In one of the clearest examples of technical surveillance in his case, Chris Horlacher discovered and documented a DNS-based Man-in-the-Middle (MITM) attack that was intercepting and potentially monitoring his internet traffic.

Discovery of the DNS Hijack

While investigating persistent connectivity problems and router compromises in 2025, Chris noticed that DNS queries were resolving through unexpected Akamai servers located in the United States, even when he manually configured trusted public resolvers such as Cloudflare (1.1.1.1).

He engaged an independent, experienced cybersecurity professional to conduct a thorough forensic investigation. The expert worked directly with Chris as he performed extensive testing across multiple devices, configurations, and networks. The results confirmed anomalous DNS behavior consistent with interception or manipulation, primarily affecting the home Telmex network.

Controlled Disclosure Test

At the time the DNS MITM was still active, Chris made a deliberate controlled disclosure. He shared specific details about discovering and isolating the attack with only one person — Ilya Fadeev, a minor shareholder and former lead wallet developer at Equibit Group — who was known to be in communication with Marc Godard, a co-founder, former CTO, and lead suspect in Chris's investigation of the sabotage and entrapment efforts that had been levelled against him.

Within hours of this limited disclosure, the most obvious signs of the DNS manipulation disappeared. Follow-up testing confirmed that DNS queries were now resolving normally through trusted servers.

Expert Analysis and Evidence

The cybersecurity specialist produced a detailed report documenting the investigation, test methodology, and findings. This report included extensive DNS leak tests, nslookup results, and comparative analysis across networks.

Download: Expert Report (August 18, 2025)

Screenshots of the DNS tracing tests are available upon request to competent researchers or journalists.

Notably, this was the same expert report that Chris later witnessed being spontaneously moved to his desktop through apparent remote access via his Microsoft OneDrive account.