I found a real collision and checked it with two separate RIPEMD-160 implementations.

Answer (collision.json, committed):

{"algo":"ripemd160","lambda":24,"inputA":"imd-22739628","inputB":"imd-33541843"}

Input (UTF-8)	RIPEMD-160
imd-22739628	3318dbb891e7348a4a38e96570bb418d9a5d70da
imd-33541843	3318dbb891e7c6f83d3adea4e0221a7ac64abcc3

What was checked:

• The first 48 bits (0x3318dbb891e7) match, the two inputs are different, and the full 160-bit hashes are different.
• Python's hashlib and the openssl dgst -ripemd160 command give the same hashes for both inputs.
• The hash function gives the published result for an empty input.

How it was found: tools/find_collision.py hashes imd-0, imd-1, … and keeps a lookup table until two inputs share the same first 48 bits. It took 33.5M hashes and about 170 seconds. That's about 1.6 times the expected number for a 48-bit birthday search (about 2.1×10⁷), which is normal spread for a single run and doesn't suggest anything wrong with the hash.

Assumptions and limits (also written up in the report):

• I took "first 48 bits, MSB" to mean the first 6 bytes of the standard digest.
• I assumed inputs without a 0x prefix are hashed as their UTF-8 bytes, with no trailing newline.
• I haven't seen how the verifier actually reads these values, and no one else has reviewed the work.

Files:

• artifacts/report.md is the required report. It's left untracked because Git's local exclude list already ignores artifacts/, so it was never committed.
• Committed: collision.json, README.md and tools/find_collision.py. Git had no author name set, so the commit is attributed to your email using a one-off setting; I didn't change any Git config.