By December 2020 CSIS was deep in default of filing its defense, and Chris Horlacher suspected they would attempt to undermine the lawsuits via other means. After experiencing persistent and strange internet behaviors Horlacher deployed a honeypot named “Equibit-Dev” on his home network while still residing in Canada on a Rogers internet connection. The purpose was straightforward: to observe and document any targeted probing of his systems.
What followed was a series of events that remain among the most technically and behaviorally revealing in the Equibit case.
Chronology of Events
December 2020 – Initial Probe
Shortly after the honeypot was activated, it received an immediate probe from the link-local IP address 169.254.15.240. This address returned several times over the ensuing weeks and eventually self-identified on the local network as “Equibit-Dev.local” — using the exact naming convention of Horlacher’s honeypot.
Link-local addresses (169.254.0.0/16 range) are not publicly routable and are typically used for automatic communication within a local network segment. In this context, the appearance of such a probe strongly suggests activity originating from within the local network — most plausibly the router itself, which Chris already suspected had been subjected to ISP-level interception under a Federal Court warrant.
Controlled Disclosure
Horlacher performed a controlled disclosure, informing Marc Godard (long-time friend, former CTO and CEO of Equibit Group, and primary suspect for being a CSIS Officer) and IT-security professional George Plytas (a highly-accomplished CISO whom Chris had worked with at several companies) about the probe. For the purpose of the test, he referred to it as the “NASA” probe (the actual address was one digit off from a known NASA range, 169.154.15.240).
Marc Godard quickly downplayed the finding. George Plytas, a seasoned cybersecurity expert with whom Horlacher had a long professional relationship, immediately ceased all communication and has not been heard from since.
January 3, 2021 & May 30, 2021 – Confirmed Government-Linked Probes
Several weeks after the initial link-local probe, the honeypot was contacted by the IP address 168.254.7.38. This address belongs to ASN BHN-33363, officially registered to Charter Communications, Inc. (formerly Bright House Networks). Charter is one of the largest cable and internet service providers in the United States, operating under the Spectrum brand in many regions.
Sources:
While Charter Communications is a commercial ISP, large U.S. telecommunications providers like Charter are frequently used by government agencies for data interception, handoffs, and operational cover. IP ranges from major carriers are commonly seen in government and law enforcement activity due to warrants served on the ISP.
The 168.254.7.38 address probed the honeypot once on January 3, 2021, and then three separate times on May 30, 2021. The repetition on May 30 is particularly noteworthy, as it suggests deliberate, targeted reconnaissance rather than random scanning.
Analysis & Implications
The combination of these probes is significant:
- The link-local probe (169.254.15.240) suggests local network compromise or router-level monitoring, consistent with lawful interception authorized by a Federal Court warrant served on Rogers.
- The BHN-33363 probes represent external interest from a major U.S. telecommunications ASN with documented government ties. The timing of these probes — shortly after honeypot deployment and again during sensitive litigation periods — strengthens the pattern of coordinated surveillance.
Together, they indicate targeted technical surveillance during a period when Horlacher was actively preparing to confront CSIS in discovery.
The behavioral reactions remain particularly telling. Marc Godard’s rapid dismissal and George Plytas’s complete withdrawal of contact occurred immediately after disclosure. In intelligence and counter-intelligence contexts, such abrupt changes in behavior are often interpreted as signs of recognition or operational sensitivity.
Conclusion
While the most dramatic initial probe was link-local rather than a direct external NASA connection, the overall pattern — local router-level activity combined with probes from a major government-linked ASN, timed with litigation milestones, and followed by highly suspicious reactions from key individuals — remains deeply concerning.
This incident forms part of a broader technical surveillance picture that has been meticulously documented and will be included in the full Factum of Equibit Group.
The watchers were active.
Some of their reactions suggested they did not appreciate being watched in return.
