UNITED STATES DISTRICT COURT 6/26/2026 FOR THE SOUTHERN DISTRICT OF NEW YORK GOOGLE LLC, Plaintiff, Civil Action No.: 26-cv-4982-VM v.
DOES 1–25, Defendants. ORDER GRANTING PRELIMINARY INJUNCTION Plaintiff Google LLC has filed a Complaint for injunctive and other relief to stop Doe
Defendants 1–25, a criminal enterprise (the “Outsider Enterprise” or “Enterprise”), from using a software suite called “Outsider” to facilitate widespread phishing attacks that have harmed and continue to harm over 100,000 victims and numerous businesses, including Google. Google filed a Complaint alleging claims under (1) the Racketeer Influenced and Corrupt Organizations Act (“RICO”), 18 U.S.C. § 1962(c)–(d) (Count I); and (2) the Lanham Act, 15 U.S.C. §§ 1114(1), 1125(a)(1)(A), 1125(a)(1)(B) (Count II). Google moved ex parte for a temporary restraining order and an order to show cause why a preliminary injunction should not issue under Federal Rule of Civil Procedure 65 and 28 U.S.C. § 1651. On June 12, 2026, this Court issued a Temporary Restraining Order (“TRO”) and order for Defendants to show cause why a preliminary injunction should not issue. THE COURT HEREBY FINDS THAT:
1. This Court has federal-question jurisdiction over Google’s claims under RICO and the Lanham Act pursuant to 28 U.S.C. § 1331. 2. This Court has personal jurisdiction over Defendants because: a. Defendants have intentionally targeted and harmed Google, a company based in the United States. Defendants had knowledge that their actions would cause harm to victims in New York and cause Google harm in New York. Google does business in New York and has done business in New York for many years, including in this District.
b. Defendants have created fake websites mimicking the New York E-ZPass website and the New York City government’s website for use in phishing schemes. c. Defendants have affirmatively directed actions at the United States, including this District, and Defendants have attempted to phish and have successfully phished personal and financial information from victims within this District and New York State. d. Defendants have used Google’s trademarks as part of fake websites used to solicit victims’ personal and financial information within this District and New York State, and have directed multiple forms of electronic communication to user devices
in this District and New York State. 3. Venue is proper in this District under 28 U.S.C. § 1391(c)(3) because Defendants are not residents of the United States and may therefore be sued in any judicial district. Venue is also proper in this District under 28 U.S.C. § 1391(b)(2) and 18 U.S.C. § 1965(a) because a substantial part of the events or omissions giving rise to Google’s claims occurred in this District, because a substantial part of the harm caused by Defendants has occurred in this District, and because Defendants transact their affairs in this District. Moreover, Defendants are subject to personal jurisdiction in this District, and no other venue appears to be more appropriate. 4. The Complaint pleads facts with the specificity required by the Federal Rules of Civil Procedure and states claims against Defendants for violations of (1) RICO, 18 U.S.C. § 1962(c)–(d) (Count I); and (2) the Lanham Act, 15 U.S.C. §§ 1114(1), 1125(a)(1)(A), 1125(a)(1)(B) (Count II). Preliminary Injunction Factors
5. The Court finds that Google has established each of the factors required for a preliminary injunction: (1) irreparable harm; (2) a likelihood of success on the merits and/or sufficiently serious questions as to the merits; (3) the balance of equities tips in Google’s favor; and (4) a preliminary injunction serves the public interest. See Benihana, Inc. v. Benihana of Tokyo, LLC, 784 F.3d 887, 895 (2d Cir. 2015); see also Sterling v. Deutsche Bank Nat’l Tr. Co. as Trustees for Femit Tr. 2006-FF6, 368 F. Supp. 3d 723, 727 (S.D.N.Y. 2019) (“The standard[s] for granting a temporary restraining order and a preliminary injunction pursuant to Rule 65 of the Federal Rules of [Civil] Procedure are identical.”). Irreparable Harm
6. Google has established that it will suffer immediate, irreparable harm if this Court denies its request for a preliminary injunction. Google has shown that Defendants—through their operation of the Outsider Enterprise to participate in and carry out numerous criminal phishing scams (the “Outsider Schemes”)—have threatened the security of the Internet by using phishing attacks to steal personal and financial information, defrauding unsuspecting targets, impairing Google’s reputation and goodwill, and causing Google (and numerous others) unrecoverable financial losses. Until the Outsider Schemes are disrupted, the Outsider Enterprise will continue to profit from its unlawful activities at the expense of Google and an ever-increasing number of victims. 7. Defendants’ conduct is injuring Google’s goodwill and damaging its reputation by falsely associating Google with fraud perpetrated by the Outsider Enterprise, and injuries to goodwill and reputation constitute irreparable harm. Google has suffered and continues to suffer economic losses from the Outsider Schemes because Google has expended (and continues to expend) substantial financial resources in developing strong brand recognition associated with its
name, logos, and products, investigating and combatting the Outsider Schemes, and identifying measures necessary to remediate the harms caused by the Outsider Schemes. These injuries constitute irreparable harm, including because Google has shown a likelihood that Defendants would avoid complying with any judgment. Likelihood of Success on the Merits 8. Google has demonstrated that its Complaint presents a sufficiently serious question as to each of its claims and that it is likely to succeed on the merits of its claims. Sterling, 368 F.Supp. 3d at 727. 9. RICO. Google has shown a likelihood of success on the merits of its claim that
Defendants have violated and continue to violate the RICO statute, and that Defendants engaged in a RICO conspiracy. a. Google has shown that Defendants are active participants in the operation and management of the Outsider Enterprise, which uses Outsider to dupe over 100,000 people into clicking malicious links leading to fraudulent websites as part of phishing schemes. b. Google has established that Defendants constitute an enterprise. Defendants are associated-in-fact and share a common purpose to execute phishing schemes to fraudulently obtain sensitive financial information and login credentials for profit. Defendants collaborate to establish, grow, and manage the Outsider Enterprise and execute the Outsider Schemes, each playing a role to fulfill their common purpose. Some Enterprise members develop the Outsider software, others market and advertise the Outsider software, others use the Outsider software to develop fraudulent websites, others sell stolen information or launder stolen money, and
others provide strategic guidance and tactical support. c. Google has established that Defendants have engaged in a pattern of racketeering activity. See 18 U.S.C. § 1961(1), (5). The predicate acts include violations of the federal wire fraud statute, 18 U.S.C. § 1343. Defendants have, with intent to defraud and obtain money or property by means of false or fraudulent pretenses, committed wire fraud and continue to commit wire fraud by transmitting signals in interstate or foreign commerce for the purpose of executing their various fraudulent schemes, in violation of 18 U.S.C. § 1343. d. Google has suffered injury to its business or property as a result of this predicate
offense. Google’s brand value and goodwill are harmed every time a fraudulent website uses a Google Mark to falsely indicate trustworthiness to a phishing victim. Google has been further harmed by devoting substantial financial resources to investigate and combat Defendants’ criminal schemes in order to protect its goodwill and reputation. e. Google has demonstrated that Defendants have engaged in a RICO conspiracy. The links among the Defendants—such as using the Outsider software, chats from the Telegram channels, and the methods for coordinating and deploying widespread phishing schemes—demonstrate that the Enterprise formed an agreement as part of a common scheme and conspiracy. 10. Lanham Act. Google has shown a likelihood of success on the merits of its claim that Defendants violated and continue to violate the Lanham Act. Section 1114 prohibits infringement of a registered trademark or service mark. Infringement occurs when a valid,
protectable mark is used in commerce and is likely to cause confusion, to cause mistake, or to deceive. See 15 U.S.C. § 1114(1); Virgin Enters. Ltd. v. Nawab, 335 F.3d 141, 146 (2d Cir. 2003). Defendants violated this provision by exploiting Google’s trustworthy, well-known, valid, protectable, and registered Marks on their fake websites to deceive consumers. Section 1125(a) prohibits false “designations of origin” that are likely to cause confusion as to the sponsorship of a product or service. 15 U.S.C. § 1125(a)(1)(A). A claim under section 1125(a)(1)(A) has the same elements as a claim under section 1114(1) and can be established with the same evidence, see Victorinox AG v. B & F System, Inc., 114 F. Supp. 3d 132, 139 (S.D.N.Y. 2015), so Google’s section 1125(a)(1)(A) claim is likely to succeed for the same reasons. Section 1125(a) also
prohibits false advertising. 15 U.S.C. § 1125(a)(1)(B). To qualify as false advertising, a representation must (1) be false, (2) be material, (3) be placed in interstate commerce, and (4) have caused injury to the plaintiff. Church & Dwight Co. v. SPD Swiss Precision Diagnostics, GmBH, 843 F.3d 48, 65 (2d Cir. 2016). Google has demonstrated that Defendants deceive Internet users by using Google’s Marks on their fake websites. Google has shown that the representations are literally false because they are not from or endorsed by Google, and that the representations are material because the Defendants’ schemes are successful precisely because their websites appear to be real. The messages bearing Google’s Marks are placed in interstate commerce on the Internet, and Google has demonstrated injury to its goodwill and through costs to identify and combat the Outsider Schemes. Google is thus likely to succeed on the merits of its Lanham Act claims. Balance of Hardships 11. The equities favor a preliminary injunction. The Outsider Enterprise is defrauding consumers, is injuring Google, and continues to victimize more people every day. No
countervailing factors weigh against a preliminary injunction. There is no legitimate reason why Defendants should be permitted to continue to weaponize Google’s branding to defraud the public and commit cybercrimes. Public Interest 12. Google has shown that the public interest favors granting a preliminary injunction. 13. The Outsider Enterprise has defrauded more than 100,000 victims. Every day that passes, Defendants deceive new unsuspecting victims. Protection from malicious cyberattacks and other cybercrimes is clearly in the public interest. 14. The public interest is also served by enforcing statutes designed to protect the
public, including RICO and the Lanham Act. Good Cause for Alternative Service 15. The Court finds that good cause exists to grant alternative service, including service of process, in this matter by email using any information available from registrars or web-hosting companies provided in connection with domain names and/or IP addresses used in connection with the Outsider Schemes or identified by Google in its investigation; website publication; and/or other means, because Google has established that traditional service methods would be futile. Moreover, Google has exercised reasonable diligence in attempting to discover physical addresses for service of process and was unsuccessful in doing so. Accordingly, because Defendants’ service addresses are unknown, the Hague Convention’s rules governing service of process do not apply. Given the online and international nature of Defendants’ conduct, online alternative service is likely to be the most accurate and viable means to give Defendants notice of the filings pertaining to this lawsuit. PRELIMINARY INJUNCTION ORDER
16. IT IS HEREBY ORDERED that Defendants, any of their officers, agents, servants, employees, or attorneys, and all others in active concert or participation with them, who receive actual notice of this Order by personal service or otherwise (“Restrained Parties”), are preliminarily restrained and enjoined, from, anywhere in the world: a. Using, linking to, transferring, selling, exercising control over, or otherwise owning or accessing Outsider or the Internet domains, IP addresses, and other network identifiers through which the Outsider Enterprise perpetrates its schemes, set forth in Appendix A to the NAXO Declaration in Support of Plaintiff’s Motion for an Ex Parte Temporary Restraining Order and Order to Show Cause (“Appendix A”);
b. Sending messages or advertisements with links to malicious websites; c. Engaging in phishing schemes; d. Stealing or selling credentials from victims of phishing schemes; e. Monitoring the activities of Google or Google’s customers or stealing information from them; f. Impersonating Google, its systems, products, and services; g. Encouraging, directing, or instructing Enterprise members to use Google products, such as Gemini, as a means to further the Enterprise’s unlawful schemes including but not limited to utilizing Google products to generate websites; h. Creating websites that falsely indicate that they are associated with Google, YouTube, Google Pay, Google Play, or any other Google product or affiliate, through use of Google’s trademarks and/or other false and/or misleading representations; i. Misappropriating that which rightfully belongs to Google, Google’s customers and
users, or in which Google has a proprietary interest; j. Configuring, deploying, operating, or otherwise participating in or facilitating the Outsider Schemes described in the moving papers, including but not limited to through the Internet domain names and/or IP addresses listed in Appendix A and through any other component or element of Defendants’ illegal infrastructure in any location, including infrastructure Defendants may attempt to rebuild; k. Delivering malicious code designed to steal credentials; l. Selling access to the accounts of Google’s customers; m. Offering, promoting, or selling victims’ credit cards or other financial information
to others for use; n. Using, transferring, exercising control over, or accessing any accounts used in the transfer of money or electronic currency, including cryptocurrency, or in the processing of card-based transactions, as a means to further Defendants’ unlawful schemes; and/or o. Undertaking any similar activity that inflicts harm on Google, Google’s customers or users, or the public. 17. Upon service as provided for in this Order, Defendants and other Restrained Parties shall be deemed to have actual notice of the issuance and terms of the Order, and any act by any of the Restrained Parties in violation of any of the terms of the Order may be considered and prosecuted as contempt of court. 18. The Clerk of the Court is to issue a summons to Defendants Does 1–25 for Google to serve on Defendants. 19. IT IS FURTHER ORDERED that the Restrained Parties are preliminarily
restrained and enjoined from: a. Using Google’s trademarks, including but not limited to Plaintiff’s YouTube and YouTube design marks (including RN: 3525802, 5581035), Google Play mark (including RN: 5570801), Google Play & Design mark (including RN: 5628029), Google Pay mark (including RN: 5708685), and G Pay & Design mark (including RN: 6067711), and/or other trademarks, trade names, service marks, or Internet domain addresses or names containing or infringing such trademarks, trade names or service marks, as set forth in Appendix D to the Google Declaration in Support of Plaintiff’s Motion for an Ex Parte Temporary Restraining Order and Order to
Show Cause, which contains Google’s trademarks, trade names, service marks, or Internet domain addresses or names containing or infringing such trademarks, trade names or service marks, or other intellectual property infringed as a result of Defendants’ activities; b. Using, in connection with Defendants’ activities, products or services with any false or deceptive designation, representations, or descriptions of Defendants or of their activities, whether by symbols, words, designs, or statements, which would damage or injure Google or its customers or users, or would give Defendants an unfair competitive advantage or result in deception of consumers; and c. Acting in any other manner that suggests in any way that Defendants’ activities, products, or services come from or are somehow sponsored by or affiliated with Google, or passing off Defendants’ activities, products, or services as Google’s. 20. IT IS FURTHER ORDERED that, pursuant to the All Writs Act, Google may serve this Order on the persons or entities hosting or providing services, including domain
registries such as Verisign, Inc., related to the domains and/or IP addresses identified in Appendix A or any domains or IP addresses identified by Google pursuant to this Order in the future, requesting that those persons or entities implement the following actions: a. Take reasonable steps to identify incoming and/or outgoing Internet traffic on their respective networks that originates or is being sent from or to any IP addresses identified in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future; b. Within three (3) business days of receipt of this Order, or as soon as practicable, take reasonable steps to block and/or disrupt access to incoming and/or outgoing
Internet traffic or communications on their respective networks that originates and/or is being sent from or to the domains and/or IP addresses identified in Appendix A, or any domains and/or IP addresses identified by Google pursuant to this Order in the future, by Defendants or Defendants’ representatives or resellers, except as explicitly provided for in this Order; c. Take reasonable steps to block incoming and/or outgoing Internet traffic on their respective networks that originates and/or is being sent from or to the domains and/or IP addresses identified in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future, by Defendants or Defendants’ representatives or resellers, except as explicitly provided for in this Order; d. Take other reasonable steps to block and/or disrupt access of such traffic to and/or from any other IP addresses, domains, or Internet channels to which Defendants may move the Outsider infrastructure, including those identified by Google
pursuant to this Order in the future, to ensure that Defendants cannot use such infrastructure to facilitate and expand the use of Outsider or continue to perpetrate illegal acts; e. Make the software and/or data assigned to or otherwise associated with the domains and/or IP addresses set forth in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future inaccessible from any other computer on the Internet, any internal network, or in any other manner, to Defendants, Defendants’ representatives, and all other persons, except as otherwise ordered herein;
f. Completely, and until further order of this Court, suspend all services to Defendants or Defendants’ representatives or resellers associated with the domains and/or IP addresses set forth in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future; g. Should a provider identify any content and/or software hosted at an IP address listed in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future that it reasonably believes is not associated with Defendants, the provider shall preserve any such content and/or software; and contact Google’s counsel, Laura Harris at King & Spalding LLP, 1290 Avenue of the Americas, 14th Floor, New York, New York 10104-0101, and lharris@kslaw.com, within one (1) business day; h. Refrain from providing any notice or warning to, or communicating in any way with Defendants or Defendants’ representatives, and refrain from publicizing this Order until the steps required by this Order are executed in full, except as necessary
to communicate with registries, registrars, hosting companies, data centers, Google, or other ISPs to execute this Order; i. Not enable, and take all reasonable steps to prevent, any circumvention of this Order by Defendants or Defendants’ representatives associated with the domains and/or IP addresses listed in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future, including without limitation enabling, facilitating, and/or allowing Defendants or Defendants’ representatives or resellers to rent, lease, purchase, or otherwise obtain other services associated with those domains and/or IP addresses;
j. Preserve, retain, and produce to Google all documents and information sufficient to identify and contact Defendants and Defendants’ representatives operating or controlling the domains and/or IP addresses set forth in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future, including any and all individual or entity names, mailing addresses, e-mail addresses, facsimile numbers, telephone numbers, or similar contact information, including but not limited to such contact information reflected in billing, usage, access, and contact records and all records, documents, and logs associated with the use of or access to such domains and/or IP addresses; k. Provide reasonable assistance in implementing the terms of this Order and take no action to frustrate the implementation of this Order; and l. Completely preserve any and all data or media assigned to or otherwise associated with the domain names and/or IP addresses set forth in Appendix A or any domains and/or IP addresses identified by Google pursuant to this Order in the future, and
preserve all evidence of any kind related to the content, data, software, or accounts associated with such domains and/or IP addresses. m. In determining the method and mechanism to disable content and software associated with Defendants, the relevant persons and/or entities shall reasonably confer with Plaintiff’s counsel of record in this action. 21. IT IS FURTHER ORDERED that Google may amend Appendix A if it identifies other domains and/or IP addresses used by Defendants in connection with the Outsider Enterprise, including any such domains and/or IP addresses that might not yet exist, without further order of this Court.
22. IT IS FURTHER ORDERED that, good cause having been shown, Google may effectuate service using alternative service, including service of process, by electronic means— including by email using any information available from web-hosting companies provided in connection with domain names used in the Outsider Schemes or identified by Google in its investigation; website publication; and/or other means ordered herein. Alternative service by email, website publication, and/or other means ordered herein shall be deemed effective as to Defendants through the pendency of this action. Security for Preliminary Injunction Order 23. IT IS FURTHER ORDERED that Google’s submission of $75,000 bond to the Clerk satisfied the requirements of this Court’s TRO. No additional bond is necessary. So ordered.
Date: June 26, 2026 New York, New York