# Opinion

> District Court, S.D. New York · June 26, 2026

URL: https://www.frixlaw.com/law-library/cases/11392288

## Case

- **Full name:** Google LLC v. Does 1–25
- **Court:** District Court, S.D. New York
- **Decided:** June 26, 2026
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/11392288

## Opinion text

UNITED STATES DISTRICT COURT 6/26/2026
FOR THE SOUTHERN DISTRICT OF NEW YORK
GOOGLE LLC,
Plaintiff, Civil Action No.: 26-cv-4982-VM
v.

DOES 1–25,
Defendants.
ORDER GRANTING PRELIMINARY INJUNCTION
Plaintiff Google LLC has filed a Complaint for injunctive and other relief to stop Doe

Defendants 1–25, a criminal enterprise (the “Outsider Enterprise” or “Enterprise”), from using a
software suite called “Outsider” to facilitate widespread phishing attacks that have harmed and
continue to harm over 100,000 victims and numerous businesses, including Google.
Google filed a Complaint alleging claims under (1) the Racketeer Influenced and Corrupt
Organizations Act (“RICO”), 18 U.S.C. § 1962(c)–(d) (Count I); and (2) the Lanham Act,
15 U.S.C. §§ 1114(1), 1125(a)(1)(A), 1125(a)(1)(B) (Count II). Google moved ex parte for a
temporary restraining order and an order to show cause why a preliminary injunction should not
issue under Federal Rule of Civil Procedure 65 and 28 U.S.C. § 1651.
On June 12, 2026, this Court issued a Temporary Restraining Order (“TRO”) and order for
Defendants to show cause why a preliminary injunction should not issue.
THE COURT HEREBY FINDS THAT:

1. This Court has federal-question jurisdiction over Google’s claims under RICO and
the Lanham Act pursuant to 28 U.S.C. § 1331.
2. This Court has personal jurisdiction over Defendants because:
a. Defendants have intentionally targeted and harmed Google, a company based in the
United States. Defendants had knowledge that their actions would cause harm to
victims in New York and cause Google harm in New York. Google does business
in New York and has done business in New York for many years, including in this
District.

b. Defendants have created fake websites mimicking the New York E-ZPass website
and the New York City government’s website for use in phishing schemes.
c. Defendants have affirmatively directed actions at the United States, including this
District, and Defendants have attempted to phish and have successfully phished
personal and financial information from victims within this District and New York
State.
d. Defendants have used Google’s trademarks as part of fake websites used to solicit
victims’ personal and financial information within this District and New York
State, and have directed multiple forms of electronic communication to user devices

in this District and New York State.
3. Venue is proper in this District under 28 U.S.C. § 1391(c)(3) because Defendants
are not residents of the United States and may therefore be sued in any judicial district. Venue is
also proper in this District under 28 U.S.C. § 1391(b)(2) and 18 U.S.C. § 1965(a) because a
substantial part of the events or omissions giving rise to Google’s claims occurred in this District,
because a substantial part of the harm caused by Defendants has occurred in this District, and
because Defendants transact their affairs in this District. Moreover, Defendants are subject to
personal jurisdiction in this District, and no other venue appears to be more appropriate.
4. The Complaint pleads facts with the specificity required by the Federal Rules of
Civil Procedure and states claims against Defendants for violations of (1) RICO, 18 U.S.C.
§ 1962(c)–(d) (Count I); and (2) the Lanham Act, 15 U.S.C. §§ 1114(1), 1125(a)(1)(A),
1125(a)(1)(B) (Count II).
Preliminary Injunction Factors

5. The Court finds that Google has established each of the factors required for a
preliminary injunction: (1) irreparable harm; (2) a likelihood of success on the merits and/or
sufficiently serious questions as to the merits; (3) the balance of equities tips in Google’s favor;
and (4) a preliminary injunction serves the public interest. See Benihana, Inc. v. Benihana of Tokyo,
LLC, 784 F.3d 887, 895 (2d Cir. 2015); see also Sterling v. Deutsche Bank Nat’l Tr. Co. as Trustees
for Femit Tr. 2006-FF6, 368 F. Supp. 3d 723, 727 (S.D.N.Y. 2019) (“The standard[s] for granting
a temporary restraining order and a preliminary injunction pursuant to Rule 65 of the Federal Rules
of [Civil] Procedure are identical.”).
Irreparable Harm

6. Google has established that it will suffer immediate, irreparable harm if this Court
denies its request for a preliminary injunction. Google has shown that Defendants—through their
operation of the Outsider Enterprise to participate in and carry out numerous criminal phishing
scams (the “Outsider Schemes”)—have threatened the security of the Internet by using phishing
attacks to steal personal and financial information, defrauding unsuspecting targets, impairing
Google’s reputation and goodwill, and causing Google (and numerous others) unrecoverable
financial losses. Until the Outsider Schemes are disrupted, the Outsider Enterprise will continue
to profit from its unlawful activities at the expense of Google and an ever-increasing number of
victims.
7. Defendants’ conduct is injuring Google’s goodwill and damaging its reputation by
falsely associating Google with fraud perpetrated by the Outsider Enterprise, and injuries to
goodwill and reputation constitute irreparable harm. Google has suffered and continues to suffer
economic losses from the Outsider Schemes because Google has expended (and continues to
expend) substantial financial resources in developing strong brand recognition associated with its

name, logos, and products, investigating and combatting the Outsider Schemes, and identifying
measures necessary to remediate the harms caused by the Outsider Schemes. These injuries
constitute irreparable harm, including because Google has shown a likelihood that Defendants
would avoid complying with any judgment.
Likelihood of Success on the Merits
8. Google has demonstrated that its Complaint presents a sufficiently serious question
as to each of its claims and that it is likely to succeed on the merits of its claims. Sterling, 368
F.Supp. 3d at 727.
9. RICO. Google has shown a likelihood of success on the merits of its claim that

Defendants have violated and continue to violate the RICO statute, and that Defendants engaged
in a RICO conspiracy.
a. Google has shown that Defendants are active participants in the operation and
management of the Outsider Enterprise, which uses Outsider to dupe over 100,000
people into clicking malicious links leading to fraudulent websites as part of
phishing schemes.
b. Google has established that Defendants constitute an enterprise. Defendants are
associated-in-fact and share a common purpose to execute phishing schemes to
fraudulently obtain sensitive financial information and login credentials for profit.
Defendants collaborate to establish, grow, and manage the Outsider Enterprise and
execute the Outsider Schemes, each playing a role to fulfill their common purpose.
Some Enterprise members develop the Outsider software, others market and
advertise the Outsider software, others use the Outsider software to develop
fraudulent websites, others sell stolen information or launder stolen money, and

others provide strategic guidance and tactical support.
c. Google has established that Defendants have engaged in a pattern of racketeering
activity. See 18 U.S.C. § 1961(1), (5). The predicate acts include violations of the
federal wire fraud statute, 18 U.S.C. § 1343. Defendants have, with intent to defraud
and obtain money or property by means of false or fraudulent pretenses, committed
wire fraud and continue to commit wire fraud by transmitting signals in interstate
or foreign commerce for the purpose of executing their various fraudulent schemes,
in violation of 18 U.S.C. § 1343.
d. Google has suffered injury to its business or property as a result of this predicate

offense. Google’s brand value and goodwill are harmed every time a fraudulent
website uses a Google Mark to falsely indicate trustworthiness to a phishing victim.
Google has been further harmed by devoting substantial financial resources to
investigate and combat Defendants’ criminal schemes in order to protect its
goodwill and reputation.
e. Google has demonstrated that Defendants have engaged in a RICO conspiracy. The
links among the Defendants—such as using the Outsider software, chats from the
Telegram channels, and the methods for coordinating and deploying widespread
phishing schemes—demonstrate that the Enterprise formed an agreement as part of
a common scheme and conspiracy.
10. Lanham Act. Google has shown a likelihood of success on the merits of its claim
that Defendants violated and continue to violate the Lanham Act. Section 1114 prohibits
infringement of a registered trademark or service mark. Infringement occurs when a valid,

protectable mark is used in commerce and is likely to cause confusion, to cause mistake, or to
deceive. See 15 U.S.C. § 1114(1); Virgin Enters. Ltd. v. Nawab, 335 F.3d 141, 146 (2d Cir. 2003).
Defendants violated this provision by exploiting Google’s trustworthy, well-known, valid,
protectable, and registered Marks on their fake websites to deceive consumers. Section 1125(a)
prohibits false “designations of origin” that are likely to cause confusion as to the sponsorship of
a product or service. 15 U.S.C. § 1125(a)(1)(A). A claim under section 1125(a)(1)(A) has the same
elements as a claim under section 1114(1) and can be established with the same evidence, see
Victorinox AG v. B & F System, Inc., 114 F. Supp. 3d 132, 139 (S.D.N.Y. 2015), so Google’s
section 1125(a)(1)(A) claim is likely to succeed for the same reasons. Section 1125(a) also

prohibits false advertising. 15 U.S.C. § 1125(a)(1)(B). To qualify as false advertising, a
representation must (1) be false, (2) be material, (3) be placed in interstate commerce, and (4) have
caused injury to the plaintiff. Church & Dwight Co. v. SPD Swiss Precision Diagnostics, GmBH,
843 F.3d 48, 65 (2d Cir. 2016). Google has demonstrated that Defendants deceive Internet users
by using Google’s Marks on their fake websites. Google has shown that the representations are
literally false because they are not from or endorsed by Google, and that the representations are
material because the Defendants’ schemes are successful precisely because their websites appear
to be real. The messages bearing Google’s Marks are placed in interstate commerce on the Internet,
and Google has demonstrated injury to its goodwill and through costs to identify and combat the
Outsider Schemes. Google is thus likely to succeed on the merits of its Lanham Act claims.
Balance of Hardships
11. The equities favor a preliminary injunction. The Outsider Enterprise is defrauding
consumers, is injuring Google, and continues to victimize more people every day. No

countervailing factors weigh against a preliminary injunction. There is no legitimate reason why
Defendants should be permitted to continue to weaponize Google’s branding to defraud the public
and commit cybercrimes.
Public Interest
12. Google has shown that the public interest favors granting a preliminary injunction.
13. The Outsider Enterprise has defrauded more than 100,000 victims. Every day that
passes, Defendants deceive new unsuspecting victims. Protection from malicious cyberattacks and
other cybercrimes is clearly in the public interest.
14. The public interest is also served by enforcing statutes designed to protect the

public, including RICO and the Lanham Act.
Good Cause for Alternative Service
15. The Court finds that good cause exists to grant alternative service, including service
of process, in this matter by email using any information available from registrars or web-hosting
companies provided in connection with domain names and/or IP addresses used in connection with
the Outsider Schemes or identified by Google in its investigation; website publication; and/or other
means, because Google has established that traditional service methods would be futile. Moreover,
Google has exercised reasonable diligence in attempting to discover physical addresses for service
of process and was unsuccessful in doing so. Accordingly, because Defendants’ service addresses
are unknown, the Hague Convention’s rules governing service of process do not apply. Given the
online and international nature of Defendants’ conduct, online alternative service is likely to be
the most accurate and viable means to give Defendants notice of the filings pertaining to this
lawsuit.
PRELIMINARY INJUNCTION ORDER

16. IT IS HEREBY ORDERED that Defendants, any of their officers, agents,
servants, employees, or attorneys, and all others in active concert or participation with them, who
receive actual notice of this Order by personal service or otherwise (“Restrained Parties”), are
preliminarily restrained and enjoined, from, anywhere in the world:
a. Using, linking to, transferring, selling, exercising control over, or otherwise owning
or accessing Outsider or the Internet domains, IP addresses, and other network
identifiers through which the Outsider Enterprise perpetrates its schemes, set forth
in Appendix A to the NAXO Declaration in Support of Plaintiff’s Motion for an
Ex Parte Temporary Restraining Order and Order to Show Cause (“Appendix A”);

b. Sending messages or advertisements with links to malicious websites;
c. Engaging in phishing schemes;
d. Stealing or selling credentials from victims of phishing schemes;
e. Monitoring the activities of Google or Google’s customers or stealing information
from them;
f. Impersonating Google, its systems, products, and services;
g. Encouraging, directing, or instructing Enterprise members to use Google products,
such as Gemini, as a means to further the Enterprise’s unlawful schemes including
but not limited to utilizing Google products to generate websites;
h. Creating websites that falsely indicate that they are associated with Google,
YouTube, Google Pay, Google Play, or any other Google product or affiliate,
through use of Google’s trademarks and/or other false and/or misleading
representations;
i. Misappropriating that which rightfully belongs to Google, Google’s customers and

users, or in which Google has a proprietary interest;
j. Configuring, deploying, operating, or otherwise participating in or facilitating the
Outsider Schemes described in the moving papers, including but not limited to
through the Internet domain names and/or IP addresses listed in Appendix A and
through any other component or element of Defendants’ illegal infrastructure in
any location, including infrastructure Defendants may attempt to rebuild;
k. Delivering malicious code designed to steal credentials;
l. Selling access to the accounts of Google’s customers;
m. Offering, promoting, or selling victims’ credit cards or other financial information

to others for use;
n. Using, transferring, exercising control over, or accessing any accounts used in the
transfer of money or electronic currency, including cryptocurrency, or in the
processing of card-based transactions, as a means to further Defendants’ unlawful
schemes; and/or
o. Undertaking any similar activity that inflicts harm on Google, Google’s customers
or users, or the public.
17. Upon service as provided for in this Order, Defendants and other Restrained Parties
shall be deemed to have actual notice of the issuance and terms of the Order, and any act by any
of the Restrained Parties in violation of any of the terms of the Order may be considered and
prosecuted as contempt of court.
18. The Clerk of the Court is to issue a summons to Defendants Does 1–25 for Google
to serve on Defendants.
19. IT IS FURTHER ORDERED that the Restrained Parties are preliminarily

restrained and enjoined from:
a. Using Google’s trademarks, including but not limited to Plaintiff’s YouTube and
YouTube design marks (including RN: 3525802, 5581035), Google Play mark
(including RN: 5570801), Google Play & Design mark (including RN: 5628029),
Google Pay mark (including RN: 5708685), and G Pay & Design mark (including
RN: 6067711), and/or other trademarks, trade names, service marks, or Internet
domain addresses or names containing or infringing such trademarks, trade names
or service marks, as set forth in Appendix D to the Google Declaration in Support
of Plaintiff’s Motion for an Ex Parte Temporary Restraining Order and Order to

Show Cause, which contains Google’s trademarks, trade names, service marks, or
Internet domain addresses or names containing or infringing such trademarks, trade
names or service marks, or other intellectual property infringed as a result of
Defendants’ activities;
b. Using, in connection with Defendants’ activities, products or services with any false
or deceptive designation, representations, or descriptions of Defendants or of their
activities, whether by symbols, words, designs, or statements, which would damage
or injure Google or its customers or users, or would give Defendants an unfair
competitive advantage or result in deception of consumers; and
c. Acting in any other manner that suggests in any way that Defendants’ activities,
products, or services come from or are somehow sponsored by or affiliated with
Google, or passing off Defendants’ activities, products, or services as Google’s.
20. IT IS FURTHER ORDERED that, pursuant to the All Writs Act, Google may
serve this Order on the persons or entities hosting or providing services, including domain

registries such as Verisign, Inc., related to the domains and/or IP addresses identified in
Appendix A or any domains or IP addresses identified by Google pursuant to this Order in the
future, requesting that those persons or entities implement the following actions:
a. Take reasonable steps to identify incoming and/or outgoing Internet traffic on their
respective networks that originates or is being sent from or to any IP addresses
identified in Appendix A or any domains and/or IP addresses identified by Google
pursuant to this Order in the future;
b. Within three (3) business days of receipt of this Order, or as soon as practicable,
take reasonable steps to block and/or disrupt access to incoming and/or outgoing

Internet traffic or communications on their respective networks that originates
and/or is being sent from or to the domains and/or IP addresses identified in
Appendix A, or any domains and/or IP addresses identified by Google pursuant to
this Order in the future, by Defendants or Defendants’ representatives or resellers,
except as explicitly provided for in this Order;
c. Take reasonable steps to block incoming and/or outgoing Internet traffic on their
respective networks that originates and/or is being sent from or to the domains
and/or IP addresses identified in Appendix A or any domains and/or IP addresses
identified by Google pursuant to this Order in the future, by Defendants or
Defendants’ representatives or resellers, except as explicitly provided for in this
Order;
d. Take other reasonable steps to block and/or disrupt access of such traffic to and/or
from any other IP addresses, domains, or Internet channels to which Defendants
may move the Outsider infrastructure, including those identified by Google

pursuant to this Order in the future, to ensure that Defendants cannot use such
infrastructure to facilitate and expand the use of Outsider or continue to perpetrate
illegal acts;
e. Make the software and/or data assigned to or otherwise associated with the domains
and/or IP addresses set forth in Appendix A or any domains and/or IP addresses
identified by Google pursuant to this Order in the future inaccessible from any other
computer on the Internet, any internal network, or in any other manner, to
Defendants, Defendants’ representatives, and all other persons, except as otherwise
ordered herein;

f. Completely, and until further order of this Court, suspend all services to Defendants
or Defendants’ representatives or resellers associated with the domains and/or IP
addresses set forth in Appendix A or any domains and/or IP addresses identified by
Google pursuant to this Order in the future;
g. Should a provider identify any content and/or software hosted at an IP address listed
in Appendix A or any domains and/or IP addresses identified by Google pursuant
to this Order in the future that it reasonably believes is not associated with
Defendants, the provider shall preserve any such content and/or software; and
contact Google’s counsel, Laura Harris at King & Spalding LLP, 1290 Avenue of
the Americas, 14th Floor, New York, New York 10104-0101, and
lharris@kslaw.com, within one (1) business day;
h. Refrain from providing any notice or warning to, or communicating in any way
with Defendants or Defendants’ representatives, and refrain from publicizing this
Order until the steps required by this Order are executed in full, except as necessary

to communicate with registries, registrars, hosting companies, data centers, Google,
or other ISPs to execute this Order;
i. Not enable, and take all reasonable steps to prevent, any circumvention of this
Order by Defendants or Defendants’ representatives associated with the domains
and/or IP addresses listed in Appendix A or any domains and/or IP addresses
identified by Google pursuant to this Order in the future, including without
limitation enabling, facilitating, and/or allowing Defendants or Defendants’
representatives or resellers to rent, lease, purchase, or otherwise obtain other
services associated with those domains and/or IP addresses;

j. Preserve, retain, and produce to Google all documents and information sufficient
to identify and contact Defendants and Defendants’ representatives operating or
controlling the domains and/or IP addresses set forth in Appendix A or any domains
and/or IP addresses identified by Google pursuant to this Order in the future,
including any and all individual or entity names, mailing addresses, e-mail
addresses, facsimile numbers, telephone numbers, or similar contact information,
including but not limited to such contact information reflected in billing, usage,
access, and contact records and all records, documents, and logs associated with the
use of or access to such domains and/or IP addresses;
k. Provide reasonable assistance in implementing the terms of this Order and take no
action to frustrate the implementation of this Order; and
l. Completely preserve any and all data or media assigned to or otherwise associated
with the domain names and/or IP addresses set forth in Appendix A or any domains
and/or IP addresses identified by Google pursuant to this Order in the future, and

preserve all evidence of any kind related to the content, data, software, or accounts
associated with such domains and/or IP addresses.
m. In determining the method and mechanism to disable content and software
associated with Defendants, the relevant persons and/or entities shall reasonably
confer with Plaintiff’s counsel of record in this action.
21. IT IS FURTHER ORDERED that Google may amend Appendix A if it identifies
other domains and/or IP addresses used by Defendants in connection with the Outsider Enterprise,
including any such domains and/or IP addresses that might not yet exist, without further order of
this Court.

22. IT IS FURTHER ORDERED that, good cause having been shown, Google may
effectuate service using alternative service, including service of process, by electronic means—
including by email using any information available from web-hosting companies provided in
connection with domain names used in the Outsider Schemes or identified by Google in its
investigation; website publication; and/or other means ordered herein. Alternative service by
email, website publication, and/or other means ordered herein shall be deemed effective as to
Defendants through the pendency of this action.
Security for Preliminary Injunction Order
23. IT IS FURTHER ORDERED that Google’s submission of $75,000 bond to the
Clerk satisfied the requirements of this Court’s TRO. No additional bond is necessary.
So ordered.

Date: June 26, 2026
New York, New York

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/11392288. Public record. Not legal advice.