The public record of the Equibit proceedings documents a series of technical incidents directed at Equibit Group Ltd. and its founder, Chris Horlacher. The events span years, jurisdictions, and layers of the stack. They are preserved in forensic reports, server logs, archival captures, third-party audits, and contemporaneous posts on this site, and they form part of the record in Court File Nos. CV-20-00645492-0000, CV-21-00654929-0000, CV-26-00015305-0000, and CV-26-00017856-0000.
Residential Routers in Mexico Were Repeatedly Compromised
First, Horlacher’s residential routers in Mexico were repeatedly compromised. Both Huawei HG8145V5 and ZTE F670L devices exhibited the same anomalies: system logs reset to the year 1981, selective disruption of specific devices on the network while others remained unaffected, and rapid re-infection after factory resets. Security analysts have identified these markers as consistent with persistent firmware-level access or exploitation of the TR-069 remote-management protocol. The attacks directly impaired secure communications and the ability to preserve evidence during critical phases of the litigation.
DNS Man-in-the-Middle Interference
Second, DNS man-in-the-middle interference was observed. Horlacher’s internet browsing and other online activity was redirected or intercepted, undermining the integrity of email, website access, and other communications. This class of attack requires either privileged network position or compromise of upstream infrastructure.
The 13 July 2026 Intrusion of Equibitlawsuit.com
Third, on 13 July 2026 the equibitlawsuit.com website itself was subjected to a coordinated intrusion. Early that morning the site began serving an aggressive Cloudflare-style verification page matching the known “ClickFix” social-engineering pattern. Shortly afterward a malicious file was discovered inside a performance-optimization plugin, triggering fatal PHP errors. An unauthorized administrator account under the username “Waseem” then logged into the WordPress dashboard from IP addresses in Bangladesh and Ashburn, Virginia. The intruder navigated the admin area, attempted plugin uploads, accessed reports, and conducted reconnaissance before the account was deleted approximately 23 minutes after the second detected login.
Negative SEO and Toxic Backlink Bombing
Fourth, the legitimate domain was subjected to sustained negative SEO and toxic backlink bombing. Independent audits revealed that a large proportion of the most prominent referring domains and anchor texts consisted of high-volume spam promoting casino sites, cryptocurrency services, private blog networks, and “rank first page Google” schemes. The practical effect was to associate a serious legal-documentation site with black-hat link-building activity in the eyes of search algorithms.
Impersonation Websites at Equibit.io and Equibit.net
Fifth, two professional-grade impersonation websites were deployed at equibit.io and equibit.net. Both used Equibit’s name and branding. The first also used Horlacher’s name and likeness and falsely presented him as chief executive officer. The second falsely claimed to be published by a non-existent “Equibit, Inc.” and asserted that the business was “Licensed and Regulated.”
Document-Access Irregularities During Heightened Litigation
Sixth, during periods of heightened litigation activity the company recorded unexpected mass-updates and access irregularities affecting case documents. Those events aligned in time with other technical incidents described on this site. They remain part of the evidentiary file even where a standalone forensic post has not yet been published.
Robots.txt and Archive Suppression After 11 April 2026
Seventh, deliberate steps were taken to suppress the archival record of the second impersonation site. After a single capture was obtained on 11 April 2026, the site was reconfigured with a highly restrictive robots.txt directive instructing all crawlers and archiving services not to access it. Combined with Cloudflare shielding and maximum registrant privacy, these measures significantly reduced the ability of independent parties to preserve evidence of the site’s content.
Collectively these seven categories show a persistent, multi-vector campaign against the company’s public presence, the founder’s operational security, and the integrity of the evidentiary record. Several of the same facts underpin the relief sought in CV-26-00017856-0000, including the Norwich request directed at NameCheap, Cloudflare, Google, and other intermediaries.
Further Reading
- Router Sabotage Exposed
- DNS Man-in-the-Middle Attack Exposed
- They Came for the Website
- SEO Poisoning
- Six Key Facts About the Impersonation Websites
