About This Court Order

This November 17, 2017 federal court order was entered in Microsoft Corporation v. John Does 1-51, Case No. 1:17-cv-04566-MHC, in the United States District Court for the Northern District of Georgia, Atlanta Division. The order granted Microsoft emergency ex parte temporary restraining relief and required the John Doe defendants to show cause why a preliminary injunction should not issue in litigation targeting the Gamarue botnets and related command-and-control infrastructure.

The Court addressed claims under the Computer Fraud and Abuse Act, Georgia Computer Systems Protection Act, Lanham Act, Georgia Uniform Deceptive Trade Practices Act, and related common-law theories. The order found good cause to believe the defendants were using malicious software, command-and-control servers, and Internet domains to infect Microsoft customers’ computers, operate Gamarue botnets, steal account information and files, and distribute additional malicious software.

A central feature of the order is its technical-remedy architecture. The Court authorized action directed at domain registries and the Domain Name System, including preservation of WHOIS and identifying information, restrictions against transfer or modification, and redirection of identified domains to Microsoft-secured name servers so that the domains could no longer be used for botnet command and control. The order also directed preservation of evidence associated with the domains.

The order authorized alternative service through available contact information, domain registrars and hosting companies, public Internet notice, and other legally authorized means. It required Microsoft to post a $100,000 bond and scheduled a preliminary-injunction show-cause proceeding. Appendix A identifies domain registries, targeted domains, and available registrant-contact information associated with the requested disruption.

For CyberLawLibrary research purposes, this filing is significant as an example of court-authorized civil cyber-infrastructure disruption using emergency Rule 65 relief, DNS redirection, registry-level controls, evidence preservation, alternative service, and coordinated execution against malicious botnet infrastructure.

Judicial Provenance

Entered by Hon. Mark H. Cohen, United States District Judge, on November 17, 2017. Plaintiff: Microsoft Corporation. Defendants: John Does 1-51, described in the caption as controlling multiple computer botnets and thereby injuring Microsoft and its customers. The uploaded order does not identify Microsoft’s individual counsel, law-firm addresses, or counsel email addresses; do not invent or infer those items from this order. Add counsel metadata later only from the complaint, TRO application, notice of appearance, or another docket filing that expressly identifies counsel

Repository Note: CyberLawLibrary reproduces this public federal court record for legal, cybersecurity, and historical research. The document is the Emergency Ex Parte Temporary Restraining Order and Order to Show Cause re Preliminary Injunction entered November 17, 2017 as D.E. 19 in Microsoft Corporation v. John Does 1-51, Case No. 1:17-cv-04566-MHC, United States District Court for the Northern District of Georgia, Atlanta Division. The docket copy preserves the original court-filed pagination and identifies the order as filed under seal. Repository publication does not alter the document, the Court’s findings, or its historical filing status.