MKR v Cloudflare Limited & Ors

Facts

The claimant, a lecturer and academic granted anonymity, found that from December 2024 thousands of internet domains had been created with her full legal name embedded in the web address or shown in a search-result snippet. Anyone who clicked was redirected to pornographic or adult content. Reverse proxy services hid the identity of whoever managed the domains. The conduct came in three phases and adapted over time. It stopped for more than two months after she complained to three registrars. It later started again in a different technical form and, after pre-action letters were sent in mid-July 2026, with geo-location restrictions limiting access from the UK. She believed a man referred to as X, whose romantic approaches she had rejected, might be responsible. Her own inquiries, including approaches to the police and to infrastructure providers, had not identified the perpetrator. By a Part 8 claim form issued on 30 July 2026, she sought Norwich Pharmacal disclosure against four defendants, covering a sample of nine domains. Cloudflare Limited was the first defendant. Mesh Digital Limited, the second defendant, was the registrar and hosting provider for one of the domains. The third defendant was its sister company, and the fourth defendant was the parent company of both. Steyn J expedited the hearing under CPR 3.1(2)(a). At the hearing, disputes of fact about whether the first defendant held the information led to the claim against it being transferred to Part 7. The claim proceeded unopposed against the other three defendants, who did not attend.