If you are new to the Equibit story, please read The Assassination of Equibit, originally released in 2023.

By December 2020 CSIS was deep in default of filing its defense, and Chris Horlacher suspected they would attempt to undermine the lawsuits via other means. After experiencing persistent and strange internet behaviors Horlacher deployed a honeypot named “Equibit-Dev” on his home network while still residing in Canada on a Rogers internet connection. The purpose was straightforward: to observe and document any targeted probing of his systems.

What followed was a series of events that remain among the most technically and behaviorally revealing in the Equibit case.

Chronology of Events

December 2020 – Initial Probe

Shortly after the honeypot was activated, it received an immediate probe from the link-local IP address 169.254.15.240. This address returned several times over the ensuing weeks and eventually self-identified on the local network as “Equibit-Dev.local” — using the exact naming convention of Horlacher’s honeypot.

Link-local addresses (169.254.0.0/16 range) are not publicly routable and are typically used for automatic communication within a local network segment. In this context, the appearance of such a probe strongly suggests activity originating from within the local network — most plausibly the router itself, which Chris already suspected had been subjected to ISP-level interception under a Federal Court warrant.

Controlled Disclosure

Horlacher performed a controlled disclosure, informing Marc Godard (long-time friend, former CTO and CEO of Equibit Group, and primary suspect for being a CSIS Officer) and IT-security professional George Plytas (a highly-accomplished CISO whom Chris had worked with at several companies) about the probe. For the purpose of the test, he referred to it as the “NASA” probe (the actual address was one digit off from a known NASA range, 169.154.15.240).

Marc Godard quickly downplayed the finding. George Plytas, a seasoned cybersecurity expert with whom Horlacher had a long professional relationship, immediately ceased all communication and has not been heard from since.

January 3, 2021 & May 30, 2021 – Confirmed Government-Linked Probes

Several weeks after the initial link-local probe, the honeypot was contacted by the IP address 168.254.7.38. This address belongs to ASN BHN-33363, officially registered to Charter Communications, Inc. (formerly Bright House Networks). Charter is one of the largest cable and internet service providers in the United States, operating under the Spectrum brand in many regions.

Sources:

• ARIN WHOIS Record for AS33363
• BGP.tools ASN Details

While Charter Communications is a commercial ISP, large U.S. telecommunications providers like Charter are frequently used by government agencies for data interception, handoffs, and operational cover. IP ranges from major carriers are commonly seen in government and law enforcement activity due to warrants served on the ISP.

The 168.254.7.38 address probed the honeypot once on January 3, 2021, and then three separate times on May 30, 2021. The repetition on May 30 is particularly noteworthy, as it suggests deliberate, targeted reconnaissance rather than random scanning.

Analysis and Implications

The combination of these probes is significant:

• The link-local probe (169.254.15.240) suggests local network compromise or router-level monitoring, consistent with lawful interception authorized by a Federal Court warrant served on Rogers.
• The BHN-33363 probes represent external interest from a major U.S. telecommunications ASN with documented government ties. The timing of these probes — shortly after honeypot deployment and again during sensitive litigation periods — strengthens the pattern of coordinated surveillance.

Together, they indicate targeted technical surveillance during a period when Horlacher was actively preparing to confront CSIS in discovery.

The behavioral reactions remain particularly telling. Marc Godard’s rapid dismissal and George Plytas’s complete withdrawal of contact occurred immediately after disclosure. In intelligence and counter-intelligence contexts, such abrupt changes in behavior are often interpreted as signs of recognition or operational sensitivity.

Conclusion

While the most dramatic initial probe was link-local rather than a direct external NASA connection, the overall pattern — local router-level activity combined with probes from a major government-linked ASN, timed with litigation milestones, and followed by highly suspicious reactions from key individuals — remains deeply concerning.

This incident forms part of a broader technical surveillance picture that has been meticulously documented and will be included in the full Factum of Equibit Group.

The watchers were active.

Some of their reactions suggested they did not appreciate being watched in return.

Stay tuned to equibitlawsuit.com for more updates on the Equibit lawsuits against CSIS and related actors.

If you are new to the Equibit story, please read The Assassination of Equibit, originally released in 2023.

In one of the clearest examples of technical surveillance in his case, Chris Horlacher discovered and documented a DNS-based Man-in-the-Middle (MITM) attack that was intercepting and potentially monitoring his internet traffic.

Discovery of the DNS Hijack

While investigating persistent connectivity problems and router compromises in 2025, Chris noticed that DNS queries were resolving through unexpected Akamai servers located in the United States, even when he manually configured trusted public resolvers such as Cloudflare (1.1.1.1).

He engaged an independent, experienced cybersecurity professional to conduct a thorough forensic investigation. The expert worked directly with Chris as he performed extensive testing across multiple devices, configurations, and networks. The results confirmed anomalous DNS behavior consistent with interception or manipulation, primarily affecting the home Telmex network.

Controlled Disclosure Test

At the time the DNS MITM was still active, Chris made a deliberate controlled disclosure. He shared specific details about discovering and isolating the attack with only one person — Ilya Fadeev, a minor shareholder and former lead wallet developer at Equibit Group — who was known to be in communication with Marc Godard, a co-founder, former CTO, and lead suspect in Chris’s investigation of the sabotage and entrapment efforts that had been levelled against him.

Within hours of this limited disclosure, the most obvious signs of the DNS manipulation disappeared. Follow-up testing confirmed that DNS queries were now resolving normally through trusted servers.

Expert Analysis and Evidence

The cybersecurity specialist produced a detailed report documenting the investigation, test methodology, and findings. This report included extensive DNS leak tests, nslookup results, and comparative analysis across networks.

Download: Expert Report (August 18, 2025)

Screenshots of the DNS tracing tests are available upon request to competent researchers or journalists.

Notably, this was the same expert report that Chris later witnessed being spontaneously moved to his desktop through apparent remote access via his Microsoft OneDrive account.

Strategic Context: “Control the Battlefield”

Had Chris remained in Canada, such a MITM attack might have been unnecessary. Canadian authorities could simply serve a warrant directly to the ISP for full traffic access. By relocating to Mexico, Chris deliberately removed one of the most powerful tools from his adversaries’ arsenal — forcing them to resort to more complex technical attacks like router compromises via TR-069 and DNS manipulation.

This forms part of Chris’s broader “Control the Battlefield” strategy, which comes from Sun Tzu’s Art of War: denying easy institutional access and forcing any surveillance into more detectable, and legally questionable methods.

Implications

A DNS Man-in-the-Middle attack at the router or ISP level is extremely invasive. It enables:

• Logging of every website visited
• Undetectable traffic redirection to spoofed websites
• Monitoring of communications (even HTTPS to a limited degree)

The precision, persistence, and rapid response to the controlled disclosure strongly suggest a targeted operation by sophisticated actors.

This incident adds to the growing body of technical evidence of digital harassment that includes router compromises, Microsoft ecosystem intrusions, and other documented attacks.

Further Reading:

• Router Sabotage via TR-069
• Microsoft Unauthorized Access Incidents
• Complete Media section

These attacks highlight the vulnerabilities of modern connected infrastructure and the challenges faced by individuals seeking accountability from powerful institutions.

If you value digital privacy and the right to due process, please share this post.

Stay tuned to equibitlawsuit.com for more updates on the Equibit lawsuits against CSIS and related actors.