Case 1:24-cv-02323-MSN-WEF Document 34 Filed 01/10/25 Page 1 of 4 PageID# 490

r.'”:

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF VIRGINIA
ALEXANDRIA DIVISION

iO A % 08
in-jr
iU-J
Microsoft Corporation,

Plaintiff,
Case No. l-24-cv-2323-AJT
V.

Does 1-10 Operating an Azure Abuse Network,

Defendants.

SUPPLEMENTAL BRIEF IN SUPPORT OF REQUEST FOR PRELIMINARY

INJUNCTION

INTRODUCTION

This case involves a sophisticated scheme by Defendants to abuse Microsoft’s generative

AI services using tools specifically designed to circumvent Microsoft’s access controls and

safety measures. On December 20, 2024, the Court issued a sealed ex parte Temporary

Restraining Order and subsequently entered an amended order extending the TRO on December

30, 2024 (collectively, the “TRO”). The Court’s orders have been effective. In response to

receiving notice of this action and the Court’s TRO, Defendants and certain third parties disabled

some of the infrastructure used to abuse Microsoft’s AI services. As anticipated. Defendants

have also tried to cover their tracks by deleting evidence of their activities.

Defendants have not responded to multiple emails from the undersigned and, as of the

time of this filing, have not responded to the Court’s OSC. Accordingly, for all the reasons stated

in Microsoft’s initial moving papers and the cases and supporting materials cited in this

supplemental brief, Microsoft respectfully requests that the Court convert the TRO into a

preliminary injunction pending final disposition of this action.

Case 1:24-cv-02323-MSN-WEF Document 34 Filed 01/10/25 Page 2 of 4 PageID# 491

ARGUMENT

The purpose of a preliminary injunction is to preserve the status quo pending final

resolution of the case. E.g., Hoechst Diafoil Co. v. Nan Ya Plastics Corp., 174 F.3d 411, 422 (4th

Cir. 1999). To obtain a preliminary injunction, a movant must demonstrate: (1) likely success on

the merits; (2) likely irreparable harm in the absence of preliminary relief; (3) that the balance of

equities favors an injunction; and (4) that an injunction is in the public interest. Winter v. Nat. Res.

Def Council, Inc., 555 U.S. 7, 20 (2008). The Court considered these same factors in issuing the

TRO and there is “no reason to disturb” those findings, particularly in view of Defendants’ failure

to respond to the Court’s Order to Show Cause. Clearone Advantage, LLC v. Kersen, 713 F. Supp.

3d 86, 87-88 (D. Md. 2024) (citing Glaxosmithkline, LLC v. Brooks, 2022 WL 2916170, at *2 (D.

Md. July 25, 2022) for the proposition that it “may be appropriate to convert a TRO into a

preliminary injunction as a result of a defendant’s failure to defend and/or failure to appear” and

11A Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 2949 (3d ed. 2023)

(explaining that an evidentiary hearing on a preliminary injunction request is not required when

there is no genuine controversy)).

The same facts...that supported entering a TRO...support converting the TRO into a

preliminary injunction.” Glaxosmithkline, LLC v. Brooks, 2022 U.S. Dist. LEXIS 132470, at *12

(D. Md. 2022). Although certain of the subject infrastructure has been disabled, Defendants’

malicious code is presumably still in their possession, creating a continuing risk of the misconduct

at issue. In fact, some of Defendants’ users have discussed continued efforts to abuse generative

AI services notwithstanding the lawsuit. Declaration of Jason Lyons (“Lyons Supplemental

Deck”) ^ 4. Moreover, it appears that Defendants are attempting to conceal evidence of their

activities. Lyons Deck 3. Such bad faith conduct supports an injunction. E.g., Mey v. Pintas,

-2-
Case 1:24-cv-02323-MSN-WEF Document 34 Filed 01/10/25 Page 3 of 4 PageID# 492

Civil Action No. 5:24-CV-55, 2024 U.S. Dist LEXIS 99273, at *13 (N.D.W. Va. May 17, 2024)

(bad faith conduct supported injunction); Walsh v. Med. Stafifng of Am., LLC, 2023 U.S. Dist.

LEXIS 203645, at *14 (E.D. Va. Sep. 7, 2023) (“Defendants’ pattern of ELSA violations and bad

faith efforts to avoid compliance weigh heavily in favor of granting a prospective injunction”).

CONCLUSION

For all the foregoing reasons. Plaintiff requests conversion of the TRO into a preliminary

injunction pursuant to Rule 65.

Dated: January 10, 2025 Respectfully submitted,

JOSHUA CARRIGAN (VA Bar No. 96911)

[email protected]
ORRICK, HERRINGTON & SUTCLIFFE LLP
2100 Pennsylvania Avenue NW
Washington, D.C. 20037
Telephone:+ 202 339 8400
Facsimile: + 202 339 8500

ROBERT L. URIARTE {Pro Hac Vice pending)

[email protected]
ORRICK, HERRINGTON & SUTCLIFFE LLP
355 S. Grand Avc.
Ste. 2700

Los Angeles, CA 90017

Telephone: + 1 213 629 2020
Facsimile:+ 1 213 612 2499

JACOB M. HEATH {Pro Hac Vice pending)

[email protected]
ANA M. MENDEZ-VILLAMIL {Pro Hac Vice
forthcoming)
[email protected]
ORRICK, HERRINGTON & SUTCLIFFE LLP
The Orrick Building
405 Howard Street
San Francisco, CA 94105
Telephone: + 1 415 773 5700
Facsimile:+ 1 415 773 5759

-3 -
Case 1:24-cv-02323-MSN-WEF Document 34 Filed 01/10/25 Page 4 of 4 PageID# 493

LAUREN BARON {Pro Mac Vice pending)

[email protected]
ORRICK, HERRINGTON & SUTCLIFFE LLP
51 West 52nd Street
New York, NY 10019
Telephone; + 1 212 506 5000
Facsimile: + 1 212 506 5151

Of Counsel:
RICHARD BOSCOVICH
[email protected]
MICROSOFT CORPORATION
Microsoft Redwest Building C
5600 148th AveNE
Redmond, Washington 98052
Telephone: +1 425 704 0867
Facsimile: +1 425 706 7329

Attorneys for Plaintiff

MICROSOFT CORPORATION

-4-
Case 1:24-cv-02323-MSN-WEF Document 34-1 Filed 01/10/25 Page 1 of 2 PageID# 494

IN THE UNITED STATES DISTRICT COURT

FOR THE EASTERN DISTRICT OF VIRGINI;A/V Q

Microsoft Corporation,

Plaintiff, ' n
A c- no
; u
Case No:1-24-cv-2323-A5T' “
V.

Does 1-10 Operating an Azure Abuse

Network,

Defendants.

DECLARATION OF JASON LYONS IN SUPPORT OF MICROSOFT’S REQUEST FOR

PRELIMINARY INJUNCTION

I, Jason Lyons, declare as follows:

I am a Principal Manager of Investigations in the Digital Crimes Unit (“DCU”)

Cybercrime Enforcement Team at Microsoft Corporation. I make this declaration based upon my

personal knowledge, and upon infonnation and belief from my review of documents and

evidence collected during Microsoft’s investigation, including the information referenced in the

prior declaration I submitted in this case.

2. I understand that Microsoft provided notice to Defendants of this action and the

Court’s TRO on Januai-y 3, 2025, after confinning that the “aitism.net” ___domain had been

redirected as required by the Court’s temporary restraining order and seiwing third-party

subpoenas.
3. 1 am infonned and believe that after receiving notice of this action and the Court’s

TRO, Defendants began taking steps to cover then- tracks, including by attempting to delete

certain Rentry.org pages, the GitHub repository for the de3u tool, and portions of the reverse

proxy infrastructure.
Case 1:24-cv-02323-MSN-WEF Document 34-1 Filed 01/10/25 Page 2 of 2 PageID# 495

4. I am informed and believe that users of Defendants’ service became aware of this

action after Microsoft served email notice on Defendants. Among other things, users posted

messages such as the following on a website used to communicate about Defendants malicious’
service:

● “Fizz took a break because someone sent a lawsuit in real life'

● “i donated AWS keys to fiz.. .am I [explative]?”

● “Fizz isn’t hosting anymore, I’m sorry proxylings, we have three Claude sources, we’ll
be fine”

● “I now have to turk this thread carefully again in case fiz comes back”

● “If I send fizz an email now, will she answer?”

Tme and correct copies of a sample of users’ messages are attached hereto as Exhibit A.

I declare under penalty of peijury under the laws of the United States that the foregoing is

true and correct to the best of my knowledge, infonnation, and belief. Executed this 9th day of

January 2025 at Bocme, Texas.

Jason Lyons

-2-
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 1 of 8 PageID# 496

Exhibit A
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 2 of 8 PageID# 497

4chan Fiz Chatter - January 7, 2025

0 Anonymous 01/07Q5CTue)11:03:44 No.103795645 ►

>>103795636
mlniproxy is taking a mlnibreak <3
forever

□ Arjonymous 01/07/25{Tue)11;04:15 No.103795649 ► »103795719

>>103795637
so Siere is a findom tag?? it didn't show any resuks when i tied it from searU). Chub fucking sucks

□ Anonymous 01/07/25(Tue)11:04;30 No.103795651 ► »10379S6S4

>>103795636
It’s 404. but you can't create it (shows yellow status) which means that H was deleted by rentry admins due to reports, not by ifz.

https://rentiy.org/minIproxy

□ Anonymous 01/07/25CTue)11:04:31 No.103795652 ►

File: REALWTF.ono (43 KB. 1440x944)
>>103795636
surely youre bailing-
AAAAAAHniEEEEEE

□ Anonymous 01/07/25(Tue)11:06:09No.103795668 ► »103795S85 »103^695

>>103795626

That's the idea, yeah.

>>103795627

FoOowing Librarian on Twitter has led to a lot of Balatro fanart showmg up in my feed, so look forward to that I guess.

□ Anonymous 01/07/25(Tue)11:06:33 No.103795670 ^

>>103795636
/fiz too, huh

o Anonymous 01/07/25(Tue)11:06:41 No.103795672 ► »i0379S9i9 »1Q379S949

https://rentry.org/6z
Fiz isn't hosting anymore, I'm sorry proxynigs. We have 3 claude sources, we'll be 6ne.

□ Anonymous 01/07/25(Tue)11;07;22 No.103795681 ►

Yeah ifs over. They got him.

o Anonymous 01/07/25(Tue)11;07:38 No,103795684 ►

>>103795651
maybe OpenAI and co.? Would also explain her sudden departure.
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 3 of 8 PageID# 498

□ Anonymous 01/07/2S(Tu«}11:16:S3No.10379S7S7 ^ ■1M7K787

>>103795636
foravnrily Usd up Rzhs FBI dateiKian ceB

□ Anonymous D1/07/25(Tu«)11:17:S3Na.1II3795764 >

FIs: 56884g3774»dA6t287be9992«(.J.lM (582 KB. 2283x2955)
>>103795685
Yeah. 7ve already added some extra paragraphs and whatnot for various anons. Everyone's gonna gettheir requests on the 2nd, barring Proton bnils, and then you've gol
two weeks to cook.

>>.1fla79MSS
To quote a sem!-vlrd post that LBtrarian idrced onto my feed by replying to It.
>7011 lowkey stee^g on baleirs pom

On a related topic, I finally found a 7y7 poker-related fanert to match my/ui ones. This la a threat

□ Anonymous 01/07f2Srrue)11:18:11 No.103795767 *■ >.ttnsooaT7

>>103795757
Im Iterell

□ Anonymous 01/07/25(Tue)11:18'.53Ho.103795774 p ■lasTastoa

SO what happened to flz7

□ Anonymous 01/07f25(Tue)11:20;10 Na.10379S784 > ●losrwst

nonnells alright but fjst doesn't quite hit the same as opus, I wish I didn't have to pay out the ass for fi

□ Anonymous 01/07f25(Tue)11:20;52 No.103795790 ¥

>>103795774
>gOt tired of hosting
>soMona reported both rentrles
>boih got nuked

□ Anonymous 01/07/25(Tue)11:26:06 No.103795829 P

>>103795790
colneidenee?
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 4 of 8 PageID# 499

□ Anonymous 01/07/25(Tue)11:39:04No.103795921 ►
Fiz’s locusts are dying~

□ Anonymous 01/07/25(Tue)11;39:10 No.103795922 ► »t037&5928 >>103795929 »10379S934 »10379S95Q

File: 1717546610482080.DnQ (6 KB, 595x89)

>https://irentry.org/request-url
>This URL was deleted by an admin due to a legal request and Is not available.
>same for /fiz
The end is nigh.

□ Anonymous 01/O7/25(Tue)11:39:33 No.103795925 ►

>>103795908
gemini has some logical hitches but it's really good. Especially at creative writing.

□ Anonymous 01/07/25CTue)11:39:38 No.103795927 ►

>>103795915
Yes please

□ Anonymous 01/07/25(Tue)11:39:46 No.103795928 ►

>>103795922
How could Ian do this...

□ Anonymous 01/07/25(Tue)11:39:53 No.103795929 ► »tQ3795942

>>103795922
smol had his rentry nuked so he just hosted it himself why can't fiz do the same

□ Anonymous 01/07/25(Tue)l1:39;10 No.103795922 ► »i03795923 »103795929 »103795934 »iq3795&sq

File: 1717546610482Q80.pnQ (6 KB, 595x89)

* This URL was deleted by an admin due to a legal request and is not available.
URL

rentry.co/ miniproxy

>https:/yrentry.or§/requ6St-url
>Thl9 URL was deleted by an admin due to a legal request and is not available.
>same for /fiz
The end is nigh.
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 5 of 8 PageID# 500

□ Anonymous 0l/07/25(TLje)11;41:16 No.103795943 ►

fiz? More likejizz!

□ Anonymous 01/07/25(Tue)11:41;22 No.103795944 ►

File: 1723985619085452,pnq (4 KB, 665x37)
>>103795934
No, normally it shows this. It’s unlikely that this is just some guy nuking the rentry.

□ Anonymous 01/07/25(Tue)11:42:08 No.103795947 ►

fiz is opening a TRUE mini proxy with opus and far less users

□ Anonymous 01/07/25(Tue)11:42:20 No.103795949 ►

>>103795672
how do you use blackbox desuarchive is down so no search

□ Anonymous 01/07/25(Tue)11:42:28 No.103795950 ►

>>103795922
Man, if pepsi was still here she would have rugpuiled by now

O Anonymous 01/07/25(Tue)11:42:37 No.103795952 ► »10379^1

Fiz took a break because someone sent a lawsuit in real life

□ Anonymous 01/07/25(Tue)11:42;40 No.103795953 ► »io37959B3 »io3796026

findom but {{char}} forces me to pay off my gambling debte by putting me In a mech

□ Anonymous 01/07/25(Tue)11:43:00 No.103795955 ► >>103795959 »19379596Q >>103795963

IM FINE NOBODY HAS ARRESTED ME

□ Anonymous 01/07/25(Tue)11:43;40 No.103795959 ► >>103799585

File: 1723585035272329 pnQ (1.45 MB. 3035x2231)
>>103795955
silence!

□ Anonymous 0t/07/25(Tue)11:43:42No.103795960 ►
>>103795955
damn the jail has internet now?
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 6 of 8 PageID# 501

□ Anonymous 01/07/25(Tue)11;55;42No.103796060 ► »1D37&&080 >>103796570

>1 now have to lurk this thread carefully again in case fiz comes back

□ Anonymous 01/07/25(Tue)11:56;54 No.103796079 ►

So who’s left? Just MM?

D Anonymous 01/07/25{Tue)11:56:55 No.103796080 ► »103796055

>>103796060
Anon... She won’t

□ Anonymous 01/07/25(Tue)11;57:27 No.103796085 ►

>>103796080
why not

□ Anonymous 01/07/25(Tue)12:00:54No.103796120 ►
I ated fiz :)

□ Anonymous 01/07/25(Tue)12;01:12 No,103796124 ►

●burp*

□ Anonymous 01/07/25(Tue)12:02:18No.103796134 ►
fiz is under an^esl

□ Anonymous 01/07/25(Tue)12:02:43 No.103796136 ► »10379B149

File: 173Q041349149230 pnQ (9 KB, 297x239)
You’re welcome!

63 » £ V
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 7 of 8 PageID# 502

□ Anonymous 01/07/25(Tue)12:31;49 No.103796370 ►

>>103796322
she will return, i'm sure of it
in fiz i trust

□ Anonymous 01/07/25(Tue)12:32:24No.103796377 ► »iq37&6395 >>103796453

mm bros...

O Anonymous 01/07/25(Tue)12:35;10 No.103796395 ► »t03796433

>>103796377
what

□ Anonymous 01/07/25(Tue)12;38:03 No.103796418 ► >>103796424 >>103796436

if i send fiz an email now, will she answer?

□ Anonymous 01/07/25CTue)12:38:34 No.103796424 ►

>>103796418
no, she's in Jail

□ Anonymous 01/07/25(Tue)12;38:52 No.103796427 ►

>>103796019
idk, I just run rocinate but that's a 12b, you could probably run bigger stuff desu

□ Anonymous 01/07/25CTue)12:39:44No.103796433 ►
>>103796395
hi :3

O Anonymous 01/07/25(Tu€)12:40;03 No.103796436 ► »1037964^

>>103796418
no im injati

□ Anonymous 01/07/25(Tue)14:11:19No.103797220 ►
Do we know which prison they're keeping Flz in?

□ Anonymous 01/07/25(Tue)14:12;45 No.103797234 ► »t03797245 »iq3798079 »103798097 »10379S174

File: 00050-3853357402.pna (1.29 MB. 1216x832)

Writing hate making greetings and it doesn’t help that) suck at H.

□ Anonymous 01/07/25(Tue)14:13:05 No.103797237 ►

The Fiz?
Case 1:24-cv-02323-MSN-WEF Document 34-2 Filed 01/10/25 Page 8 of 8 PageID# 503

OManrnamftMTCWoXLti.lt No.t037»MM > ^iHT—»~tmiir^iaiTM»u..wrM«p» in7itMi

7<KK:4ux}

□ Anonymous 01/07/25(Tue)16;47;42No.103798937 ►
?>Jg2I9e^Z
Sh«*ft by OpmW.

OAiK>symou(01/C7;26CTu«)ie45.34No.!03rS8e94 K .>«jr»«8<7..iai7Mi M>.nrmi:

>>103798894 Fh:<i1iifa'ilt9rt183%97.3«13a7i la^(1.T8MB.S0fti281)

>>103798854
HI ^ 11 ifsOVEEEEEEEEEER
Rip FIz ■ \W ^,9 MI^OOOOOSSSSSSSS
BWEEEEEEEEEEEEEEHHW

D Anonymous 01/07/25(Tue)16:47:53 No.103798938 ► >>103798948 >>103798962

>>103798898
openrouter.ai

O Anonymous 01/07/25(Tue)16:48:05 No.103798944 ► >>103798948

>>103798854
She's the one who used the glowkey btw

□ Anonymous 01/07/25(Tue)16:48:33No.103798948 ► »103798974 »1037990Q5

>>103798938
I'm not paying for shit

>>103798944
And Unreliable

□ Anonymous 01/07/25(Tue)16:48;42 No.103798952 ►

>>103798917
fiz here
i'm coming back 'slurp* anonie, i just need aaahn~ to 'slurp* finish some oooh~ stuff...

□ Anonymous 01/07/25(Tue)17:[)3:36 .103799173 ►

>1 donated AWS keys to fiz

am i fucked?