In October 2015, Swedish tech blog “Gadgetzz” received an anonymous envelope from Poland. The envelope contained a CD-ROM with a single file on it: 11B-X-1371.mp4. This file quickly spread through social media, especially on YouTube, Reddit, and 4Chan, becoming known as the “Plague Doctor” video.
This soon became the object of massive public investigations and even involved the FBI. To date, the meaning of this file has not been uncovered, and the case remains unsolved.
The Plague Doctor video
The MP4 file showed a video set in an abandoned building, such as a decaying sanatorium or asylum. The subject of the video is a person in a black cloak and a plague doctor mask (a beaked mask, historically used in the 17th century for treating plague victims). This figure makes a series of odd, deliberate hand signals — some resembling semaphore or coded gestures. Finally, the video also features a highly distorted background sound.
Behind the surface of the video
This peculiar video was analyzed by the cryptographic and OSINT communities in an attempt to understand its meaning.
Their findings were even more intriguing: the audio hides disturbing images of mutilated women, surgical procedures, and the masked figure appearing in the video. Steganography was used by the author of the video to embed these images in the audio and the video frames.
Furthermore, in the video, the light signals and the hand movements of the plague doctor figure also hide Morse code and binary code messages.
Uncovering the secrets of the video
The plague doctor video used multiple techniques to conceal codes and hidden messages. These weren’t just a single cipher — it was layered, so solving it meant peeling these messages back like an onion.
Investigators used frame-by-frame analysis, audio spectrogram scanning, light pattern decoding, and steganography to uncover the hidden layers.
The puzzle-solving was largely done by: Reddit (/r/UnresolvedMysteries, /r/ARG), 4chan’s /x/ and /b/b/boards, and specialist forums like Kryptoslogic and Imgur puzzle threads.
They used a divide-and-conquer approach: audio experts handled spectrogram work, cryptographers tackled ciphers, and OSINT enthusiasts geolocated the building from window shapes and brick patterns. Some Polish speakers helped translate graffiti inside the building.
The hidden messages
This is the original post from GadgetZZ, where you can watch the original video: “This creepy puzzle arrived in our mail.”
When run through a spectrogram tool (such as Sonic Visualizer or the Audacity + plugin), disturbing images were revealed. They showed mutilated female bodies, autopsy photos, and masked figure portraits.
Some images were real-world crime scene photos (likely pulled from the public domain or crime archives). This caught the attention of the FBI, which opened an investigation into the video.
Certain images were overlaid with text in ASCII art. These revealed messages, such as “You are already dead,” “War is coming,” and sequences of numbers or letters that were later linked to cipher keys.
The figure in the video moves one hand, holding what looks like a blinking light. By isolating light and dark sequences in the frames, users decoded Morse code messages.
Some messages referenced “Red Lips Life Tenth” (an anagram for Kill the President — a find that escalated concerns with authorities), and “Strike fear into the hearts of men.”
Certain video frames contained blocks of black-and-white pixels resembling noise. When extracted, these turned into binary strings. Converted to ASCII, these strings revealed GPS coordinates pointing to the White House, the Zofiówka Sanatorium in Poland (where the video was shot), and a location in France near a military site.
Some file hashes were possibly placeholders for something that was never released.
Some numeric strings were encoded with a Polybius square (a cipher grid) that spelled out ominous words like “End,” “Death, and ”You are lost.”
Others used Base64 encoding and Atbash cipher (reversing the alphabet).
Investigators extracted the raw .mp4 file and found steganographic payloads. The file contained .jpg images matching the spectrogram finds, a small .txt file with more cipher text — some believe these were incomplete, possibly to drive speculation.
The building was confirmed as Zofiówka Sanatorium in Otwock, Poland — a psychiatric hospital that also treated tuberculosis patients. The building has been closed since the 1990s. Photos from urban explorers match the exact window layouts and floor patterns.
Several other clues hinted at biological weapons and pandemics, including references to pathogens in spectrogram text. However, some GPS coordinates were likely red herrings designed to mislead.
Known developments
In 2016, a man from Poland calling himself “Parker Warner Wright” claimed to be the creator of the video, framing it as an art project exploring “the age of mass surveillance.”
Some remained skeptical, since others have falsely claimed ownership of internet mysteries for clout. There is no verifiable link between Wright and the original mailing of the video. Indeed, the sender’s real identity was never confirmed. No definitive purpose was ever established: there is no connected ARG, no follow-up, no marketing tie-in.
The line between hoax, art, and threat remains blurry because of the way the codes mix real locations, disturbing imagery, and cryptographic elements. Furthermore, unsolved cipher fragments remain — a few binary strings and spectrogram symbols have never been conclusively decoded.
Theories
Besides the most obvious theories about the video (an art project, or a hoax), some suggested it originated from darker online communities, possibly as a recruitment or intimidation tool. At the time, the FBI reportedly took notice because some imagery was graphic, and the hidden messages were violent.
The case is now known and used in cryptography challenges as an example of multi-layer encoding, OSINT training for geolocation, and Internet mystery lore alongside Cicada 3301.