*1209This case involves an alleged worldwide Ponzi scheme and the antifraud provisions of the federal Securities Act of 1933 and the Securities Exchange Act of 1934. Defendant Charles Scoville operated an internet traffic exchange business through his Utah company, Defendant Traffic Monsoon, LLC. The Securities and Exchange Commission ("SEC") initiated this civil enforcement action, alleging Defendants were instead operating an unlawful online Ponzi scheme involving the fraudulent sale of securities. In this interlocutory appeal, Scoville challenges several preliminary orders the district court issued at the outset of this still ongoing enforcement action, including orders freezing Defendants' assets, appointing a receiver, and preliminarily enjoining Defendants from continuing to operate their business.

In upholding these preliminary rulings, we conclude first that the antifraud provisions of the federal securities laws reach Traffic Monsoon's sales to customers outside the United States because, applying the conduct-and-effects test added to the federal securities laws by the 2010 Dodd-Frank Act, Traffic Monsoon undertook significant conduct in the United States to make those sales to persons abroad. We further conclude that Traffic Monsoon's Adpacks (bundled internet advertising services that allowed a purchaser to share in some of Traffic Monsoon's revenue) qualified as investment contracts, which are securities regulated under the 1933 and 1934 securities acts. We further conclude that the SEC has asserted sufficient evidence to make it likely that the SEC will be able to prove that Defendants were operating a fraudulent scheme-a Ponzi scheme-selling Adpacks and that scheme violated the antifraud statutes invoked in this litigation. Having jurisdiction under 28 U.S.C. § 1292(a)(1) and (2), we, therefore, AFFIRM the district court's challenged preliminary orders.

I. BACKGROUND

The parties have very different versions of Traffic Monsoon's business model. According to the SEC, Traffic Monsoon was operating a Ponzi scheme; that is, a fraudulent scheme in which the business pays returns to its investors that are financed, not by the success of the business, but instead with money acquired from later investors. See S.E.C. v. Thompson, 732 F.3d 1151, 1154 n.3 (10th Cir. 2013) ; Okla. Dep't of Sec. ex rel. Faught v. Wilcox, 691 F.3d 1171, 1173 n.2 (10th Cir. 2012).

Scoville claims, instead, that Traffic Monsoon is a legitimate internet traffic exchange offering internet advertising services. Such a business is based on the fact that internet search engines such as Google use algorithms that rank more frequently visited websites higher than less frequently visited websites. In light of this, website traffic exchange businesses sell visits to a purchaser's website in order to make that website look more popular than it really is. Scoville operated several other website traffic exchanges before starting Traffic Monsoon in September 2014.

Scoville is the sole member, manager and registered agent of Traffic Monsoon, a Utah limited liability company. Scoville is also Traffic Monsoon's sole employee, running the business from his Utah apartment. The company contracts with a Russian *1210computer programmer and several call centers hired to respond to telephone inquiries from Traffic Monsoon's customers.

Scoville operated Traffic Monsoon through a website, www.trafficmonsoon.com, which was housed on servers physically located in the United States. Someone wanting to do business with Traffic Monsoon first had to become a member by going to the website and creating an account. The member could then purchase through the website several different advertising services. For example, for $5, a member could purchase twenty clicks on the member's online advertisement, and for $5.95 a member could purchase 1,000 visits to his website.

Alternatively, instead of purchasing these services "ala carte," a member could purchase an Adpack for $50. A single Adpack entitled a member to receive 1,000 visits to his website and twenty clicks on his internet ad (a $10.95 value), plus the opportunity to share in Traffic Monsoon's revenue up to a maximum amount of $55. An Adpack purchaser qualified to share in Traffic Monsoon's revenue for each day that the purchaser clicked on ten (later fifty1 ) internet ads for other Traffic Monsoon members' websites and remained on the ad's landing page for five seconds. In this way, Scoville gave Adpack purchasers an incentive to provide some of the advertising traffic that Traffic Monsoon was selling to its members.

Traffic Monsoon made it easy for members to complete their daily qualifying advertising clicks. When an Adpack purchaser logged onto his account, Traffic Monsoon would present rotating ads on which the member could click.

The [member] is required to view each banner ad for only 5 seconds, and a counter appears that counts down the 5 seconds for [the member]. At the end of that time the [member] must click on an image that appears, to verify that he is human, and then the next banner ad appears automatically. The act of completing the 50 clicks takes the [member] 4.1 minutes per day.

(Aplt. App. at 18-19 ¶ 31 (bracketed material added).)

Each day that the Adpack purchaser completed the requisite number of clicks, the purchaser qualified to share in Traffic Monsoon's revenue earned during the preceding twenty-four hours. Ninety-nine percent of Adpack purchasers qualified to share in at least some of Traffic Monsoon's revenue. But "neither the website nor any other publicly available source of information informed the members how Traffic Monsoon split the revenue between itself and qualified Adpack holders." (Id. 2068 ¶ 14.) Furthermore, because Traffic Monsoon "kept no accounting records[,] ... there are no readily available documents that describe precisely how the money was distributed." (Id. 2067 ¶ 13.) Typically an Adpack purchaser would earn $1 in shared revenue for each day that he made the requisite number of qualifying clicks. That meant that in approximately fifty-five days an Adpack purchaser could reach the maximum $55 return, recouping the $50 the member originally paid for the Adpack plus earning an additional $5 (a 10% return over the fifty-five days). When an Adpack purchaser reached the maximum $55 limit in revenue sharing, that member could either use that money to purchase another $50 Adpack, or he could withdraw some or all of his money.

A member could buy as many $50 Adpacks as he wanted; some members owned *1211hundreds or even thousands of Adpacks. Significantly, no matter how many Adpacks a member purchased, the member could qualify to share in Traffic Monsoon's revenue on all of those Adpacks through a single four-minute session clicking on other members' ads. So, for example, if a member bought 100 Adpacks for $5,000 and spent just four minutes a day for fifty-five days clicking on other Traffic Monsoon members' ads, the Adpack purchaser would earn back the original $5,000 he paid for all 100 Adpacks plus an additional 10% return of $500. If a member consistently rolled over his Adpacks every fifty-five days, instead of cashing out, he would earn a 66% annual return on his original $50 purchase and in a year he would have 166 Adpacks. In three years, he could earn "$25,080-over five times the initial [$5,000] investment." (Id. 2073-74 ¶ 30.)

A second way a Traffic Monsoon member could earn money was to recruit other members. The recruiting member would earn a 10% commission on every advertising service the recruited member purchased. This included Adpacks the recruit purchased, both with new money and by rolling over earnings from prior Adpacks. The district court noted that "for all $50 Adpacks that were purchased by a referred member, Traffic Monsoon typically deposited $60 worth of credits in member accounts: $55 into the purchasing member's account over a 55-day period (so long as the member qualified [to share revenue] ) and $5 into the referring member's account." (Id. 2068-69 ¶ 17.)

The district court found that, while "[s]ome individuals initially purchased Adpacks principally as a way to promote their online businesses[,] ... for many members, the profits that could be reaped from the Adpacks themselves quickly eclipsed this motive." (Id. 2071 ¶ 23.) "Indeed, many members have not received or used the web visits and banner clicks purchased in the Adpack" (id. 2072 ¶ 24), because Traffic Monsoon only delivered about 10% of the clicks and website visits it sold as part of the Adpacks.

Before buying an Adpack, the member had to agree with Traffic Monson that the Adpack was not an "investment" and that Traffic Monsoon's "past performance does not guarantee [the purchaser] the same result in the future." (Id. 2069 ¶ 18 (internal quotation marks omitted).) Traffic Monsoon's website also included a lengthy explanation to its members as to why it was not operating a Ponzi scheme. The website further stated that the revenue Traffic Monsoon shared with its qualifying members was earned from the sale of all of its services, and not just Adpacks. But the website did not explain that Adpacks actually made up more than 98% of Traffic Monsoon's sales. In fact, Traffic Monsoon misrepresented that its other advertising services were more popular than Adpacks.

Adpacks became enormously popular. Between October 2014 and July 2016, when the SEC initiated this civil enforcement action, members paid Traffic Monsoon $173 million in new money to purchase 3.4 million Adpacks and purchased approximately 14 million additional Adpacks-for $700 million-by rolling over money earned from earlier Adpacks. During this same time period, members paid only $2.9 million for all other Traffic Monsoon advertising services. Of the total amount of $175.9 million in cash Traffic Monsoon took in over this period, it distributed approximately $88 million to its members, "leaving a difference of $87.4 million between what has been paid in by members and what they have taken out." (Id. 2074 ¶ 32.)

Ninety percent of Adpacks were purchased by people who live outside the United States. Adpacks were especially popular in poorer countries, including Bangladesh, Venezuela, and Morocco.

*1212"A large majority of the financial transactions the members completed with Traffic Monsoon-both payments made to Traffic Monsoon and withdrawals from the member's [sic] account-were conducted through PayPal." (Id. 2066 ¶ 6.) In January 2016, because "PayPal became concerned about the enormous growth in the volume of transactions between Traffic Monsoon and its members," PayPal "froze Traffic Monsoon's account." (Id. 2074 ¶ 33.) Traffic Monsoon then began using other electronic payment processors. The PayPal freeze lasted until July 11, 2016. The SEC brought this enforcement action two weeks later. During those interim two weeks, Scoville withdrew $23 million from Traffic Monsoon's PayPal accounts, in increments of $100,000, which is the maximum withdrawal PayPal allows at one time. Scoville tried to withdraw another $10 million, but PayPal reversed those transactions.

"The receiver currently has between $50-$60 million in frozen Traffic Monsoon assets" (id. 2075 ¶ 37), and "[t]he current combined account balance of Traffic Monsoon members is $34.2 million" (id. 2075 ¶ 36). But members "typically had relatively little money in their account because the members would continually reinvest it by purchasing new Adpacks." (Id. 2072 ¶ 27.) "If the outstanding Adpacks currently owned by Traffic Monsoon members had matured, the [members'] account balance would" have increased from $34 million to $278.1 million." (Id. 2075 ¶ 36.)

II. THIS SEC ENFORCEMENT ACTION

The SEC initiated this civil enforcement action on July 26, 2016, invoking the district court's jurisdiction under 15 U.S.C. §§ 77t, 77v, 78u, and 78aa. Relevant to this appeal, the SEC contends that Defendants violated § 17(a)(1) and (a)(3) of the Securities Act of 1933, which prohibit fraud or deception in the offer or sale of securities,2 and § 10(b) of the Securities Exchange Act of 1934 and SEC Rule 10b-5(a) and (c), which prohibit fraud or deception "in connection with the purchase or sale of any security."3 As relief, the SEC seeks to *1213enjoin Defendants permanently from engaging in this scheme, to impose civil penalties, and to disgorge all Defendants' "ill-gotten gains" (Aplt. App. 32).

At the time the SEC initiated this enforcement action, it obtained ex parte three preliminary orders from the district court 1) freezing Defendants' assets; 2) appointing a receiver over those assets and over Defendants' business; and 3) entering a temporary restraining order ("TRO") prohibiting Defendants from continuing to operate their business. After an adversarial evidentiary hearing, the district court made the TRO a preliminary injunction and denied Defendants' motion to set aside the receivership. It is these two rulings that are at issue in this interlocutory appeal.

We grant the receiver's motion to appear on appeal as an amicus. The receiver asserts that, although the notice of appeal named both Scoville and Traffic Monsoon as appellants, the receiver has not authorized Traffic Monsoon's appeal. Furthermore, the attorney who filed the notice of appeal informed the district court that, while he represented Scoville, the attorney did not represent Traffic Monsoon because the company was in receivership. For these reasons, Traffic Monsoon is not a proper party to this appeal. Nevertheless, the district court recently authorized Scoville "to appeal and advance arguments on behalf of Traffic Monsoon in th[is] appeal." (Doc. 120.)4 Consequently, our rulings on this appeal similarly apply to Traffic Monsoon.

III. STANDARD OF REVIEW

This court reviews the district court's order appointing a receiver, and refusing to set aside that order, for an abuse of discretion. See DeTar Distrib. Co. v. Tri-State Motor Transit Co., 379 F.2d 244, 252 (10th Cir. 1967). See generally SEC v. Vescor Capital Corp., 599 F.3d 1189, 1194, 1198 (10th Cir. 2010) (recognizing, in SEC civil action, district court's equitable power to appoint a receiver and the court's "broad powers and wide discretion to determine relief in an equity receivership" (internal quotation marks, alteration omitted) ).

We also review the district court's decision to grant a preliminary injunction for an abuse of discretion. See McDonnell v. City & Cty. of Denver, 878 F.3d 1247, 1252 (10th Cir. 2018). "A district court abuses its discretion when it commits an error of law or relies upon a clearly erroneous factual finding." Id. (internal quotation marks omitted).

A movant is not entitled to a preliminary injunction unless he can show: (1) he is likely to succeed on the merits of his claim; (2) he will suffer irreparable harm if the injunction is denied; (3) his threatened injury outweighs the harm the grant of the injunction will cause the opposing party; and (4) if issued, the injunction will not adversely affect the public interest. Because the grant of a preliminary injunction is "an extraordinary remedy," the movant must make a "clear showing" that he is entitled to the injunction.

*1214Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 22, 129 S.Ct. 365, 172 L.Ed.2d 249 ... (2008). Further, the movant must meet a heightened burden if he seeks a preliminary injunction, like the one [at issue here], that will alter the status quo. When "seeking such an injunction [the movant] must make a strong showing both with regard to the likelihood of success on the merits and with regard to the balance of the harms." O Centro Espirita Beneficiente Uniao Do Vegetal v. Ashcroft, 389 F.3d 973, 976 (10th Cir. 2004) (en banc) [ (per curiam) ].

McDonnell, 878 F.3d at 1252 (citations omitted) (bracketed material added).5 On appeal, Scoville focuses only on whether the SEC has made a sufficient showing of the likelihood of its success on its antifraud claims.

IV. DISCUSSION

Scoville challenges both the preliminary injunction and the receivership primarily on three grounds. First, he contends that the antifraud provisions of the federal securities acts do not apply to offers to sell, and sales of, Adpacks to Traffic Monsoon members located outside the United States. The extraterritorial reach of a federal statute is a matter of congressional intent and Congress has clearly indicated, through the 2010 Dodd-Frank Act amendments to the securities laws, that the antifraud provisions apply when either significant steps are taken in the United States to further a violation of those antifraud provisions or conduct outside the United States has a foreseeable substantial effect within the United States. Because Scoville engaged in conduct within the United States that has been shown likely to have violated the securities laws, we conclude the antifraud provisions reach Traffic Monsoon's sale of Adpacks outside the United States.

Second, Scoville argues that Adpacks are not "securities" and so are not subject to federal securities laws. We reject that argument because Adpacks meet the three-part test for investment contracts, which qualify as securities regulated by federal law.

Lastly, Scoville contends that the SEC has failed to show it is likely to succeed in proving the elements of its antifraud claims and, in particular, cannot show that Defendants engaged in a fraudulent securities scheme with the requisite scienter. We reject those arguments because the SEC presented sufficient evidence that Defendants were likely operating a fraudulent scheme-a Ponzi scheme-and likely doing so with the required scienter. For these reasons, explained in greater detail below, and because we conclude the remainder of Scoville's arguments lack merit, we affirm the district court's rulings entering a preliminary injunction and refusing to set aside the receivership.

A. The antifraud provisions reach Traffic Monsoon's sales of, or offers to sell, Adpacks to purchasers located outside the United States

Scoville first asserts that the antifraud provisions of the federal securities acts do not reach Traffic Monsoon's sales of, or offers to sell, Adpacks to people living outside the United States. That amounts to 90% of Traffic Monsoon's Adpack sales.

*12151. Congress has provided that the antifraud provisions apply extraterritorially when significant steps are taken in the United States to further a violation or conduct occurring outside the United States has a foreseeable substantial effect within the United States

Whether a federal statute applies to conduct outside the United States is a question of congressional intent. See Morrison v. Nat'l Australia Bank Ltd., 561 U.S. 247, 255, 130 S.Ct. 2869, 177 L.Ed.2d 535 (2010). There is a presumption that Congress intends a statute to apply only within the United States, see id., unless Congress has "affirmatively and unmistakably" indicated that the statute should apply extraterritorially, RJR Nabisco, Inc. v. European Cmty., --- U.S. ----, 136 S.Ct. 2090, 2100, 195 L.Ed.2d 476 (2016). "When a statute gives no clear indication of an extraterritorial application, it has none." Morrison, 561 U.S. at 255, 130 S.Ct. 2869.

"Th[e] [Supreme] Court has established a two-step framework for deciding questions of extraterritoriality." WesternGeco LLC. v. ION Geophysical Corp., --- U.S. ----, 138 S.Ct. 2129, 2136, 201 L.Ed.2d 584 (2018). "The first step asks 'whether the presumption against extraterritoriality has been rebutted.' " Id. (quoting RJR Nabisco, 136 S.Ct. at 2101 ). "If the presumption against extraterritoriality has not been rebutted, the second step of our framework asks 'whether the case involves a domestic application of the statute.' " Id. (quoting RJR Nabisco, 136 S.Ct. at 2101 ). If either step is satisfied, the statute applies to the challenged conduct. See id.

Here, we can resolve at step one the question of the extraterritorial reach of the antifraud provisions because it is clear that Congress "affirmatively and unmistakably" directed that those provisions apply extraterritorially in an enforcement action. Through the 2010 Dodd-Frank Act, Congress amended both the 1933 and 1934 securities acts to state:

The district courts of the United States and the United States courts of any Territory shall have jurisdiction of an action or proceeding brought or instituted by the Commission or the United States alleging a violation of section 77q(a) of this title [Section 17(a) of the 1933 Securities Act] involving-

(1) conduct within the United States that constitutes significant steps in furtherance of the violation, even if the securities transaction occurs outside the United States and involves only foreign investors; or

(2) conduct occurring outside the United States that has a foreseeable substantial effect within the United States.

15 U.S.C. § 77v(c) (bracketed material added); see also id. § 78aa(b) (amended 1934 Securities Exchange Act providing federal district courts with "jurisdiction of an action or proceeding brought or instituted by the [SEC] or the United States alleging a violation of the antifraud provisions of this chapter involving--(1) conduct within the United States that constitutes significant steps in furtherance of the violation, even if the securities transaction occurs outside the United States and involves only foreign investors; or (2) conduct occurring outside the United States that has a foreseeable substantial effect within the United States").

Scoville argues that, while Dodd-Frank amended these jurisdictional provisions of the securities acts, Congress has not expressly stated that the antifraud provisions of those securities acts apply extraterritorially. We reject that argument in light of the specific context in which Congress enacted the 2010 jurisdictional amendments as part of the Dodd-Frank Act. See *1216Morrison, 561 U.S. at 265, 130 S.Ct. 2869 (stating, in determining whether a statute applies extraterritorially, that "[a]ssuredly context can be consulted"); see also RJR Nabisco, 136 S.Ct. at 2102 ; Kiobel v. Royal Dutch Petroleum Co., 569 U.S. 108, 119, 133 S.Ct. 1659, 185 L.Ed.2d 671 (2013) (looking to "historical background against which the [statute at issue there] was enacted" to determine whether presumption against extraterritorial application had been rebutted).

Historically, Congress, in originally enacting the federal securities acts in 1933 and 1934, did not address the extraterritorial reach of the antifraud provisions of those statutes. See Morrison, 561 U.S. at 255, 130 S.Ct. 2869 (addressing specifically § 10(b) ). Notwithstanding that fact, courts of appeals for over forty years applied the antifraud provisions of those acts extraterritorially when "wrongful conduct occurred in the United States" or when conduct outside the United States had a "substantial effect in the United States or upon United States citizens." Id. at 257, 130 S.Ct. 2869 (internal quotation marks omitted); see also id. at 255-60, 130 S.Ct. 2869. This became known as the conduct-and-effects test. Id. at 259, 130 S.Ct. 2869 ; see also id. at 257-59, 130 S.Ct. 2869. The courts of appeals treated application of the conduct-and-effects test to decide when the federal securities acts applied extraterritorially as a matter of subject-matter jurisdiction. Id. at 253-54, 257-60, 130 S.Ct. 2869.

In 2006, in a completely different context (a Title VII employment case), the Supreme Court addressed the difference between matters that implicate a federal court's subject-matter jurisdiction and matters that go, instead, to proving an element of a claim. See Arbaugh v. Y&H Corp., 546 U.S. 500, 503, 126 S.Ct. 1235, 163 L.Ed.2d 1097 (2006). Distinguishing between the two issues also turns on congressional intent. Id. at 514-15, 126 S.Ct. 1235. In Arbaugh, the Supreme Court held that the statutory provision restricting application of Title VII only to employers with fifteen or more employees was not a jurisdictional prerequisite but instead went to the merits of a Title VII claim. 546 U.S. at 503, 515-16, 126 S.Ct. 1235. The Court reached that conclusion because Congress placed this fifteen-employee requirement, not in the statute's jurisdictional provision, but instead in the definitions section of the statute, id. at 514-15, 126 S.Ct. 1235 ; "when Congress does not rank a statutory limitation on coverage as jurisdictional, courts should treat the restriction as nonjurisdictional in character," id. at 516, 126 S.Ct. 1235.

Returning to the specific question at issue here, the extraterritorial reach of the antifraud provisions of the federal securities laws, the Second Circuit, in 2008, applied a conduct-and-effects test to such a securities case in Morrison v. National Australian Bank Ltd. to determine the district court's subject-matter jurisdiction. 547 F.3d 167, 170-71 (2d Cir. 2008). In doing so, however, the Second Circuit noted that Congress, in enacting the securities laws, had never addressed the extraterritorial reach of their antifraud provisions and "urge[d] that this significant omission receive the appropriate attention of Congress ...." Id. at 170 & n.4. The Supreme Court granted certiorari to review the Second Circuit's Morrison decision. See 558 U.S. 1047, 130 S.Ct. 783, 175 L.Ed.2d 513 (Nov. 30, 2009).

In the meantime, Congress accepted the Second Circuit's invitation and, in October 2009, amendments to the federal securities acts were proposed that would eventually become § 929P(b) of the Dodd-Frank Act; those amendments added the extraterritorial language now found in *121715 U.S.C. §§ 77v(c) and 78aa(b), quoted previously in this opinion, see supra p. 1215.

The Supreme Court, however, decided Morrison before Congress finalized those amendments. The specific question presented to the Supreme Court in Morrison was whether § 10(b), the antifraud provision of the 1934 Act, applied to purchases by Australians on the Australian stock exchange of shares in the National Bank of Australia. 561 U.S. at 250-52, 130 S.Ct. 2869. The Australian purchasers brought suit in the United States under American securities laws, alleging that the Australian Bank's stock lost value after the Bank bought an American mortgage servicing company whose owners had misrepresented the value of that company to the Australian Bank. Id. at 251-53, 130 S.Ct. 2869.

In Morrison, the Supreme Court, relying on the Arbaugh line of cases, first held, contrary to decades of circuit-level authority, that the question of whether federal securities laws applied extraterritorially was not a matter of subject-matter jurisdiction, but instead went to the merits of the claim. Id. at 253-54, 130 S.Ct. 2869 ("[T]o ask what conduct § 10(b) reaches is to ask what conduct § 10(b) prohibits, which is a merits question. Subject-matter jurisdiction, by contrast, refers to a tribunal's power to hear a case." (internal quotation marks omitted) ).

Second, Morrison held that, because Congress, in originally enacting § 10(b), did not address whether that provision applied extraterritorially, § 10(b) did not apply outside the United States. Id. at 255, 130 S.Ct. 2869. Morrison, therefore, concluded that the courts of appeals were wrong to apply their conduct-and-effects tests to determine when § 10(b) applied outside the United States because § 10(b) simply did not apply extraterritorially. Id. at 255-65, 130 S.Ct. 2869. Instead, focusing on the language of § 10(b), the Court held that that antifraud provision only applied domestically; that is, to fraud only "in connection with the purchase or sale of a security listed on an American stock exchange, and the purchase or sale of any other security in the United States."6 Id. at 273, 130 S.Ct. 2869.

The Supreme Court issued Morrison on June 24, 2010. At that time, the proposed Dodd-Frank Act was before a joint congressional committee tasked with ironing out differences in the House and Senate versions of that bill. One such difference was that the House had included what eventually became § 929P(b), addressing as a jurisdictional matter the extraterritorial application of the antifraud provisions, while the Senate had removed that proposed amendment. The day that the Supreme Court issued Morrison was the final day that the joint committee considered the proposed Dodd-Frank Act. See SEC v. Gruss, 859 F.Supp.2d 653, 664 (S.D. N.Y. 2012). The committee published the final version of the bill several days later, and it included § 929P(b). The Dodd-Frank Act was enacted into law on July 21, 2010, less than a month after Morrison.

Morrison, then, contrary to forty years of circuit-level law, held that the question of the extraterritorial reach of § 10(b) did not implicate a court's subject-matter jurisdiction;

*1218instead, other provisions of the securities acts gave district courts subject-matter jurisdiction to hear SEC enforcement actions generally. 561 U.S. at 254-55, 130 S.Ct. 2869 (citing 15 U.S.C. § 78aa ). But Congress, in the Dodd-Frank Act, amended only the jurisdictional sections of the securities laws to indicate that the antifraud provisions applied extraterritorially when a version of the conduct-and-effects test is met. The Dodd-Frank Act did not make any explicit revisions to the substantive antifraud provisions themselves. See generally U.S. SEC v. Chicago Convention Ctr., LLC, 961 F.Supp.2d 905, 910 (N.D. Ill. 2013) (recognizing that "the plain language of the Section 929P(b) seems purely jurisdictional-particularly in light of its placement in the jurisdictional section of the Exchange Act-yet the Congressional intent behind that provision supports the conclusion that the provision is substantive").

Notwithstanding the placement of the Dodd-Frank amendments in the jurisdictional provisions of the securities acts, given the context and historical background surrounding Congress's enactment of those amendments, it is clear to us that Congress undoubtedly intended that the substantive antifraud provisions should apply extraterritorially when the statutory conduct-and-effects test is satisfied. We agree, then, with the district court, which stated:

Although courts generally presume that Congress is familiar with the precedents of the Supreme Court when it enacts legislation, the close proximity between the date when Morrison was issued and the date when the language of Dodd-Frank was finalized, greatly undermines this presumption. It strains credulity to assume that legislators read Morrison on the last day that they met to negotiate the final version of a massive 850-page omnibus bill designed to overhaul large swaths of the United States financial regulations and consciously chose to enact Section 929P(b) against the background of the fundamental shift in securities law brought about by Morrison. Given this timing, the more reasonable assumption is that Morrison was issued too late in the legislative process to reasonably permit Congress to react to it.

(Aplt. App. 2086-87.)

This conclusion is bolstered by the title Congress gave this section of the Dodd-Frank Act, "STRENGTHENING ENFORCEMENT BY THE COMMISSION." Dodd-Frank Wall Street Reform and Consumer Protection Act, PL 111-203 (July 21, 2010), 124 Stat 1376. See generally Almendarez-Torres v. United States, 523 U.S. 224, 234, 118 S.Ct. 1219, 140 L.Ed.2d 350 (1998) ("[T]he title of a statute and the heading of a section are tools available for the resolution of a doubt about the meaning of a statute.") (internal quotation marks omitted) ). In another section, § 929Y, the Dodd-Frank Act directed the SEC to "solicit public comment and thereafter conduct a study to determine the extent to which private rights of action under the antifraud provisions" of the 1934 Act "should be extended" extraterritorially. We agree with the district court that this suggests Congress believed it "had extended the SEC's authority to bring an [antifraud] enforcement action in Section 929P(b)." (Aplt. App. 2089 (emphasis added).) Furthermore, several members of Congress, including § 929P's drafter, Representative Paul Kanjorski, stated that the purpose of that provision was to make clear that the antifraud provisions apply extraterritorially in enforcement actions.

For all of these reasons, then, we conclude that Congress has "affirmatively and unmistakably" indicated that the antifraud provisions of the federal securities acts apply extraterritorially when the statutory conduct-and-effects test is met.

*12192. Because Dodd-Frank's conduct-and-effects test is met here, the antifraud provisions apply to Defendants' sales of, and offers to sell, Adpacks to customers located outside the United States

Having determined that the antifraud provisions of the federal securities acts can apply extraterritorially when the statutory conduct-and-effect test is met, we now apply that test to Traffic Monsoon's sales of, and offers to sell, Adpacks to customers located outside the United States. The scope of that extraterritorial application turns on congressional intent; that is, "on the limits Congress has ... imposed on the statute[s'] foreign application." RJR Nabisco, 136 S.Ct. at 2101. Here, Congress limited the extraterritorial application of the antifraud provisions in enforcement actions to

(1) conduct within the United States that constitutes significant steps in furtherance of the violation, even if the securities transaction occurs outside the United States and involves only foreign investors; [and]

(2) conduct occurring outside the United States that has a foreseeable substantial effect within the United States.

15 U.S.C. § 77v(c) ; see also id. § 78aa(b).

We agree with the district court that Defendants' " 'conduct within the United States ... constitute[d] significant steps in furtherance of the violation' of Rule 10b-5 and Section 17(a). Mr. Scoville conceived and created Traffic Monsoon in the United States. Through Traffic Monsoon, he created and promoted the Adpack investments over the internet while residing in Utah." (Aplt. App. 2091.) We add that the servers housing the Traffic Monsoon website were physically located in the United States. For these reasons, the district court correctly held that the antifraud provisions of the federal securities acts encompass Defendants' sales of, and offers to sell, Adpacks to Traffic Monsoon members located outside the United States.

B. Adpacks are "securities"

Scoville next contends that Adpacks are not "securities" and therefore Defendants are not subject to federal securities laws. Like the district court, we disagree.

As an initial matter, Scoville argues that the question of whether Adpacks are "securities" implicates federal courts' subject-matter jurisdiction. We disagree, for the same reasons the Supreme Court in Morrison held that whether the statute applied extraterritorially was not a jurisdictional issue. See 561 U.S. at 251, 253-54 & n.3, 130 S.Ct. 2869 (distinguishing, in § 10(b) enforcement action, between provisions in federal securities statutes giving district courts subject-matter jurisdiction-the power to hear a case-from questions of what conduct § 10(b) reaches, "which is a merits question"). Instead, the question of whether Adpacks are "securities" is a merits inquiry. See, e.g., Avenue Capital Mgmt. II, L.P. v. Schaden, 843 F.3d 876, 880-81, 886 (10th Cir. 2016) (affirming dismissal of private claim under the 1934 Act for failure to state a claim on which relief can be granted because plaintiffs failed to show that the challenged transactions were "securities").

Answering that merits inquiry, we agree with the district court that Adpacks qualify as securities regulated under the 1933 and 1934 acts. "Congress enacted the Securities Acts in response to 'serious abuses in a largely unregulated securities market,' and for the purpose of regulating 'investments, in whatever form they are made and by whatever name they are called." SEC v. Shields, 744 F.3d 633, 641 (10th Cir. 2014) (quoting Reves v. Ernst & Young, 494 U.S. 56, 60-61, 110 S.Ct. 945, 108 L.Ed.2d 47 (1990) ). "Congress 'painted with a broad brush' in defining a 'security'

*1220in recognition of the 'virtually limitless scope of human ingenuity, especially in the creation of "countless and variable schemes devised by those who seek the use of the money of others on the promise of profits. ..." ' " Id. (quoting Reves, 494 U.S. at 60-61, 110 S.Ct. 945 ). Nevertheless, " 'Congress, in enacting the securities laws, did not intend to provide a broad federal remedy for all fraud.' " Id. at 642 (quoting Marine Bank v. Weaver, 455 U.S. 551, 556, 102 S.Ct. 1220, 71 L.Ed.2d 409 (1982) ).

The 1933 Act defines "security" to include an "investment contract," 15 U.S.C. § 77b(a)(1), and that is what the district court determined an Adpack is.7 Although the Act did not further define "investment contract," the Supreme Court did in SEC v. W.J. Howey Co., 328 U.S. 293, 66 S.Ct. 1100, 90 L.Ed. 1244 (1946). In Howey, the owner of a large Florida citrus grove sold small pieces of the grove to the public to help finance the grove's further development. Id. at 294-95, 66 S.Ct. 1100. The purchasers of these small parts of the grove were "for the most part ... non-residents of Florida. They [we]re predominantly business and professional people who lack the knowledge, skill and equipment necessary for the care and cultivation of citrus trees. They [we]re attracted by the expectation of substantial profits." Id. at 296, 66 S.Ct. 1100. Purchasers received the deed to the small pieces of land they bought and the option to hire the seller or some other company to cultivate and market the fruit grown on that particular piece of land, with the net proceeds to be paid to the land purchaser. Id. at 295-96, 66 S.Ct. 1100. Owners of 85% of the pieces of land sold hired the grove owner to cultivate and market their sections of the grove. Id. at 295, 66 S.Ct. 1100. Howey held that a purchaser's "land sales contract, the warranty deed [he received] and the service contract together constitute[d] an 'investment contract,' " id. at 297, 66 S.Ct. 1100 (bracketed material added), defined as "a contract, transaction or scheme whereby a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party." Id. at 298-99, 66 S.Ct. 1100 ; see also id. at 297-301, 66 S.Ct. 1100.

"[T]o distinguish an investment contract from other commercial dealings, the Howey test has subsequently been broken down into three requirements: (1) an investment, (2) in a common enterprise, (3) with a reasonable expectation of profits to be derived from the entrepreneurial or managerial efforts of others." Shields, 744 F.3d at 643 n.7 (internal quotation marks omitted). In addressing the legal question of whether some transaction qualifies as an "investment contract," see Thompson, 732 F.3d at 1161, we disregard form over substance and focus on the " 'economic realities underlying a transaction, and not on the name appended thereto.' " Shields, 744 F.3d at 643 (quoting United Housing Found'n, Inc. v. Forman, 421 U.S. 837, 849, 95 S.Ct. 2051, 44 L.Ed.2d 621 (1975) ). Here, Scoville contends-unsuccessfully-that the SEC failed to make an adequate showing as to any of the three Howey requirements and, therefore, the district court erred in treating Adpacks as "investment contracts" subject to federal securities regulation.

1. An Adpack qualifies as an investment

An Adpack is an "investment." Just as the citrus grove owner in Howey *1221was "offering something more than fee simple interests in land, something different from a farm or orchard coupled with management services," 328 U.S. at 299, 66 S.Ct. 1100, so, too, Traffic Monsoon was offering its Adpack purchasers something more than just advertising services. Adpacks also offered the purchaser an opportunity to share in Traffic Monsoon's revenue. Just as the land purchasers in Howey"had no desire to occupy the[ir] land or to develop it themselves" but were instead "attracted solely by the prospects of a return on their investment," id. At 300, so too the vast majority of $50 Adpack purchasers bought Adpacks, not to receive the same advertising services they could have bought ala carte for $10.95, but instead to have the opportunity to share in Traffic Monsoon's revenue and earn significant returns. We agree with the district court that

[t]he evidence clearly points to the fact that Traffic Monsoon's explosive growth was driven by members purchasing and repurchasing Adpacks in order to obtain the incredible returns on their investment, not by intense demand for Traffic Monsoon's [internet advertising] services. Indeed, many Adpack purchasers had no interest in the website visits Traffic Monsoon offered, and Traffic Monsoon only ever delivered a fraction of the clicks it promised to deliver. In short, the economic reality of the Adpack purchases is that they were investments.

(Aplt. App. 2103 (bracketed material added).)

Neither the fact that a few Adpack purchasers testified that they bought Adpacks for the advertising services, nor the fact that not every Adpack purchaser qualified to share revenue (although almost all of them did), prevents us from characterizing Adpacks as investments. See Howey, 328 U.S. at 300-01, 66 S.Ct. 1100 (holding, in the context of § 10(b), that Court's conclusion that land sales and service contracts amounted to an "investment contract" was "unaffected by the fact that some purchasers choose not to accept the full offer of an investment contract by declining to enter into a service contract with the" citrus grove owner).

2. An Adpack involves a common enterprise

An Adpack is an investment in "a common enterprise." Just as the land purchasers in Howey bought the opportunity "to share in the profits of a large citrus fruit enterprise managed and partly owned by" the citrus grove owners, 328 U.S. at 299, 66 S.Ct. 1100, so Adpack purchasers bought the opportunity to share in revenue derived from the sale of all of Traffic Monsoon's advertising services. The revenue in which Adpack purchasers could share, then, was generated from a common enterprise, Traffic Monsoon's sale of internet advertising services.

3. An Adpack provides members with a reasonable expectation of profit derived from the entrepreneurial or management efforts of others

Howey's third requirement for an investment contract is that the investor "is led to expect profits solely from the efforts of the promoter or a third party." 328 U.S. at 298-99, 66 S.Ct. 1100 ; see also Shields, 744 F.3d at 643 n.7 (applying this part of Howey's inquiry to require that the consumer have "a reasonable expectation of profits to be derived from the entrepreneurial or managerial efforts of others" (internal quotation marks omitted) ).

Scoville points out that, although the revenue Adpack purchasers share is derived from Defendants' efforts to sell Traffic Monsoon's advertising services, the returns Adpack purchasers earn are also the result of purchasers' own efforts in clicking *1222on other members' websites in order to qualify to share revenue. Although the Supreme Court, in Howey, stated that the profits expected from an "investment contract" should result "solely" from others' efforts, 328 U.S. at 301, 66 S.Ct. 1100, the Tenth Circuit has held that "[i]nvestments satisfy the third prong of the Howey test when the efforts made by those other than the investor are the ones which affect significantly the success or failure of the enterprise." Shields, 744 F.3d at 645 (internal quotation marks omitted); see also Crowley v. Montgomery Ward & Co., 570 F.2d 875, 877 (10th Cir. 1975).

That is the case here. Adpack purchasers expected Traffic Monsoon's success to turn "significantly" on the company's efforts to sell its advertising services. See generally Miller v. Cent. Chinchilla Grp., Inc., 494 F.2d 414, 417 (8th Cir. 1974) ("In determining whether the plaintiffs' contributions were nominal or significant, the issue is not what efforts, in fact, were required of them. Rather, it is what efforts the plaintiffs were reasonably led to believe were required of them at the time they entered into the contracts."). Assuming Adpack purchasers expected to contribute to some degree in the delivery of those services by clicking on other members' websites, Adpack purchasers did not expect their own efforts to be significant. No matter how many Adpacks a member owned, the member expected to qualify to share revenue on all of his or her Adpacks by spending only four minutes a day clicking on up to fifty ads. Moreover, there is evidence that receiving clicks on one's website or internet ad was not the motivation for the vast majority of Adpack purchasers; earning a 10% return on their investment was.

Scoville further argues that Adpacks cannot be "investment contracts" because there was never a "guarantee" that qualified Adpack purchasers would receive a share of Traffic Monsoon's revenue because Traffic Monsoon's obligation to share its revenue was contingent on there being revenue to share. But neither were the citrus grove purchasers in Howey guaranteed a return on their investment in the citrus crop. 328 U.S. at 296, 66 S.Ct. 1100. So long as a transaction satisfies Howey's test for an "investment contract," "it is immaterial whether the enterprise is speculative or non-speculative." Id. at 301, 66 S.Ct. 1100. To qualify as an "investment contract," the purchaser just has to have a "reasonable expectation of profits." Shields, 744 F.3d at 642 n.7, 643 ; see, e.g., Edwards, 540 U.S. at 395, 124 S.Ct. 892 ; see also SEC v. Int'l Loan Network, Inc. 968 F.2d 1304, 1308 (D.C. Cir. 1992) (rejecting argument that investment program could not be an "investment contract" because no return was guaranteed; stating that "[v]ery few investments 'guarantee' a return-all that Howey requires is a 'reasonable expectation of profits' " (quoting Forman, 421 U.S. at 852, 95 S.Ct. 2051 ) ). The evidence here supported Adpack purchasers' reasonable expectation-based on the representations made to them-of sharing Traffic Monsoon's revenue. Although Traffic Monsoon's website stated there was no guarantee that there would always be revenue for qualifying members to share, it does not appear that there was ever a time, before the PayPal freeze, when a qualifying member did not receive purported shared revenue.

4. Conclusion: Adpacks qualify as investment contracts

For these reasons, then, the district court did not err in concluding that Adpacks meet Howey's three-part test and, therefore, qualify as "investment contracts" and, thus, as securities subject to regulation under the federal securities laws.

*1223C. It is likely that the SEC can prove that Defendants' conduct violated the antifraud provisions of federal securities laws

Scoville asserts that the district court abused its discretion in determining that the SEC can likely establish that Defendants violated the antifraud statutes. Scoville takes aim at two requisite elements of Defendants' liability.

1. Defendants were operating a Ponzi scheme

The antifraud statutes apply to fraudulent schemes involving securities.8 The district court held that the SEC will likely succeed in proving that Defendants were involved in such a fraudulent scheme because Defendants were operating a Ponzi scheme, which is "inherently deceptive because it generates a false appearance of profitability by using money from new investors to generate returns for earlier investors." ( Aplt. App. 2099 (citing Mukamal v. Gen. Elec. Capital Corp. (In re Palm Beach Fin. Partners, L.P.), 517 B.R. 310, 346 (Bankr. S.D. Fla. 2013) ).)

Scoville counters that the SEC cannot prove that Defendants were operating a Ponzi scheme. But there is strong evidence that that is exactly what Defendants were doing.

The Tenth Circuit has offered several different definitions of a Ponzi scheme, but the district court captured the gist of those definitions in noting that "the central characteristic of a Ponzi scheme is that returns are not based upon any underlying business activity. Instead, money from new investors is used to pay earlier investors." (Aplt. App. 2097.) See Thompson, 732 F.3d at 1154 n.3 ; Wilcox, 691 F.3d at 1173 n.2. In addition, in a Ponzi scheme often the "money contributed by later investors generates artificially high dividends for the original investors, whose example attracts even larger investments." Wilcox, 691 F.3d at 1173 n.2.

The district court did not abuse its discretion in determining that the SEC is likely to prove Defendants were operating a Ponzi scheme. For every $50 Adpack it sold, Traffic Monsoon often had to pay out $55 to qualifying purchasers, and even $60 if the purchaser had been recruited by another Traffic Monsoon member. Traffic Monsoon paid these amounts from sales of new Adpacks; there was essentially no other business activity generating the revenue Traffic Monsoon was sharing with qualifying Adpack purchasers. Furthermore, Traffic Monsoon misrepresented to its Adpack purchasers that the revenue it was sharing came from sales of all of Traffic Monsoon's other advertising services, which Traffic Monsoon falsely indicated were more popular than its Adpacks. Thus, the record evidence would support finding that Defendants were offering the possibility of high rates of return on qualifying Adpacks and paying those returns using money from later Adpack sales. In light of this evidence, it was likely the SEC will be able to show that Defendants were operating a Ponzi scheme and thus, be able to *1224prove that Defendants used fraud or deception to sell, or offer to sell, Adpacks.

Scoville's arguments to the contrary are unavailing. For example, although he reasserts his argument that Traffic Monsoon was only selling advertising services, as previously discussed, the vast majority of Adpack purchasers were not seeking to buy internet advertising services but were, instead, seeking a significant return on their $50-per-Adpack investment. Moreover, Defendants may still be operating a Ponzi scheme even if they have "some legitimate business operations." Gillman v. Geis (In re Twin Peaks Fin. Servs., Inc.), 516 B.R. 651, 655 (Bankr. D. Utah 2014) ; see also Miller v. Wulf, 84 F.Supp.3d 1266, 1272 & n.45 (D. Utah 2015).

Neither does Scoville's assertion-that before an Adpack purchaser could share in Traffic Monsoon's revenue, he had to qualify by clicking on other members' websites for four minutes on a given day and then there had to be revenue Traffic Monsoon generated in the preceding twenty-four hours-prevent the district court's determination that Defendants were running a Ponzi scheme. Even though Defendants disclosed these requisite conditions for an Adpack purchaser to share in Traffic Monsoon's revenue, there is evidence that Defendants deceived purchasers by telling them that the revenue to be shared was generated by Traffic Monsoon's other advertising services that were more popular than Adpacks. Instead, essentially all of the revenue to be shared was generated by the sale of additional Adpacks.9

Lastly, Scoville argues that Defendants did not expressly limit returns on Adpacks only to the original purchasers. And he contends that none of its members had ever suffered a loss. But the fact that this Ponzi scheme had not yet imploded does not mean Defendants were not running a Ponzi scheme.

2. Scienter

In a related argument, Scoville next asserts that the SEC will not be able to establish that Defendants acted with the requisite scienter. We disagree.

Sections 10(b) and 17(a)(1) require proof that Defendants acted with the "intent to deceive, manipulate, or defraud." Aaron v. SEC, 446 U.S. 680, 686 & n.5, 695-97, 100 S.Ct. 1945, 64 L.Ed.2d 611 (1980) (quoting Ernst & Ernst v. Hochfelder, 425 U.S. 185, 194 & n.12, 96 S.Ct. 1375, 47 L.Ed.2d 668 (1976) ). (No scienter is required under § 17(a)(3). See Aaron, 446 U.S. at 695-96, 100 S.Ct. 1945.) The district court correctly held that this scienter is likely established in this case by the fact that Defendants were operating a Ponzi scheme, which again is "inherently deceptive because it generates a false appearance of profitability by using money from new investors to generate returns for earlier investors." (Aplt. App. 2099 (citing In re Palm Beach Fin. Partners, 517 B.R. at 346 ).).10

D. Traffic Monsoon's revenue generated from the sale of its other advertising services is properly subject to the district court's preliminary orders

Lastly, Scoville asserts that, "[a]t a minimum, the Court should order the District Court to release the [currently frozen] Traffic Monsoon funds that are admittedly outside the scope of any of the *1225SEC's claims." (Aplt. Br. 53 (bracketed material added).) Scoville refers to the approximately $3 million that Traffic Monsoon earned from September 2014 through July 2016 from the sale of its internet advertising services other than Adpacks. But it is not clear, as Scoville asserts, that these other sales are "outside the scope of any of the SEC's claims." Id. The revenue to be shared with qualifying Adpack purchasers was generated from the sale of all of Traffic Monsoon's advertising services. Further, Traffic Monsoon had no accounting records; its revenue apparently was pooled together and Adpack purchasers were paid from that pool. In light of this evidence, Scoville has not shown that the district court abused its discretion in preliminarily freezing all of Traffic Monsoon's funds and placing them in the receivership.11

V. CONCLUSION

For the foregoing reasons, we AFFIRM in all respects the district court's challenged preliminary decisions in this civil enforcement action. Although early in this civil enforcement action, the SEC has established the likelihood that it will succeed on its antifraud claims against Defendants.12

I concur in the judgment. I agree with the majority that AdPacks are "securities" within the meaning of the 1933 and 1934 securities acts, Maj. Op. 1219-22, that Scoville did not adequately preserve the personal liability issue, id. at 1225 n.11, and that the SEC is likely to prove that the Defendants' conduct violated the antifraud provisions of the securities acts and their accompanying regulations, id. at 1222-23. I am not persuaded, however, as the majority appears to assume, that the AdPack sales at issue were foreign sales outside of the United States. Absent that assumption there would be no need to address in this case whether the antifraud provisions of the securities acts apply extraterritorially. I write separately to endorse the ruling of the district court, Aplt. App. at 2091-94, and as also advanced by the SEC on appeal, Resp. Br. 52-57, that under Morrison v. Nat'l Australia Bank Ltd., 561 U.S. 247, 130 S.Ct. 2869, 177 L.Ed.2d 535 (2010), Traffic Monsoon sold AdPacks in the United States. Therefore, the securities acts and their accompanying regulations cover the Defendants' domestic activity even if a large percentage of the AdPack buyers purchased the securities while abroad.

As explained by the majority, the Supreme Court has developed a two-step test to determine questions of extraterritoriality. WesternGeco LLC v. ION Geophysical Corp., --- U.S. ----, 138 S.Ct. 2129, 2136, 201 L.Ed.2d 584 (2018). We have discretion to begin the analysis at step one or two, id. at 2136-37, and if either step is satisfied then the statute applies to the challenged conduct, see id. at 2136. I would resolve this case at step two.

"Under the second step of [the] framework, we must identify the statute's focus," WesternGeco, 138 S.Ct. at 2137 (citing RJR Nabisco, Inc. v. European Cmty., --- U.S. ----, 136 S.Ct. 2090, 2101, 195 L.Ed.2d 476 (2016) ) (internal quotation marks omitted), and the Supreme Court has clarified that "the focus of the Exchange Act is ... upon purchases and sales of securities in the United States,"

*1226Morrison, 561 U.S. at 266, 130 S.Ct. 2869. Morrison provides the test for liability under § 10(b). As Morrison explains, based on the text of § 10(b),1 we ask "whether the purchase or sale [of the security] [wa]s made in the United States, or involve[d] a security listed on a domestic exchange." 561 U.S. at 269-70, 130 S.Ct. 2869 (emphasis added). Since AdPacks were not listed on a domestic exchange, we must decide if either the "purchase[s]" or the "sale[s]" were "made in the United States."

The Second, Third, and Ninth Circuits have adopted the "irrevocable liability" test to determine where a security "sale" or "purchase" occurs under Morrison and § 10(b). See Absolute Activist Value Master Fund Ltd. v. Ficeto, 677 F.3d 60, 67 (2d Cir. 2012) ("[W]e hold that transactions involving securities that are not traded on a domestic exchange are domestic if irrevocable liability is incurred or title passes within the United States."); see also Stoyas v. Toshiba Corp., 896 F.3d 933, 949 (9th Cir. 2018), petition for cert. filed, (U.S. Oct. 17, 2018) (No. 18-486); United States v. Georgiou, 777 F.3d 125, 137 (3d Cir. 2015). As the Second Circuit has explained, a domestic transaction occurs when "the purchaser incur[s] irrevocable liability within the United States to take and pay for a security, or [when] the seller incur[s] irrevocable liability within the United States to deliver a security." Absolute Activist, 677 F.3d at 68. While "irrevocable liability" may appear to turn on contract principles and "the location of the securities transactions at issue," see id. at 70 (emphasis added), the Second Circuit later clarified that "territoriality under Morrison concerns where, physically, the purchaser or seller committed him or herself, not where, as a matter of law, a contract is said to have been executed." United States v. Vilar, 729 F.3d 62, 77 n.11 (2d Cir. 2013) (citing Morrison, 561 U.S. at 268, 130 S.Ct. 2869 ). It appears, then, that the irrevocable liability test is a fact intensive inquiry to determine whether a "sale" or "purchase" of "any security not so registered" occurred in the United States.

In this case, Traffic Monsoon was based in the United States and operated out of the United States when selling its securities. As found by the district court, Scoville registered Traffic Monsoon with the State of Utah as a limited liability company. Scoville filed organizational documents with the State of Utah which identified Scoville as Traffic Monsoon's sole member, manager, and registered agent. Scoville listed his apartment's address in Murray, Utah, as Traffic Monsoon's corporate address. Traffic Monsoon sold AdPacks via the internet, and the record further demonstrates that Traffic Monsoon made its sales through computer servers based solely in the United States. Under any common sense reading of Morrison and § 10(b), Traffic Monsoon made several securities sales in the United States. That many AdPack buyers were abroad when they purchased the securities over the internet does not alter this conclusion. Neither does Scoville's argument that he was in the United Kingdom for a period while Traffic Monsoon sold AdPacks since Traffic Monsoon executed all the AdPack sales in an automated manner in the United States.

The analysis under § 17(a) is similar. Section 17(a) makes it "unlawful for any person in the offer or sale of any securities *1227... to employ any device, scheme, or artifice to defraud, or ... to engage in any transaction, practice, or course of business which operates or would operate as a fraud or deceit upon the purchaser." 15 U.S.C. § 77q(a)(1), (3) (emphasis added). Under the same reasoning illustrated above, Traffic Monsoon made "sale[s]" or "offer[s]" of "securities" in the United States within the meaning of § 17(a).

Accordingly, I would affirm because, as explained by the district court, the SEC sufficiently established that the Defendants sold securities in the United States in violation of the securities acts and their accompanying regulations.