Google LLC v. Does 1-25

Background

Google moved for default judgment and entry of a permanent injunction against Does 1-25. The opinion describes the defendants as participants in the BadBox 2.0 botnet, which allegedly involved malware, command-and-control servers, advertising fraud, and the sale of access to infected devices. The court found that the botnet had infected more than ten million devices worldwide, including tens of thousands of devices in the Southern District of New York.

The court found that the defendants had been served with the summons, complaint, and other pleadings by email and publication on a publicly available website. It also found that they had actual notice based on media coverage and their responses to Google’s disruption of the botnet. They did not appear, answer, or otherwise defend the action. The Clerk entered default under Rule 55(a) on August 27, 2025.

Jurisdiction and Liability

The court found federal-question jurisdiction under 28 U.S.C. § 1331. It found personal jurisdiction because the defendants allegedly distributed malware, infected devices, sent commands to infected computers, and sold access to infected devices in the district and New York State. It found venue proper under federal venue provisions and the Racketeer Influenced and Corrupt Organizations Act.

Because the defendants defaulted, the complaint’s factual allegations were deemed admitted, and the court also considered evidence in Google’s supporting papers. The court found that Google established its claims under two statutes:

- Computer Fraud and Abuse Act: The court found that the defendants intentionally transmitted malware and commands to protected computers without authorization, intentionally caused damage, and accessed protected computers to further fraud and obtain something of value. The court found that the defendants infected devices without users’ knowledge or consent and caused Google more than $5,000 in loss during a one-year period. - Racketeer Influenced and Corrupt Organizations Act: The court found that the defendants operated an enterprise with a shared purpose of spreading malware, building a botnet, and carrying out criminal schemes for profit. It found a pattern of racketeering activity based on alleged Computer Fraud and Abuse Act violations and wire fraud. The court also found that Google suffered injury to its business or property through advertising fraud, refunds for fraudulent traffic, the sale of residential proxy access, and the costs of investigating and combating the schemes.

Permanent Injunction

The court applied the factors for a permanent injunction: irreparable harm, inadequate legal remedies, the balance of hardships, and the public interest. It found that Google had shown each factor. The court cited threats to internet and device security, continuing harm to Google’s goodwill and reputation, economic losses, and the risk of further attacks or other criminal schemes. It also found that the defendants had continued conduct covered by earlier court orders, including attempts to establish new command-and-control servers and infect additional devices.

Order

The court granted Google’s motion for default judgment and entry of a permanent injunction, declared the defendants in default, and awarded judgment in Google’s favor against them. The injunction applies worldwide to the defendants and other restrained parties who receive actual notice. It prohibits them from accessing Google customers’ protected computers without authorization, sending malicious code, operating or facilitating the BadBox 2.0 botnet, compromising devices or networks, stealing information, selling proxy services, committing advertising fraud, using specified domains, and undertaking similar activities that harm Google, its customers, or the public.

The court also authorized Google to serve the order on hosting companies, data centers, and other service providers connected to domains identified in the complaint. Those providers were directed to take reasonable steps to identify and block related traffic, disable or suspend services, prevent circumvention, preserve evidence, provide identifying information about the operators, and assist in implementing the order. Violations of the injunction may be treated and prosecuted as contempt of court.