Strike 3 Holdings, LLC v. Doe

1
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF CALIFORNIA
STRIKE 3 HOLDINGS, LLC,
Plaintiff,
v.
JOHN DOE subscriber assigned IP
address 104.177.118.15,
Defendant.
Case No.: 3:26-cv-01120-LL-VET
ORDER GRANTING EX PARTE
APPLICATION FOR LEAVE TO
SERVE A THIRD-PARTY
SUBPOENA PRIOR TO A RULE
26(f) CONFERENCE
[ECF No. 4]
Before the Court is Plaintiff Strike 3 Holdings, LLC’s (“Plaintiff”) Ex Parte
Application for Leave to Serve a Third-Party Subpoena Prior to a Rule 26(f) Conference
(“Application”). ECF No. 4. No defendant has been named or served. For the reasons
discussed below, the Court GRANTS Plaintiff’s Application.
I. 	BACKGROUND
On February 20, 2026, Plaintiff filed a Complaint against Defendant “John Doe,” an
alleged 	subscriber 	of 	AT&T 	Inc. 	and 	assigned 	Internet 	Protocol 	(“IP”) 	address
104.177.118.15. ECF No. 1 at ¶ 5. Plaintiff is the owner of numerous adult motion pictures,
which Plaintiff distributes through adult websites and DVDs. Id. at ¶¶ 2–3. Plaintiff asserts
that 	Defendant 	is 	committing 	“rampant 	and 	wholesale 	copyright 	infringement” 	by
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
1 of 9

2
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
downloading and distributing copies of Plaintiff’s copyrighted motion pictures without
authorization, using the BitTorrent file distribution network. Id. at ¶¶ 4, 18–29.
In the Application, Plaintiff seeks leave to conduct early discovery prior to the
mandated Rule 26(f) conference to learn the Doe defendant’s identity. ECF No. 4-1.
Specifically, Plaintiff seeks leave to serve a Rule 45 third-party subpoena on AT&T Inc.,
the Internet Service Provider (“ISP”) who leased the IP address belonging to Defendant
John Doe. Id. at 7–8.1 The proposed subpoena would require AT&T Inc. to supply only
“the true name and address of Defendant.” Id. at 8. Additionally, Plaintiff represents to the
Court that it will only use this information to prosecute the claims in its Complaint. Id.
II. 	LEGAL STANDARD
A party is generally not permitted to obtain discovery without a court order before
the parties have conferred pursuant to Rule 26(f). Fed. R. Civ. P. 26(d)(1). “However,
situations arise, such as the present, where the identity of alleged defendants will not be
known prior to the filing of a complaint.” Gillespie v. Civiletti, 629 F.2d 637, 642 (9th Cir.
1980). In those circumstances, the Ninth Circuit recognizes that “the plaintiff should be
given an opportunity through discovery to identify the unknown defendants, unless it is
clear that discovery would not uncover the identities, or that the complaint would be
dismissed on other grounds.” Id.; see also Wakefield v. Thompson, 177 F.3d 1160, 1163
(9th Cir. 1999) (same). For this reason, courts allow limited discovery after a complaint is
filed to permit a plaintiff to learn the identifying information necessary to serve a
defendant. See, e.g., Columbia Ins. Co. v. Seescandy.com, 185 F.R.D. 573, 577 (N.D. Cal.
1999); UMG Recordings, Inc. v. Doe, No. C-08-3999-RMW, 2008 WL 4104207, at *2
(N.D. Cal. Aug. 29, 2008) (noting, in an infringement case, that “a plaintiff cannot have a
discovery planning conference with an anonymous defendant[,]” thus, limited expedited
1 Page numbers for docketed materials cited in this Order refer to those imprinted by the
Court’s electronic case filing system or the PDF pagination, not the document’s internal
pagination.
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
2 of 9

3
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
discovery would “permit the [plaintiff] to identify John Doe and serve the defendant,
permitting this case to go forward”). Further, courts “permit expedited discovery before
the Rule 26(f) conference upon a showing of good cause.” Am. LegalNet, Inc. v. Davis,
673 F. Supp. 2d 1063, 1066 (C.D. Cal. 2009). “Good cause exists where the need for
expedited discovery, in consideration of the administration of justice, outweighs the
prejudice to the responding party.” Id. (internal quotations omitted).
When considering a request for expedited discovery to uncover the identity of a
defendant, the Court applies the following “limiting principles:” (1) “the plaintiff should
identify the missing party with sufficient specificity such that the Court can determine that
defendant is a real person or entity who could be sued in federal court;” (2) the plaintiff
“should identify all previous steps taken to locate the elusive defendant,” confirming that
plaintiff made a good faith effort to identify and serve the defendant; and (3) the “plaintiff
should establish to the Court’s satisfaction that plaintiff’s suit against defendant could
withstand a motion to dismiss.” Columbia Ins., 185 F.R.D. at 578–80. These factors ensure
this unusual discovery procedure is employed only “in cases where the plaintiff has in good
faith exhausted traditional avenues for identifying a civil defendant pre-service” and
“prevent use of this method to harass or intimidate.” Id.
III. 	DISCUSSION
Plaintiff contends there is good cause for this Court to allow expedited discovery.
ECF No. 4-1 at 11–17. For the reasons stated below, the Court agrees.
A. 	Identification of Doe Defendant with Sufficient Specificity
Courts in this circuit agree that “a plaintiff identifies Doe defendants with sufficient
specificity by providing the unique IP addresses assigned to an individual defendant on the
day of the allegedly infringing conduct, and by using ‘geolocation technology’ to trace the
IP addresses to a physical point of origin.” See 808 Holdings, LLC v. Collective of
December 29, 2011 Sharing Hash, No. 12-cv-186-MMA (RBB), 2012 WL 12884688, at
*4 (S.D. Cal. May 4, 2012); OpenMind Solutions, Inc. v. Does 1-39, No. C-11-3311-MEJ,
2011 WL 4715200, at *2 (N.D. Cal. Oct. 7, 2011) (concluding that plaintiff satisfied the
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
3 of 9

4
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
first factor by identifying the defendants’ IP addresses and by tracing the IP addresses to a
point of origin within the State of California); Pink Lotus Entm’t, LLC v. Does 1–46, No.
C-11-02263, 2011 WL 2470986, at *3 (N.D. Cal. June 21, 2011) (same). Other courts
conclude that merely identifying the IP addresses on the day of the alleged infringement
satisfies this factor. 808 Holdings, 2012 WL 12884688, at *4 (collecting cases).
Here, Plaintiff identified the Doe defendant with sufficient specificity. First, Plaintiff
provides a Declaration by Jorge Arco, an independent contractor hired by Plaintiff as an
“Enterprise Architect.” ECF No. 4-2, Ex. A (“Ex. A”) at ¶ 12. Mr. Arco “was part of a team
that developed the infringement detection system VXN Scan” (“VXN Scan”), which
Plaintiff “owns and uses to identify the IP addresses used” to infringe Plaintiff’s movies
via the BitTorrent protocol. Ex. A at ¶ 41. Mr. Arco currently participates in “the
maintenance and evolution of VXN and Cross Reference Tool components.” Id. Mr. Arco
explains VXN Scan in detail, which involves, in part, the development of a proprietary
BitTorrent client that emulates the behavior of a standard BitTorrent client by repeatedly
downloading data pieces from peers within the BitTorrent network that are distributing
Plaintiff’s movies. Id. at ¶¶ 53–56.
Per Mr. Arco, a separate component of VXN Scan is the PCAP 2 Recorder / Capture
Card, 	which 	allows 	Plaintiff 	to 	“record 	numerous 	infringing 	BitTorrent 	computer
transactions in the form of PCAPs.” Id. at ¶¶ 61–63; see also Declaration of Patrick Paige,
ECF No. 4-2, Ex. B (“Ex. B”) at ¶ 14 (explaining that “PCAP is a computer file containing
captured or recorded data transmitted between network devices;” “it is a recording of
network traffic”). The PCAPs show “particular IP addresses connecting to the Proprietary
Client and sending pieces of a computer file (which contains an infringing copy of
Plaintiff’s works) to the Proprietary Client.” Ex. A at ¶ 63; see Ex. B at ¶ 15. Not only does
a PCAP contain the IP addresses used in the network transaction, it also records the port
2 PCAP stands for “Packet Capture,” a computer file containing captured or recorded data
transmitted between network devices. Ex. A at ¶ 62.
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
4 of 9

5
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
number and BitTorrent client used to accomplish each transaction, and the “Info Hash
value that was used to obtain the transacted piece,” which in turn, “identifies the data that
was shared in the recorded transaction.” Ex. A at ¶¶ 65–66. The PCAP Capture Card
records perfect copies of every network packet received by the Proprietary Client. Id. at ¶
69. Although this Order touches only on two of the components of VXN Scan, Mr. Arco’s
92-paragraph Declaration sets forth additional in-depth details of all six components of the
system and the Cross Reference Tool, providing a thorough explanation of how the system
reliably pinpoints the IP addresses used by individuals infringing Plaintiff’s movies and
verifies the infringement.
Second, Plaintiff also provides a declaration by Patrick Paige, a computer forensics
expert retained by Plaintiff to analyze and retain forensic evidence captured by VXN Scan.
Ex. B at ¶¶ 3, 12. Mr. Paige “received a PCAP from Strike 3 containing information relating
to 	a 	transaction 	initiated 	on 	02/01/2026 	00:24:03 	UTC 	involving 	IP 	address
104.177.118.15.” Id. at ¶ 16. Based on his review, Mr. Paige confirms that the “PCAP is
evidence of a recorded transaction with IP address 104.177.118.15 initiated at 02/01/2026
00:24:03 UTC” and “shows that within that transaction, IP address 104.177.118.15
uploaded 	a 	piece 	or 	pieces 	of 	a 	file 	corresponding 	to 	hash 	value
ED50E33FA026B5C523EBF23A005E4E1304778A49 to VXN Scan,” i.e., a hash value
that is unique to one of Plaintiff’s movies. Id. at ¶¶ 13–19; see also ECF No. 1-2 (Exhibit
A to the Complaint, listing the hash values of the 36 torrent files received by the Proprietary
Client from the IP address 104.177.118.15).
Third, Plaintiff provides a declaration by Susan B. Stalzer, Plaintiff’s employee.
ECF No. 4-2 at Ex. C (“Ex. C”). Based on a side-by-side comparison with Plaintiff’s
original movies, Ms. Stalzer verifies that each digital file that the Proprietary Client
received through its transactions with IP address 104.177118.15 is a copy of one of
Plaintiff’s copyrighted works that is identical, strikingly similar, or substantially similar to
the original work. Id. at ¶¶ 8–11; see also ECF No. 1-2.
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
5 of 9

6
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Finally, Plaintiff provides a declaration by Emilie Kennedy, Plaintiff’s in-house
General Counsel. ECF No. 4-2 at Ex. D (“Ex. D”). Ms. Kennedy explains that after Plaintiff
received infringement data from VXN Scan, identifying IP address 104.117.118.15 as
infringing its works, the IP address was automatically input into Maxmind’s Geolocation
Database, which first traced the IP address to a location in San Diego, California. Id. at ¶¶
4–5. Per Ms. Kennedy, Plaintiff subsequently repeated the trace through the Geolocation
Database (prior to filing the Complaint and prior to filing her declaration), which again
traced the IP address to San Diego, California, a location within this Court’s jurisdiction.
Id. at ¶¶ 6–7; see ECF No. 4-2 at 36. The Court is satisfied that these multiple geolocation
traces are reliably accurate and support a finding that the Doe defendant is located in this
District.
Based on the foregoing, the Court finds that Plaintiff identified the Doe defendant
with sufficient specificity and seeks to sue a real person subject to the Court’s jurisdiction.
Moreover, by obtaining the identifying information for the IP address at issue, the
discovery sought would likely enable Plaintiff to serve the Doe defendant.
B. 	Previous Attempts to Locate the Doe Defendant
The Application also describes Plaintiff’s efforts to identify, locate, and serve the
Doe defendant. Plaintiff attempted to locate the Doe defendant by searching for the IP
address using online search engines and other web search tools. ECF No. 4-1 at 14. Plaintiff
also reviewed numerous sources of authority such as legislative reports, agency websites,
informational technology guides, etc. regarding whether it is possible to identify such a
defendant by other means, and extensively discussed this issue with its computer
investigators and cyber security consultants. Id. Despite these diligent efforts, Plaintiff was
unable to identify any means of obtaining the identity of Doe defendant other than through
subpoenaing the information from the ISP. Id.; see also Ex. B at ¶ 28. Thus, the Court finds
Plaintiff has shown it has made a good faith effort to identify and locate the Doe defendant
before resorting to filing the instant Application.
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
6 of 9

7
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
C. 	Whether Plaintiff’s Complaint Can Withstand a Motion to Dismiss
Lastly, to establish that the Complaint could survive a motion to dismiss, Plaintiff
must “make some showing that an act giving rise to civil liability actually occurred and
that the discovery is aimed at revealing specific identifying features of the person or entity
who committed that act.” Columbia Ins., 185 F.R.D. at 580; see also Fed. R. Civ. P. 12(b).
To present a prima facie case of copyright infringement, Plaintiff must show: (1) ownership
of a valid copyright; and (2) that Defendant violated the copyright owner’s exclusive rights
under the Copyright Act. Bell v. Wilmott Storage Servs., LLC, 12 F.4th 1065, 1071 (9th
Cir. 2021). A prima facie case of direct copyright infringement must also show causation
by the Defendant. Id. at 1080.
Here, the Complaint alleges that Plaintiff owns a valid copyright in the works at
issue, which are registered with the United States Copyright Office. See ECF No. 1 at ¶¶ 43,
44, 46.3 Ms. Stalzer attests that she reviewed the files correlating to the hashes identified
in Exhibit A to the Complaint and confirmed that they are “identical, strikingly similar or
substantially similar” to Strike 3’s original copyrighted Works. Ex. C at ¶¶ 7–11; see ECF
No. 1 at ¶¶ 34–35. Plaintiff’s Complaint also alleges Doe defendant used BitTorrent to
copy and distribute the copyrighted works without authorization, and that the infringement
was continuous and ongoing. ECF No. 1 at ¶¶ 4, 19–30, 33–36, 45–46. Thus, Plaintiff’s
Complaint has stated a claim for copyright infringement against the Doe defendant.
Additionally, Plaintiff has alleged sufficient facts to show it could withstand a motion to
dismiss for lack of personal jurisdiction or a motion for improper venue because Plaintiff
traced the IP address at issue to this District. Further, Mr. Paige declares that based on his
experience in similar cases, the ISP, AT&T Inc., is the only entity that can correlate the IP
3 Exhibit A to the Complaint, which shows the hash values of the purportedly infringing
movies downloaded from IP address 104.177.118.15, also contains the United States
Copyright Office registration information of the works that correspond with those hash
files. ECF No. 1-2.
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
7 of 9

8
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
address 104.177.118.15 to its subscriber to pinpoint the Doe defendant’s identity. Ex. B at
¶ 28.
Accordingly, coupled with the information provided by Mr. Arco and Mr. Paige in
their respective declarations, the Court is satisfied that Plaintiff’s Complaint would survive
a motion to dismiss.
IV. 	CONCLUSION
For the reasons set forth above, and for good cause shown, the Court GRANTS
Plaintiff’s Application. ECF No. 4. However, the Court is cognizant of the potential
embarrassment of being identified in this type of case and “shares the growing concern
about unscrupulous tactics used by certain plaintiffs, especially in the adult film industry,
to shake down the owners of IP addresses.” Malibu Media, LLC v. Does 1-5, No. 12-Civ-
2950-JPO, 2012 WL 2001968, at *1 (S.D.N.Y. June 1, 2012). Anticipating and sharing
these concerns, Plaintiff invites the Court to issue a protective order establishing procedural
safeguards if the Court finds such procedures appropriate. ECF No. 4-1 at 18. Accordingly,
the Court ORDERS as follows:
1. 	Plaintiff SHALL attach a copy of this Order to any Rule 45 subpoena.
2. 	Plaintiff may serve the ISP with a Rule 45 subpoena commanding the ISP to
provide Plaintiff with only the true name and address of the subscriber to whom the ISP
assigned IP address 104.177.118.15, as set forth on Exhibit A to the Complaint. The ISP is
not to release the subscriber’s telephone number or email address.
3. 	Within fourteen (14) calendar days after service of the subpoena, the ISP
SHALL notify the subscriber that his or her identity has been subpoenaed by Plaintiff. The
ISP must also provide a copy of this Order along with the required notice to the subscriber
whose identity is sought pursuant to this Order.
4. 	The subscriber whose identity has been subpoenaed shall have thirty (30)
calendar days from the date of such notice to challenge the disclosure of his or her name
and address by filing an appropriate pleading with this Court contesting the subpoena. A
subscriber who moves to quash or modify the subpoena may proceed anonymously as
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
8 of 9

9
3:26-cv-01120-LL-VET
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
“John Doe” or “Jane Doe,” and shall remain anonymous until the Court orders that the
identifying information may be released.
5. 	If the ISP wishes to move to quash the subpoena, it shall do so before the
return date of the subpoena. The return date of the subpoena must allow for at least forty-
five (45) days from service to production. If a motion to quash or other challenge is brought,
the ISP shall preserve the information sought by Plaintiff in the subpoena pending
resolution of such motion or challenge.
6. 	Plaintiff may only use the information disclosed in response to a Rule 45
subpoena served on the ISP for the purpose of protecting and enforcing Plaintiff’s rights
as set forth in its Complaint. If the subscriber wishes to proceed anonymously, Plaintiff
may not release any identifying information without a court order allowing the release of
the information.
IT IS SO ORDERED.
Dated: March 23, 2026 	__________________________________
Honorable Valerie E. Torres
United States Magistrate Judge
Case 3:26-cv-01120-LL-VET Document 5 Filed 03/23/26 PageID.<pageID> Page
9 of 9