Case 1:24-cv-02323-MSN-WEF Document 38 Filed 01/10/25 Page 1 of 4 PageID# 510

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF VIRGINIA
ALEXANDRIA DIVISION

Microsoft Corporation,

Plaintiff,
Case No. 1:24-cv-02323-MSN-WEF
V.

Does 1-10 Operating an Azure Abuse Network,

Defendants.

PRELIMINARY INJUNCTION ORDER

Plaintiff Microsoft Corporation (“Microsoft” or “Plaintiff') has filed a complaint for

injunctive and other relief pursuant to: the Computer Fraud and Abuse Act (“CFAA”) (18
U.S.C. § 1030); the Digital Millenium Copyright Act (“DMCA”) (17 U.S.C. § 1201), the
Lanham Act (15 U.S.C. §§ 1114, 116, & 1125); the Racketeer Inftuenced and Corrupt
Organizations (“RICO”) Act (18 U.S.C. § 1962(c)); the common law, and the All Writs Act (28
U.S.C. § 1651). Plaintiff moved ex parte for an emergency temporary restraining order (“TRO”)
which the Court granted on December 20, 2024. Microsoft subsequently moved for an order
extending the TRO for an additional seven days, which the Court granted on January 2, 2025.
The Court’s TRO directed Defendants to show cause by January 10, 2025 why the TRO

should not be converted into a preliminary injunction for the remainder of the case. Defendants
did not appear at the January 10, 2025, 10 a.m. hearing on the Court’s order to show cause and
have not otherwise responded to the order to show cause despite receiving notice of these
proceedings.
Accordingly, based on the record, including Microsoft’s supplemental brief and the
supplemental declaration of Jason Lyons filed January 10, 2025, and good cause having been
shown, the Court’s TRO is hereby converted to a preliminary injunction that shall remain in
place pending final disposition of this matter. The preliminary injunction is based on the
following findings.
Case 1:24-cv-02323-MSN-WEF Document 38 Filed 01/10/25 Page 2 of 4 PageID# 511

FINDINGS OF FACT AND CONCLUSIONS OF LAW

1. There is good cause to believe that the Court's prior findings of fact and
conclusions of law continue to apply as of the time of this order.
2. This Court has jurisdiction over the subject matter of this case and there is good
cause to believe that it will have jurisdiction over all parties hereto. The Complaint states claims

upon which relief may be granted against Defendants Does MO under the CFAA (18 U.S.C. §
1030), the DMCA (17 U.S.C. § 1201), the Lanham Act (15 U.S.C. §§ 1114, 1116, 1125). the
RICO Act (18 U.S.C. § 1962(c)), and the common law of trespass to chattels and tortious
interference.

3. There is good cause to believe that Defendants have specifically directed their
activities to computers located in the Eastern District of Virginia.
4. There is good cause to believe based on the January 9, 2025 declaration of Jason
Lyons, filed with the Court on January 10, 2025, that Defendants have received actual notice of
this action and the Court’s prior orders.
5. Defendants have not responded to the Court’s order to show cause.
6. Microsoft has registered trademarks representing the quality of its products and
services and its brand, including the Microsoft® and Azure® marks.
7. Defendants have engaged in and are likely to engage in acts or practices that
violate the CFAA (18 U.S.C. § 1030), the DMCA (17 U.S.C. § 1201), the Lanham Act (15
U.S.C. §§ 1114. 1116, 1125), the RICO Act (18 U.S.C. § 1962(c)), and constitute trespass to
chattels and tortious interference. Microsoft is, therefore, likely to prevail on the merits of this

action.

8. There is good cause to believe that Defendants have engaged in illegal activity by
using the “aitism.net” domain, de3U software, Cloudflarc tunnel, rentry.org subdomains, oai-
reverse proxy, and AWS infrastructure in the manner described in Microsoft’s TRO papers.

-2 -
Case 1:24-cv-02323-MSN-WEF Document 38 Filed 01/10/25 Page 3 of 4 PageID# 512

9. There is good cause lo believe that, unless Defendants are restrained and enjoined
by Order of this Court, immediate and irreparable harm will result from the Defendants' further
violations of law.

10. 'fhere is good cause to believe that Defendants will use the domain “ailism.net”
and its subdomains to direct malicious communications to Microsoft’s computers to further

perpetrate their fraud on Plaintiff and its customers, and that control over the “aitism.net”
domain should remain with Microsoft pending final disposition of this action.
11. Defendants do not have any legitimate interest that will be impaired by a

preliminary injunction.
12. The balance of hardships and public interest weigh in favor of converting the
TRO to a preliminary injunction.
13. Microsoft has deposited with the Court a bond in an amount that the Court
considers proper to pay the costs and damages sustained by any party found to have been
wrongfully enjoined or restrained.
PRELIMINARY INJUNCTION

IT IS THEREFORE ORDERED that, Defendants, their representatives, and persons

who are in active concert or participation with them are temporarily restrained and enjoined

from: (1) accessing without authorization the computers or software comprising Microsoft’s
Azure OpenAI Service, (2) sending malicious code to configure, deploy or operate the Azure
Abuse Enterprise, {3} generating and sending harmful images bearing false indicia of
sponsorship or approval by Microsoft; and (4) stealing information, money, or property from
Plaintiff or Plaintiffs customers

IT IS FURTHER ORDERED that, with respect to any currently registered Internet

domains used by Defendants to conduct the Azure Abuse Enterprise, the domain registries
located in the United States shall take the following actions:
A. Maintain unchanged the WHOIS or similar contact and identifying information as
of the time of receipt of this Order and maintain the domains with the current registtai,
B. The domains shall remain active and continue to resolve in the manner set forth in

-3 -
Case 1:24-cv-02323-MSN-WEF Document 38 Filed 01/10/25 Page 4 of 4 PageID# 513

this Order;

C. I’rcvenl transfer or moditlealion oflhc domains b\' Defendants or third parties at

the registrar;
D. The domains shall be redirected to secure servers by changing the authoritative

name servers to such name servers identified by Microsoft as may be necessary, and taking other

reasonable steps to work with Microsoft to ensure the redirection of the domains, to ensure that
Defendants cannot use them, and to maintain the domains under the control of Microsoft pending

final disposition of this action;

E. Take all steps required to propagate the foregoing changes through the DNS,
including domain registrars; and
F. Preserve ail evidence that may be used to identify the Defendants using the
domains.

rr IS so ORDERED.
Is/
Entered this 10th day of January, 2025.
Hon. Michael S. Nachmanoff
United States District Judge

-4-