Case 1:24-cv-02323-MSN-WEF Document 29 Filed 12/30/24 Page 1 of 6 PageID# 474

IN THE UNITED STATES DISTRICT COURT FOR

MICROSOFT CORPORATION,
Plaintiff,
No. 1:24-cv-2323-MSN-WEF
v.
FILED UNDER SEAL
DOES 1-10 OPERATING AN AZURE
ABUSE NETWORK,
Defendants.

AMENDED EX PARTE TEMPORARY RESTRAINING ORDER

Plaintiff Microsoft Corporation (“Microsoft” or “Plaintiff”) has filed a complaint for

injunctive and other relief pursuant to: the Computer Fraud and Abuse Act (“CFAA”) (18 U.S.C.

§ 1030); the Digital Millenium Copyright Act (“DMCA”) (17 U.S.C. § 1201), the Lanham Act

(15 U.S.C. §§ 1114, 1116, & 1125); the Racketeer Influenced and Corrupt Organizations Act

(“RICO”) (18 U.S.C. § 1962(c)); the common law, and the All Writs Act (28 U.S.C. § 1651).

Plaintiff has moved ex parte for an emergency temporary restraining order pursuant to Rule 65(b)

of the Federal Rules of Civil Procedure, 15 U.S.C. § 1116(a) (the Lanham Act), and 28 U.S.C.

§ 1651(a) (the All Writs Act).

FINDINGS OF FACT AND CONCLUSIONS OF LAW

Having reviewed the papers, declarations, exhibits, and memorandum filed in support of

Plaintiffs' Application for an Emergency Ex Parle Temporary Restraining Order, the Court hereby

makes the following findings of fact arid conclusions of law:

1. This Court has jurisdiction over the subject matter of this case and there is good

cause to believe that it will have jurisdiction over all parties hereto; the Complaint states a claim

upon which relief may be granted against Defendants John Does 1-8 ("Defendants") under the
Case 1:24-cv-02323-MSN-WEF Document 29 Filed 12/30/24 Page 2 of 6 PageID# 475

CFAA (18 U.S.C. § 1030), the DMCA {17 U.S.C. § 1201), the Lanham Act (15 U.S.C. §§ 1114,

1116, 1125), the RICO Act (18 U.S.C. § 1962(c)), and the common law of trespass to chattels and

tortious interference.

2. There is good cause to believe that Defendants have engaged in and are likely to

engage in acts or practices that violate the CFAA (18 U.S.C. § 1030), the DMCA (17 U.S.C.

§ 1201), the Lanham Act (15 U.S.C. §§ 1114, 1116, 1125), the RICO Act (18 U.S.C. § 1962(c)),

and constitute trespass to chattels and tortious interference, and that Microsoft is, therefore, likely

to prevail on the merits of this action;

3. Microsoft has registered trademarks representing the quality of its products and

services and its brand, including the Microsoft® and Azure® marks.

4. There is good cause to believe that, unless Defendants are restrained and enjoined

by Order of this Court, immediate and irreparable harm will result from the Defendants' ongoing

violations.

5. There is good cause to believe that immediate and irreparable damage to this Court's

ability to grant effective final relief will result from the destruction or concealment of other

discoverable evidence of Defendants' misconduct if Defendants receive advance notice of this

action. Based on the evidence cited in Microsoft's TRO Application and accompanying

declarations and exhibits, Plaintiff is likely to be able to prove that:

a. Defendants are engaged in activities that directly violate United States law and

harm Plaintiff and the public, including Plaintiff’s customers;

b. Defendants have continued their unlawful conduct despite the clear injury to the

foregoing interests; and

c. Defendants are likely to delete or relocate evidence and/or to warn their associates

engaged in such activities if informed of Plaintiff’s action.

6. Plaintiff’s request for this emergency ex parte relief is not the result of any lack of

diligence on Plaintiff's part, but instead based upon the nature of Defendants' unlawful conduct.

Therefore, in accordance with Fed. R. Civ. P. 6S(b), IS U.S.C. § 1116(a) and 28 U.S.C. § 1651

(a), good cause and the interest of justice require that this Order be Granted without prior notice

to Defendants, and accordingly, Plaintiff is relieved of the duty to provide Defendants with prior

notice of Microsoft's motion;

7. There is good cause to believe that Defendants have specifically directed their

activities to computers located in the Eastern District of Virginia.

8. There is good cause to believe that Defendants will use the domain “aitism.net” and

its subdomains to direct malicious communications to Microsoft's computers to further perpetrate

their fraud on Plaintiff and its customers.

9. There is good cause to believe that Defendants have engaged in illegal activity by

using the aitism.net domain as described in Microsoft's TRO papers.

10. There is good cause to believe that to immediately halt the injury caused by

Defendants, Defendants must be prohibited from sending malicious communications to

Microsoft's computers and networks.

11. There is good cause to believe that to immediately halt the injury caused by

Defendants, the execution of this Order should be carried out in a prompt and coordinated manner

by Plaintiff and by the domain registry for "aitism.net" within a reasonable time after the registry

receives notice of this order.

12. There is good cause to permit notice of the instant Order notice of the Preliminary

Injunction hearing and service of the Complaint by formal and alternative means, given the

exigency of the circumstances and the need for prompt relief. The following means of service are

authorized by law, satisfy Due Process, satisfy Fed. R. Civ. P. 4(f)(3), and are reasonably

calculated to notify Defendants of the instant order, the Preliminary Injunction hearing and of this

action: ( l) by personal delivery upon Defendants who provided accurate contact information in

the U.S., if any, (2) transmission by email, facsimile, mail and/or personal delivery to the contact

information provided by Defendants to their domain registrars and hosting companies and as

agreed to by Defendants in their domain registration and/or hosting agreements, and (3) publishing

notice on a publicly available Internet websites where Defendants are believed to operate.

TEMPORARY RESTRAINING ORDER AND ORDER TO SHOW CAUSE

IT IS THEREFORE ORDERED that, Defendants, their representatives, and persons

who are in active concert or participation with them are temporarily restrained and enjoined from:

(1) accessing without authorization the computers or software comprising Microsoft’s Azure

OpenAI Service, (2) sending malicious code to configure, deploy or operate the Azure Abuse

Enterprise, (3) generating and sending harmful images bearing false indicia of sponsorship or

approval by Microsoft; and (4) stealing information, money, or property from Plaintiff or Plaintiff's

customers.

IT IS FURTHER ORDERED that, with respect to any currently registered Internet

domains used by Defendants to conduct the Azure Abuse Enterprise, the domain registries located

in the United States shall take the following actions:

A. Maintain unchanged the WHOIS or similar contact and identifying information as

of the time of receipt of this Order and maintain the domains with the current registrar;
Case 1:24-cv-02323-MSN-WEF Document 29 Filed 12/30/24 Page 5 of 6 PageID# 478

B. The domains shall remain active and continue to resolve in the manner set forth in

this Order;

C. Prevent transfer or modification of the domains by Defendants or third parties at the

registrar;

D. The domains shall be redirected to secure servers by changing the authoritative

name servers to NS9.microsoftintemetsafety.net, NSI0.microsoftintemetsafety.net, or such other

name servers identified by Microsoft as may be necessary, and taking other reasonable steps to

work with Microsoft to ensure the redirection of the domains and to ensure that Defendants cannot

use them;

E. Take all steps required to propagate the foregoing changes through the DNS,

including domain registrars;

F. Preserve all evidence that may be used to identify the Defendants using the

domains; and

G. Refrain from providing any notice or warning to, or communicating in any way

with Defendants or Defendants' representatives and refrain from publicizing this Order until this

Order is executed in full, except as necessary to communicate with domain registrars and registries

to execute this order.

IT IS FURTHER ORDERED that copies of this Order, notice of the Preliminary

Injunction hearing, and service of the Complaint may be served by any means authorized by law,

including (1) by personal delivery upon Defendants who provided accurate contact information in

the U.S., if any; (2) transmission by email, facsimile, mail and/or personal delivery to the contact

information provided by Defendants to their domain registrars and/or hosting companies and as
Case 1:24-cv-02323-MSN-WEF Document 29 Filed 12/30/24 Page 6 of 6 PageID# 479

agreed to by Defendants in their domain registration and/or hosting agreements, and (3) publishing

notice on a publicly available Internet Website where Defendant’s are believed to operate.

IT IS FURTHER ORDERED, pursuant to Fed. R. Civ. P. 65(b) that the Defendants shall

appear before this Court on January 10, 2024, at 10 a.m. to show cause, if there is any, why this

Court should not enter a Preliminary Injunction, pending final ruling on the Complaint against the

Defendants, enjoining them from the conduct temporarily restrained by the preceding provisions

of this Order.

IT IS FURTHER ORDERED that Microsoft shall post a bond in the amount of $25,000

pursuant to Fed. R. Civ. P. 65(c), to be deposited by the Clerk in a non-interest-bearing account.

IT IS FURTHER ORDERED that the Defendants shall file with the Court and serve on

Plaintiff’s counsel any answering affidavits, pleadings, motions, expert reports or declarations,

and/or legal memoranda no later than two (2) days prior to the hearing on Microsoft’s request for

a preliminary injunction. Plaintiff may file responsive or supplemental pleadings, materials,

affidavits, or memoranda with the Court and serve the same on counsel for the Defendants no later

than one (1) day prior to the preliminary injunction hearing in this matter, provided that service

shall be performed by personal or overnight delivery, facsimile or electronic mail, and documents

shall be delivered so that they shall be received by the other parties no later than 4:00 p.m. (Eastern

Standard Time) on the appropriate dates listed in this paragraph.

IT IS SO ORDERED.

/s/
Hon. Michael S. Nachmanoff
United States District Judge

December 30, 2024