Back to all blogs
#arg
#web
#mystery
November 24, 2025
8 min read
A blog post byThereallo

Digging into a Creepy Survey Website From 2023

A mysterious psychological survey that IP bans people for switching tabs.

I saw a tweet about a weird website. Two years old, still running, never solved. Curiosity got the best of me.
By the end of the day, I had reversed the entire thing, possibly found the creator, and understood what it was actually for.
Here is what I found.

Someone retweeted this:
Hey, so this website has changed since this post 2 years ago
  • no longer ip bans you
  • doesn't ask for contact information
  • seems to be looking for the answers people previously put in
QRT: dimden
http://52.28.33.214:5002/ wtf
The link led to something called the "Observance Survey." A barebones HTML form with unsettling questions about death, God, and existence. The aesthetic was deliberately creepy. MS P Gothic font. Gray background. Questions that felt like they were probing for something specific.
3. When was the last time you've met a human? Do you have any humans in your presence right now?
4. Do you hear anyone talking around (also outside of the room)? If you're not alone, ignore the person.
The instructions were threatening:
Do not switch tabs. Do not switch windows.
The first thing I did was switch back to Chrome and turn on "Emulate a focused page" in DevTools. If this thing was going to punish me for exploring it, I'd disable the punishment first.

ARG stands for Alternate Reality Game. It's a type of interactive narrative that blurs the line between fiction and reality. Players solve puzzles, find clues across multiple platforms, and collaborate to uncover a story.
ARGs can span websites, social media, phone numbers, physical locations, anything. The best ones feel real even when you know they're not.
This looked like one. Or maybe just someone's art project. Either way, it needed investigating.

According to Reddit posts from December 2023, the survey originally:
  • Asked for your name and email (Questions 1-2)
  • IP bans you if you switched tabs
  • Used actual TCP level blocking, not just cookies
  • Required a new IP address to access again
The ban was aggressive. People reported it worked even in incognito mode, different browsers, different devices on the same network. The server would accept the TCP connection but send no data.
By the time I found it in November 2025, the behavior had changed. No IP bans. Questions 1-2 were gone. The survey just showed prefilled answers from previous submissions.
Someone had turned it into an archive.

The site ran on AWS Frankfurt (52.28.33.214). Multiple ports were open:
  • Port 22: SSH (OpenSSH 7.9p1)
  • Port 80: Apache (503 error)
  • Port 5001: 404 errors
  • Port 5002: The survey
  • Port 5005: HTTP proxy requiring authentication
I started with the obvious approach, trying different answers and seeing what happens.
Most answers returned "unsatisfactory".
bash
curl -X POST http://52.28.33.214:5002/submit \
  -d "3=test&4=test&5=test&6=test&7=test&8=test&9=test&10=test&11=test&12=test&13=test&14=test&15=test&16=test&17=test"
Response:
Thank you for your participation in the Observance Survey. 
Your answers were unsatisfactory.
But certain words triggered a different response:
bash
curl -X POST http://52.28.33.214:5002/submit \
  -d "3=death&4=death&5=death&6=death&7=death&8=death&9=death&10=death&11=death&12=death&13=death&14=death&15=death&16=death&17=death"
Response:
Thank you for your participation in the Observance Survey. 
We have found your record.

1. Input your pseudonym.
Answer: mirza

2. Input your e-mail address.
Answer: ilia5000@gmail.com
The answer to every question was "death".

The system wasn't asking for answers, but a password to unlock an archive of previous submissions.
Different request properties returned different records:
Form-encoded POST (application/x-www-form-urlencoded):
Name: mirza
Email: ilia5000@gmail.com
JSON POST (application/json):
Name: Catca
Email: xcpe1704tks@proton.me
Other answers revealed test entries:
  • "yes" -> yes / support@apple.com
  • "a" -> a / b
  • "A" -> A / Example@example.com
Only mirza and Catca looked real. I checked their GitHub profiles. Both accounts existed:
  • mirza: Created 2009, inactive
  • catca: Created 2019, active Korean developer with recent commits
These were real people, but I am not sure if they are related.

Port 5005 ran an HTTP proxy that returned 407 Proxy Authentication Required. I tried every combination I could think of:
  • mirza:death
  • Catca:death
  • mirza:ilia5000@gmail.com
  • Survey answers as passwords
  • MD5/SHA1 hashes of answers
  • Data-id values from the form
Nothing worked. The proxy credentials remain unknown. We'll never know if it was part of the puzzle or just a red herring, and that's okay.

A Reddit comment mentioned the creator might be someone named dimden (d1mden on Twitter, same person from the quote retweet). The evidence:
  • dimden is Ukrainian, "uragan" means hurricane in Ukrainian/Russian
  • The company name in the survey was "uragan"
  • dimden's personal site uses the same font (MS P Gothic), the same aesthetic
  • dimden mentions loving the moon, the survey logo is a crescent moon
  • dimden has a project called "/puzzle3" on their site
I checked dimden's website (dimden.dev). The profile matched perfectly:
I'm from Ukraine (left in September 2025). I love Moon and clouds. I hate the Sun.
The aesthetic, the experimental web projects, the puzzle-making. This was dimden's work.
The survey evolved over three years. It started as an experiment, became briefly viral, then transformed into a memorial for the people who participated.

This was a memento mori art project. "Remember death." The theme runs through everything:
  • The answer to all questions is "death"
  • Switching tabs makes you "dead" (the cookie set is literally dead=dead)
  • The cookie expires in year 9999
  • Question 15 mentions "the death screen"
  • The entire aesthetic is gothic and unsettling
It's about observation, surveillance, mortality. The survey observes you while forcing you to stay observed. Leave and you're banned. Stay and answer death. Either way, death is the outcome.
The proxy on port 5005 might represent the unknowable afterlife. Or it might just be disabled infrastructure. The ambiguity feels intentional.

When the survey was active in December 2023, it spread across Twitter. People shared screenshots, speculated about its purpose, got IP banned trying to investigate it.
The Reddit thread shows the confusion:
"This shit is old... Logo has been uploaded to FotoForensics in May 2022."
"I just saw a link to that website on twitter, i think some youtuber is gonna make a video on it like tomorrow lol"
"It doesn't actually IP ban you, it just saves a cookie called 'dead'" -> "No, it totally IP bans you."
No one solved it. The community moved on. The survey kept running.
Two years later, someone noticed it had changed. That tweet landed on my timeline. And here we are.

The JavaScript that enforced the tab-switching ban was elegant in its simplicity:
javascript
function onDeath(n) {
  var e = !1;
  function o() { e && n((e = !1)); }
  function d() { e || n((e = !0)); }
  
  "hidden" in document && document.addEventListener("visibilitychange", 
    function () { (document.hidden ? d : o)(); });
  // ... more browser-specific listeners
  
  window.onpageshow = window.onfocus = o;
  window.onpagehide = window.onblur = d;
}

onDeath(function (n) {
  n && (
    document.body.innerHTML = "",
    document.cookie = "dead=1; expires=Sun, 1 Jan 2040 00:00:00 UTC; path=/",
    setTimeout(function () {
      location.replace(
        document.referrer && document.referrer != location.href
          ? document.referrer
          : "https://google.com"
      );
    }, 10)
  );
});
When you switch tabs, the page erases itself, sets a cookie, and redirects you. Combined with server side IP tracking, this created an effective deterrent.
The current version still has this code, but the server no longer enforces the ban.

ARGs like this are rare now. The web has become more centralized, more corporate, more predictable. Weird experimental projects that span years are uncommon.
This survey ran for three years across multiple iterations. It IP-banned people. It collected real submissions. It evolved from active experiment to passive archive. And nobody documented what it was or why it existed.
Until someone stumbled on it again and decided to figure it out.
The web still has mysteries. They're just harder to find.

The survey is still running: http://52.28.33.214:5002/
Answer every question (3-17) with "death" (lowercase). You'll see the archived records.
The pre-filled answers change based on your request properties. Try different browsers, request methods, or tools like curl to see different submissions.
The proxy on port 5005 still requires authentication. If you crack it, let me know.

I spent a day on this. Curl commands, bash scripts, GitHub stalking, archive diving. It was fun.
The answer was hiding in plain sight. Death. The most obvious answer to a survey about mortality and observation.
Sometimes the solution to a mystery is exactly what it appears to be. And sometimes a creepy survey is just an art project about remembering that we all die eventually.
The real death was the friends we made along the way.
Related links: