High Court orders three UK companies to disclose information about a domain account holder.
The High Court has granted a Norwich Pharmacal order requiring three UK internet companies to disclose information that may help identify the person behind a domain linking an academic’s name with adult content. Mrs Justice Hill made the order against Mesh Digital Limited, 123-Reg Limited and Host Europe Group Limited in MKR v Cloudflare Limited and others [2026] EWHC 2452 (KB).
The claimant, who has been granted anonymity, is a lecturer and academic. The court heard that since December 2024, thousands of domains had been created using her full legal name, sometimes alongside random letters. When some of the links were accessed, users were redirected to webpages containing pornographic or adult content.
The claimant divided the conduct into three phases running from December 2024 onwards. The court heard that the activity repeatedly stopped and restarted, including after complaints were made to domain registrars and following pre-action correspondence from her solicitors. The claimant had been unable to identify the person responsible and brought proceedings concerning a sample of nine domains.
Mrs Justice Hill considered the four conditions required for Norwich Pharmacal relief: an arguable wrong, the respondent being sufficiently involved in facilitating the wrongdoing, possession or likely possession of information needed to identify the wrongdoer, and overall justice requiring proportionate disclosure.
The judge found that the claimant had a good arguable case of harassment contrary to the Protection from Harassment Act 1997 and defamation. She concluded that the repeated creation of domains using the claimant’s name supported an arguable case that the conduct was deliberately targeted at her. The court also accepted that the combination of her name with adult content could be defamatory by implication.
The court further found that Mesh Digital, as the domain registrar and/or hosting provider for one of the domains, was sufficiently connected with the alleged wrongdoing. The court reached similar conclusions regarding its sister company, 123-Reg, and parent company, Host Europe Group.
Mrs Justice Hill was satisfied that the companies were able, or likely to be able, to provide information needed to identify the person responsible. She also concluded that disclosure was necessary and proportionate because the claimant had already taken steps to obtain the information without a court order.
The three defendants were ordered to disclose carefully defined categories of information about the person or people behind the relevant domain within seven days. The information can be used for pursuing civil proceedings or other civil relief, reporting the matter to law-enforcement or regulatory authorities, or seeking further Norwich Pharmacal relief where necessary.
The claimant was required to pay the defendants’ compliance costs, but these were capped at £200 per defendant. The claim against Cloudflare Limited was transferred from Part 8 to Part 7 because of factual disputes concerning whether the information sought was controlled by Cloudflare Limited or its US-based parent company, Cloudflare Inc. A trial of that claim was directed for early 2027.