MKR v Cloudflare: High Court orders domain providers to disclose details of anonymous harasser

The High Court has ordered three internet infrastructure companies to disclose information identifying whoever is behind a long-running campaign that has associated the claimant's name with thousands of domains redirecting to adult content. In MKR v Cloudflare Limited & Ors [2026] EWHC 2452 (KB), Mrs Justice Hill made Norwich Pharmacal orders against the second to fourth defendants, Mesh Digital Limited, 123-Reg Limited and Host Europe Group Limited, none of which attended.

The Part 8 claim was issued on 30 July 2026. The claimant was granted anonymity and the hearing was expedited. At the outset, the judge questioned whether the claim against the first defendant, Cloudflare Limited, remained suitable for Part 8, given substantial factual disputes over whether it or its US parent, Cloudflare, Inc, held the information sought. The parties agreed to transfer that claim to Part 7, with a trial expected in early 2027.

The claimant's evidence was that since December 2024 domains containing her full legal name, in the URL or in search snippets, have redirected visitors to pornographic pages, often through traffic-monetisation networks, with reverse proxy services masking the operator. The conduct fell into three phases and adapted over time. It paused within days of complaints reaching registrars, resumed in altered form, and most recently began using geo-location restrictions that block access from the UK, after pre-action letters were sent in July 2026. Nine domains formed the sample for the claim.

The judge applied the four-stage test from Collier v Bennett, approved by the Privy Council in Stanford Asset Holdings v AfrAsia Bank: an arguable wrong, the respondent being mixed up in it, the respondent's ability to provide the information, and overall justice. The applicant bears the burden throughout and the jurisdiction is exceptional and narrow.

Mrs Justice Hill accepted a good arguable case in harassment under the Protection from Harassment Act 1997 and in defamation. Targeting was inferred from conduct persisting for more than 18 months, the effort involved, the absence of any obvious commercial rationale for pursuing a private individual, and the pauses that followed complaints. Those features made it less likely that the conduct was spam or click-farming, as police had suggested to the claimant. The defamation case rested on implication: a reasonable person would arguably read the juxtaposition of her name with adult content as discreditable, applying Monson v Tussauds.

The mixed up in condition was met because a registrar and host that enables the domain at the centre of the wrong facilitates it, following Ashworth Hospital Authority v MGN and Davidoff v Google. One defendant is registrar and host for one of the domains, another is its sister company and the third its parent. The sister company had said it would comply with a police preservation request. On possession, the registrar was likely to hold the information, and the others were likely able to provide it, as none had said that was impossible. A templated response from the ultimate parent, GoDaddy, saying it lacked access to the content did not alter that view, since the application was not against it.

On overall justice, the judge considered the factors in Rugby Football Union v Consolidated Information Services. The claimant had tried without success to obtain the information voluntarily, the categories sought were focused on identifying the wrongdoer, and no innocent person was likely to be named. There was a strong public interest in allowing her to vindicate her rights, and limited weight attached to the anonymity of someone using it to avoid consequences, following Davidoff. The defendants must comply within seven days, and the order carries a collateral use undertaking limiting use to civil proceedings, reports to authorities and further disclosure relief.

Given the claimant's circumstances and the likelihood that compliance would be quick and inexpensive, no cross-undertaking in damages was required. On costs, the starting point in Filatona Trading v Quinn Emanuel and Jofa v Benherst Finance is that the applicant pays the respondent's reasonable compliance costs, and the judge saw no powerful reason to depart from it. She capped them at £200 per defendant because the three had not engaged with pre-action or claim correspondence or indicated likely costs, the costs are likely to be modest, and the claimant's circumstances are difficult.

Katherine Ratcliffe and David Robertson, instructed by Reynolds Porter Chamberlain LLP, appeared for the claimant. Anna Hoffmann, instructed by Winston Taylor LLP, appeared for Cloudflare Limited.