LIPS" phrase could be an intended anagram for "KILL THE PRESIDENT". These were seen as a threat against the United States in general and President Barack Obama in particular. Krahbichler reported that a cipher in the video could be decoded to reveal the message "STANDANDFIGHTWITHUSTAKEDOWNTHEBLACKBEASTKILLHISDISEASEORFALLWITHTHEREST", and that the "BLACKBEAST" of the message could be Obama, an African-American. Krahbichler said that he believed that the video contained a political message, but was not a terrorist threat.

Shortly after the individual calling himself Parker Warner Wright revealed himself as the creator on Twitter at the end of November, he said to those who had been working to decode the texts "you are no closer to understanding the message". However, he allowed that it had been his intent that people work together to break the codes: "Not one individual could decipher the whole".

While the video's metamessage was clearly threatening, it remained too vague to draw any definitive conclusions about what the makers' intent might have been. Since it was publicized a few weeks before Halloween, there was speculation that it could be an Internet prank related to the holiday. After initially being disturbed when the threatening messages were decoded, Krahbichler said, "I'm starting to think again it's just an elaborate joke". However, he did not think it was one aimed at him specifically, since if the sender "knew me personally, they would know I don't have the expertise to crack it, at least not the whole thing".

The other theory to gain support was that it was viral marketing to promote an upcoming movie or video game. A Redditor noted that the film version of Dan Brown's novel Inferno was beginning production at that time for a late 2016 release. In the story, a rich villain makes a video warning of his plans to release a virus in order to reduce population growth. In it, he also wears a plague doctor costume, likens himself to death and claims at the same time to be the cure.

Moviepilot also reported on speculation that the video was intended to promote the upcoming season of the Syfy series 12 Monkeys, based on the Terry Gilliam film of the same name. Both concern a time traveler from the future who is attempting to prevent the outbreak of a devastating epidemic in the present. Another Redditor had observed that the line "You are already dead" is used frequently in the show, as is a plague doctor costume. He added that the "3-1-2" signaled by the figure's fingers at the beginning of the video could refer to the show's upcoming third season.

The video's Polish origin further suggested a marketing gimmick, according to one Redditor from that country. "[O]ur fledgling [video game] studios don't have large budgets for 'standard' advertisement[s]", he wrote. There had been a similarly creepy viral video in Poland a few years ago, he recalled, that parodied a children's show. He did not think the same people were behind 11B-X-1371, however, as their clip's production values had been higher.

Ultimately, it seemed unlikely that any media company, particularly the major studios and television network making Inferno and 12 Monkeys, would risk the negative publicity that would come from using the images in the spectrograms and a suggested threat against a U.S. president.

Another theory connected the video to popular electronic musician Skrillex. In May, when the video had first been posted to the Internet, he released a song called "Red Lips". Shortly after Krahbichler's original post, he tweeted "#REDLIPS #REDLIPS #REDLIPS". It was speculated that it could be viral marketing for his work—other musicians in that genre have been known to hide images in spectrograms—or from some CDs of unreleased work that he said had been stolen from his hotel room. But if it was the former possibility, Krahblicher noted, "the problem is that the hints towards the works being promoted are fairly weak".

Parker Warner Wright, whom both Krahblicher and The Daily Dot believed to be the creator of the video, said it and its sequel were the first in a series of art projects. He would not be specific on their themes or message. "I see my work as waves on the ocean", he told the latter. "Some people look for shells in it, some surf, others—dive". He had always intended for them to be a series, regardless of whether they went viral or not. "Currently, there is a call for more, and I aim to please", he admitted. "However, my art would move forward irrespective of external force. I have a call from within, I need to answer".

Wright uploaded another video to his Facebook page entitled 110A30213 on November 5, 2016, three days prior to the 2016 United States presidential election. It features Wright addressing a crowd while dressed like a military officer or dictator. Krahbichler theorized that the video, which he deemed "very political", might have a message related to the election. He also felt that the date that Wright posted the video on his Facebook page could be a reference to Guy Fawkes' words "Remember, remember, the 5th of November".

• Cicada 3301, the identity claimed by a group, about whom little else is known, that has posted several cryptological puzzles on the Internet in the mid-2010s looking for intelligent people to recruit
• Sad Satan
• List of ciphertexts
• List of viral videos

• 11B-X-1371 on YouTube
• 11B-3-1369 wiki