Opinion

UNITED STATES DISTRICT COURT 6/26/2026

FOR THE SOUTHERN DISTRICT OF NEW YORK

GOOGLE LLC,

Plaintiff, Civil Action No.: 26-cv-4982-VM

v.

DOES 1–25,

Defendants.

ORDER GRANTING PRELIMINARY INJUNCTION

Plaintiff Google LLC has filed a Complaint for injunctive and other relief to stop Doe

Defendants 1–25, a criminal enterprise (the “Outsider Enterprise” or “Enterprise”), from using a

software suite called “Outsider” to facilitate widespread phishing attacks that have harmed and

continue to harm over 100,000 victims and numerous businesses, including Google.

Google filed a Complaint alleging claims under (1) the Racketeer Influenced and Corrupt

Organizations Act (“RICO”), 18 U.S.C. § 1962(c)–(d) (Count I); and (2) the Lanham Act,

15 U.S.C. §§ 1114(1), 1125(a)(1)(A), 1125(a)(1)(B) (Count II). Google moved ex parte for a

temporary restraining order and an order to show cause why a preliminary injunction should not

issue under Federal Rule of Civil Procedure 65 and 28 U.S.C. § 1651.

On June 12, 2026, this Court issued a Temporary Restraining Order (“TRO”) and order for

Defendants to show cause why a preliminary injunction should not issue.

THE COURT HEREBY FINDS THAT:

1. This Court has federal-question jurisdiction over Google’s claims under RICO and

the Lanham Act pursuant to 28 U.S.C. § 1331.

2. This Court has personal jurisdiction over Defendants because:

a. Defendants have intentionally targeted and harmed Google, a company based in the

United States. Defendants had knowledge that their actions would cause harm to

victims in New York and cause Google harm in New York. Google does business

in New York and has done business in New York for many years, including in this

District.

b. Defendants have created fake websites mimicking the New York E-ZPass website

and the New York City government’s website for use in phishing schemes.

c. Defendants have affirmatively directed actions at the United States, including this

District, and Defendants have attempted to phish and have successfully phished

personal and financial information from victims within this District and New York

State.

d. Defendants have used Google’s trademarks as part of fake websites used to solicit

victims’ personal and financial information within this District and New York

State, and have directed multiple forms of electronic communication to user devices

in this District and New York State.

3. Venue is proper in this District under 28 U.S.C. § 1391(c)(3) because Defendants

are not residents of the United States and may therefore be sued in any judicial district. Venue is

also proper in this District under 28 U.S.C. § 1391(b)(2) and 18 U.S.C. § 1965(a) because a

substantial part of the events or omissions giving rise to Google’s claims occurred in this District,

because a substantial part of the harm caused by Defendants has occurred in this District, and

because Defendants transact their affairs in this District. Moreover, Defendants are subject to

personal jurisdiction in this District, and no other venue appears to be more appropriate.

4. The Complaint pleads facts with the specificity required by the Federal Rules of

Civil Procedure and states claims against Defendants for violations of (1) RICO, 18 U.S.C.

§ 1962(c)–(d) (Count I); and (2) the Lanham Act, 15 U.S.C. §§ 1114(1), 1125(a)(1)(A),

1125(a)(1)(B) (Count II).

Preliminary Injunction Factors

5. The Court finds that Google has established each of the factors required for a

preliminary injunction: (1) irreparable harm; (2) a likelihood of success on the merits and/or

sufficiently serious questions as to the merits; (3) the balance of equities tips in Google’s favor;

and (4) a preliminary injunction serves the public interest. See Benihana, Inc. v. Benihana of Tokyo,

LLC, 784 F.3d 887, 895 (2d Cir. 2015); see also Sterling v. Deutsche Bank Nat’l Tr. Co. as Trustees

for Femit Tr. 2006-FF6, 368 F. Supp. 3d 723, 727 (S.D.N.Y. 2019) (“The standard[s] for granting

a temporary restraining order and a preliminary injunction pursuant to Rule 65 of the Federal Rules

of [Civil] Procedure are identical.”).

Irreparable Harm

6. Google has established that it will suffer immediate, irreparable harm if this Court

denies its request for a preliminary injunction. Google has shown that Defendants—through their

operation of the Outsider Enterprise to participate in and carry out numerous criminal phishing

scams (the “Outsider Schemes”)—have threatened the security of the Internet by using phishing

attacks to steal personal and financial information, defrauding unsuspecting targets, impairing

Google’s reputation and goodwill, and causing Google (and numerous others) unrecoverable

financial losses. Until the Outsider Schemes are disrupted, the Outsider Enterprise will continue

to profit from its unlawful activities at the expense of Google and an ever-increasing number of

victims.

7. Defendants’ conduct is injuring Google’s goodwill and damaging its reputation by

falsely associating Google with fraud perpetrated by the Outsider Enterprise, and injuries to

goodwill and reputation constitute irreparable harm. Google has suffered and continues to suffer

economic losses from the Outsider Schemes because Google has expended (and continues to

expend) substantial financial resources in developing strong brand recognition associated with its

name, logos, and products, investigating and combatting the Outsider Schemes, and identifying

measures necessary to remediate the harms caused by the Outsider Schemes. These injuries

constitute irreparable harm, including because Google has shown a likelihood that Defendants

would avoid complying with any judgment.

Likelihood of Success on the Merits

8. Google has demonstrated that its Complaint presents a sufficiently serious question

as to each of its claims and that it is likely to succeed on the merits of its claims. Sterling, 368

F.Supp. 3d at 727.

9. RICO. Google has shown a likelihood of success on the merits of its claim that

Defendants have violated and continue to violate the RICO statute, and that Defendants engaged

in a RICO conspiracy.

a. Google has shown that Defendants are active participants in the operation and

management of the Outsider Enterprise, which uses Outsider to dupe over 100,000

people into clicking malicious links leading to fraudulent websites as part of

phishing schemes.

b. Google has established that Defendants constitute an enterprise. Defendants are

associated-in-fact and share a common purpose to execute phishing schemes to

fraudulently obtain sensitive financial information and login credentials for profit.

Defendants collaborate to establish, grow, and manage the Outsider Enterprise and

execute the Outsider Schemes, each playing a role to fulfill their common purpose.

Some Enterprise members develop the Outsider software, others market and

advertise the Outsider software, others use the Outsider software to develop

fraudulent websites, others sell stolen information or launder stolen money, and

others provide strategic guidance and tactical support.

c. Google has established that Defendants have engaged in a pattern of racketeering

activity. See 18 U.S.C. § 1961(1), (5). The predicate acts include violations of the

federal wire fraud statute, 18 U.S.C. § 1343. Defendants have, with intent to defraud

and obtain money or property by means of false or fraudulent pretenses, committed

wire fraud and continue to commit wire fraud by transmitting signals in interstate

or foreign commerce for the purpose of executing their various fraudulent schemes,

in violation of 18 U.S.C. § 1343.

d. Google has suffered injury to its business or property as a result of this predicate

offense. Google’s brand value and goodwill are harmed every time a fraudulent

website uses a Google Mark to falsely indicate trustworthiness to a phishing victim.

Google has been further harmed by devoting substantial financial resources to

investigate and combat Defendants’ criminal schemes in order to protect its

goodwill and reputation.

e. Google has demonstrated that Defendants have engaged in a RICO conspiracy. The

links among the Defendants—such as using the Outsider software, chats from the

Telegram channels, and the methods for coordinating and deploying widespread

phishing schemes—demonstrate that the Enterprise formed an agreement as part of

a common scheme and conspiracy.

10. Lanham Act. Google has shown a likelihood of success on the merits of its claim

that Defendants violated and continue to violate the Lanham Act. Section 1114 prohibits

infringement of a registered trademark or service mark. Infringement occurs when a valid,

protectable mark is used in commerce and is likely to cause confusion, to cause mistake, or to

deceive. See 15 U.S.C. § 1114(1); Virgin Enters. Ltd. v. Nawab, 335 F.3d 141, 146 (2d Cir. 2003).

Defendants violated this provision by exploiting Google’s trustworthy, well-known, valid,

protectable, and registered Marks on their fake websites to deceive consumers. Section 1125(a)

prohibits false “designations of origin” that are likely to cause confusion as to the sponsorship of

a product or service. 15 U.S.C. § 1125(a)(1)(A). A claim under section 1125(a)(1)(A) has the same

elements as a claim under section 1114(1) and can be established with the same evidence, see

Victorinox AG v. B & F System, Inc., 114 F. Supp. 3d 132, 139 (S.D.N.Y. 2015), so Google’s

section 1125(a)(1)(A) claim is likely to succeed for the same reasons. Section 1125(a) also

prohibits false advertising. 15 U.S.C. § 1125(a)(1)(B). To qualify as false advertising, a

representation must (1) be false, (2) be material, (3) be placed in interstate commerce, and (4) have

caused injury to the plaintiff. Church & Dwight Co. v. SPD Swiss Precision Diagnostics, GmBH,

843 F.3d 48, 65 (2d Cir. 2016). Google has demonstrated that Defendants deceive Internet users

by using Google’s Marks on their fake websites. Google has shown that the representations are

literally false because they are not from or endorsed by Google, and that the representations are

material because the Defendants’ schemes are successful precisely because their websites appear

to be real. The messages bearing Google’s Marks are placed in interstate commerce on the Internet,

and Google has demonstrated injury to its goodwill and through costs to identify and combat the

Outsider Schemes. Google is thus likely to succeed on the merits of its Lanham Act claims.

Balance of Hardships

11. The equities favor a preliminary injunction. The Outsider Enterprise is defrauding

consumers, is injuring Google, and continues to victimize more people every day. No

countervailing factors weigh against a preliminary injunction. There is no legitimate reason why

Defendants should be permitted to continue to weaponize Google’s branding to defraud the public

and commit cybercrimes.

Public Interest

12. Google has shown that the public interest favors granting a preliminary injunction.

13. The Outsider Enterprise has defrauded more than 100,000 victims. Every day that

passes, Defendants deceive new unsuspecting victims. Protection from malicious cyberattacks and

other cybercrimes is clearly in the public interest.

14. The public interest is also served by enforcing statutes designed to protect the

public, including RICO and the Lanham Act.

Good Cause for Alternative Service

15. The Court finds that good cause exists to grant alternative service, including service

of process, in this matter by email using any information available from registrars or web-hosting

companies provided in connection with domain names and/or IP addresses used in connection with

the Outsider Schemes or identified by Google in its investigation; website publication; and/or other

means, because Google has established that traditional service methods would be futile. Moreover,

Google has exercised reasonable diligence in attempting to discover physical addresses for service

of process and was unsuccessful in doing so. Accordingly, because Defendants’ service addresses

are unknown, the Hague Convention’s rules governing service of process do not apply. Given the

online and international nature of Defendants’ conduct, online alternative service is likely to be

the most accurate and viable means to give Defendants notice of the filings pertaining to this

lawsuit.

PRELIMINARY INJUNCTION ORDER

16. IT IS HEREBY ORDERED that Defendants, any of their officers, agents,

servants, employees, or attorneys, and all others in active concert or participation with them, who

receive actual notice of this Order by personal service or otherwise (“Restrained Parties”), are

preliminarily restrained and enjoined, from, anywhere in the world:

a. Using, linking to, transferring, selling, exercising control over, or otherwise owning

or accessing Outsider or the Internet domains, IP addresses, and other network

identifiers through which the Outsider Enterprise perpetrates its schemes, set forth

in Appendix A to the NAXO Declaration in Support of Plaintiff’s Motion for an

Ex Parte Temporary Restraining Order and Order to Show Cause (“Appendix A”);

b. Sending messages or advertisements with links to malicious websites;

c. Engaging in phishing schemes;

d. Stealing or selling credentials from victims of phishing schemes;

e. Monitoring the activities of Google or Google’s customers or stealing information

from them;

f. Impersonating Google, its systems, products, and services;

g. Encouraging, directing, or instructing Enterprise members to use Google products,

such as Gemini, as a means to further the Enterprise’s unlawful schemes including

but not limited to utilizing Google products to generate websites;

h. Creating websites that falsely indicate that they are associated with Google,

YouTube, Google Pay, Google Play, or any other Google product or affiliate,

through use of Google’s trademarks and/or other false and/or misleading

representations;

i. Misappropriating that which rightfully belongs to Google, Google’s customers and

users, or in which Google has a proprietary interest;

j. Configuring, deploying, operating, or otherwise participating in or facilitating the

Outsider Schemes described in the moving papers, including but not limited to

through the Internet domain names and/or IP addresses listed in Appendix A and

through any other component or element of Defendants’ illegal infrastructure in

any location, including infrastructure Defendants may attempt to rebuild;

k. Delivering malicious code designed to steal credentials;

l. Selling access to the accounts of Google’s customers;

m. Offering, promoting, or selling victims’ credit cards or other financial information

to others for use;

n. Using, transferring, exercising control over, or accessing any accounts used in the

transfer of money or electronic currency, including cryptocurrency, or in the

processing of card-based transactions, as a means to further Defendants’ unlawful

schemes; and/or

o. Undertaking any similar activity that inflicts harm on Google, Google’s customers

or users, or the public.

17. Upon service as provided for in this Order, Defendants and other Restrained Parties

shall be deemed to have actual notice of the issuance and terms of the Order, and any act by any

of the Restrained Parties in violation of any of the terms of the Order may be considered and

prosecuted as contempt of court.

18. The Clerk of the Court is to issue a summons to Defendants Does 1–25 for Google

to serve on Defendants.

19. IT IS FURTHER ORDERED that the Restrained Parties are preliminarily

restrained and enjoined from:

a. Using Google’s trademarks, including but not limited to Plaintiff’s YouTube and

YouTube design marks (including RN: 3525802, 5581035), Google Play mark

(including RN: 5570801), Google Play & Design mark (including RN: 5628029),

Google Pay mark (including RN: 5708685), and G Pay & Design mark (including

RN: 6067711), and/or other trademarks, trade names, service marks, or Internet

domain addresses or names containing or infringing such trademarks, trade names

or service marks, as set forth in Appendix D to the Google Declaration in Support

of Plaintiff’s Motion for an Ex Parte Temporary Restraining Order and Order to

Show Cause, which contains Google’s trademarks, trade names, service marks, or

Internet domain addresses or names containing or infringing such trademarks, trade

names or service marks, or other intellectual property infringed as a result of

Defendants’ activities;

b. Using, in connection with Defendants’ activities, products or services with any false

or deceptive designation, representations, or descriptions of Defendants or of their

activities, whether by symbols, words, designs, or statements, which would damage

or injure Google or its customers or users, or would give Defendants an unfair

competitive advantage or result in deception of consumers; and

c. Acting in any other manner that suggests in any way that Defendants’ activities,

products, or services come from or are somehow sponsored by or affiliated with

Google, or passing off Defendants’ activities, products, or services as Google’s.

20. IT IS FURTHER ORDERED that, pursuant to the All Writs Act, Google may

serve this Order on the persons or entities hosting or providing services, including domain

registries such as Verisign, Inc., related to the domains and/or IP addresses identified in

Appendix A or any domains or IP addresses identified by Google pursuant to this Order in the

future, requesting that those persons or entities implement the following actions:

a. Take reasonable steps to identify incoming and/or outgoing Internet traffic on their

respective networks that originates or is being sent from or to any IP addresses

identified in Appendix A or any domains and/or IP addresses identified by Google

pursuant to this Order in the future;

b. Within three (3) business days of receipt of this Order, or as soon as practicable,

take reasonable steps to block and/or disrupt access to incoming and/or outgoing

Internet traffic or communications on their respective networks that originates

and/or is being sent from or to the domains and/or IP addresses identified in

Appendix A, or any domains and/or IP addresses identified by Google pursuant to

this Order in the future, by Defendants or Defendants’ representatives or resellers,

except as explicitly provided for in this Order;

c. Take reasonable steps to block incoming and/or outgoing Internet traffic on their

respective networks that originates and/or is being sent from or to the domains

and/or IP addresses identified in Appendix A or any domains and/or IP addresses

identified by Google pursuant to this Order in the future, by Defendants or

Defendants’ representatives or resellers, except as explicitly provided for in this

Order;

d. Take other reasonable steps to block and/or disrupt access of such traffic to and/or

from any other IP addresses, domains, or Internet channels to which Defendants

may move the Outsider infrastructure, including those identified by Google

pursuant to this Order in the future, to ensure that Defendants cannot use such

infrastructure to facilitate and expand the use of Outsider or continue to perpetrate

illegal acts;

e. Make the software and/or data assigned to or otherwise associated with the domains

and/or IP addresses set forth in Appendix A or any domains and/or IP addresses

identified by Google pursuant to this Order in the future inaccessible from any other

computer on the Internet, any internal network, or in any other manner, to

Defendants, Defendants’ representatives, and all other persons, except as otherwise

ordered herein;

f. Completely, and until further order of this Court, suspend all services to Defendants

or Defendants’ representatives or resellers associated with the domains and/or IP

addresses set forth in Appendix A or any domains and/or IP addresses identified by

Google pursuant to this Order in the future;

g. Should a provider identify any content and/or software hosted at an IP address listed

in Appendix A or any domains and/or IP addresses identified by Google pursuant

to this Order in the future that it reasonably believes is not associated with

Defendants, the provider shall preserve any such content and/or software; and

contact Google’s counsel, Laura Harris at King & Spalding LLP, 1290 Avenue of

the Americas, 14th Floor, New York, New York 10104-0101, and

lharris@kslaw.com, within one (1) business day;

h. Refrain from providing any notice or warning to, or communicating in any way

with Defendants or Defendants’ representatives, and refrain from publicizing this

Order until the steps required by this Order are executed in full, except as necessary

to communicate with registries, registrars, hosting companies, data centers, Google,

or other ISPs to execute this Order;

i. Not enable, and take all reasonable steps to prevent, any circumvention of this

Order by Defendants or Defendants’ representatives associated with the domains

and/or IP addresses listed in Appendix A or any domains and/or IP addresses

identified by Google pursuant to this Order in the future, including without

limitation enabling, facilitating, and/or allowing Defendants or Defendants’

representatives or resellers to rent, lease, purchase, or otherwise obtain other

services associated with those domains and/or IP addresses;

j. Preserve, retain, and produce to Google all documents and information sufficient

to identify and contact Defendants and Defendants’ representatives operating or

controlling the domains and/or IP addresses set forth in Appendix A or any domains

and/or IP addresses identified by Google pursuant to this Order in the future,

including any and all individual or entity names, mailing addresses, e-mail

addresses, facsimile numbers, telephone numbers, or similar contact information,

including but not limited to such contact information reflected in billing, usage,

access, and contact records and all records, documents, and logs associated with the

use of or access to such domains and/or IP addresses;

k. Provide reasonable assistance in implementing the terms of this Order and take no

action to frustrate the implementation of this Order; and

l. Completely preserve any and all data or media assigned to or otherwise associated

with the domain names and/or IP addresses set forth in Appendix A or any domains

and/or IP addresses identified by Google pursuant to this Order in the future, and

preserve all evidence of any kind related to the content, data, software, or accounts

associated with such domains and/or IP addresses.

m. In determining the method and mechanism to disable content and software

associated with Defendants, the relevant persons and/or entities shall reasonably

confer with Plaintiff’s counsel of record in this action.

21. IT IS FURTHER ORDERED that Google may amend Appendix A if it identifies

other domains and/or IP addresses used by Defendants in connection with the Outsider Enterprise,

including any such domains and/or IP addresses that might not yet exist, without further order of

this Court.

22. IT IS FURTHER ORDERED that, good cause having been shown, Google may

effectuate service using alternative service, including service of process, by electronic means—

including by email using any information available from web-hosting companies provided in

connection with domain names used in the Outsider Schemes or identified by Google in its

investigation; website publication; and/or other means ordered herein. Alternative service by

email, website publication, and/or other means ordered herein shall be deemed effective as to

Defendants through the pendency of this action.

Security for Preliminary Injunction Order

23. IT IS FURTHER ORDERED that Google’s submission of $75,000 bond to the

Clerk satisfied the requirements of this Court’s TRO. No additional bond is necessary.

So ordered.

Date: June 26, 2026

New York, New York