Court File No. CV-20-00645492-0000
Equibit Group Ltd. v. Attorney General of Canada et al.
Related: Seven Documented Technical Attacks · WhatsApp block at Anarchapulco 2026 · Wosnack Statement of Claim
In late July 2025 Equibit Group Ltd. deployed a private Jitsi Meet instance for encrypted video conferences with legal counsel. Fail2Ban was set to ban any IP after five failed SSH authentications.
Between 30 July 2025 and 26 May 2026 the system recorded 5,622 distinct IP bans. After a quiet summer, bans resumed on 27 August 2026 at a few dozen per day — the period in which the company was preparing Court File No. CV-26-00017856-0000 against Nathan Wosnack and Ubitquity, LLC. That claim issued on 8 September 2026.
This article is a quantitative pass over the first campaign, then a dated note on the resume. It does not assign the packets to a named operator.
Methodology
Daily ban counts were taken from Fail2Ban notification emails. After cleaning and converting timestamps, the first series covers 163 days with at least one ban.
Descriptive statistics on that series:
- Mean daily bans: 34.49
- Standard deviation: 71.34
- Two-standard-deviation threshold: 177.18
Any day above that threshold is treated as an anomaly under a normal-distribution rule of thumb. The distribution is heavily right-skewed. The rule is a flag, not a proof of cause.
Results: Seven Anomalous Days
Seven days exceeded the 2σ threshold:
| Rank | Date | Ban count | Multiple of mean |
|---|---|---|---|
| 1 | 2026-02-22 | 476 | 13.8× |
| 2 | 2026-02-23 | 453 | 13.1× |
| 3 | 2026-02-24 | 449 | 13.0× |
| 4 | 2026-02-25 | 271 | 7.9× |
| 5 | 2026-02-27 | 229 | 6.6× |
| 6 | 2026-02-26 | 220 | 6.4× |
| 7 | 2026-05-26 | 214 | 6.2× |
The extreme window is 22–27 February 2026: 220 to 476 bans a day, an order of magnitude above the mean. A second spike landed on 26 May 2026 (214). After that date the first campaign went quiet.
February 2026 and Anarchapulco
The February surge sits on the same week as Anarchapulco 2026, where Chris Horlacher was speaking and meeting counsel and journalists. On 18 February 2026 he also recorded a targeted WhatsApp failure to his wife at the conference. That incident is on the technical-attack chronology.
Volume and duration in that week are a poor match for idle internet scanning of a private counsel server that advertised nothing.
Technical Characteristics of the First Campaign
The logged vector was SSH brute force against sshd. Source IPs were spread across geographies and ASNs, with a large share from Chinese address space, cloud hosts, and residential proxies — the usual rented or compromised pool. Many addresses returned on later days.
Jitsi itself kept running. A loud SSH grind against a hardened box can be the campaign, or it can be noise around another objective. The logs do not settle that question.
Keeping hundreds of distinct banned IPs on a single low-value host for several days is not free. Commercial proxy and botnet prices for a burst of that length sit in the low-to-mid thousands of dollars on public rate cards. That is above casual scanning. It is not, by itself, a named defendant.
Resumption — 27 August 2026
After 26 May 2026 the daily series went quiet through the summer. On 27 August 2026 Fail2Ban again began recording bans at a rate of a few dozen per day.
That date sits immediately before issuance of Court File No. CV-26-00017856-0000, Equibit Group Ltd. and Chris Horlacher v. Nathan Wosnack and Ubitquity, LLC, on 8 September 2026. Preparation of that claim was underway in late August.
The resume is a second time series. It has not yet been run through the same 2σ screen as the 5,622-ban set. It is recorded here because an earlier version of this article’s closing line — that activity ceased after 26 May — is no longer true.
Place in the Equibit Lawsuit
The Jitsi host was built for counsel calls in the CSIS action, Court File No. CV-20-00645492-0000. The logs belong on the technical-attack record with the router, DNS, and WhatsApp incidents in Seven Documented Technical Attacks. The August resume is contemporaneous with the Wosnack filing.
Conclusion
The Fail2Ban mailbox is one of the cleaner quantitative sets in this file: a baseline of probes, a six-day February spike aligned with public appearance and a comms failure, a May termination, a summer gap, then a resume at the same baseline rate as a fourth Ontario action was being prepared. The packets do not name an operator. They do name a clock.
