Snapshot

Jeffrey Epstein and people working for him built a network of websites that presented him as a philanthropist, scientist, educator, international mediator, and public intellectual. The network became especially active after his 2008 conviction and 2009 release from jail. Its pages repeated flattering claims, recycled old photographs, published press releases, and created search results that competed with reporting about survivors and Epstein’s crimes.

This article currently identifies twenty two unique domains and hosted site addresses supported by historical captures, contemporaneous reporting, or documentary records. It distinguishes thirteen core addresses disclosed in registry records, six additional sites maintained by third party reputation managers, two separately documented reputation domains, and one Tumblr account directly connected to the paid Reputation Changer campaign. Addresses Epstein merely attempted to acquire and domains registered only after his death are classified separately. Some addresses led to the same underlying Blogger property, so twenty two addresses should not be read as twenty two independently operated websites.

Most of the original sites are gone. Several names were later re-registered by unrelated or unidentified parties. Some are parked for sale. Some do not resolve. At least one current redirect produced a scamlike security warning during this review. Researchers should use archived copies rather than visiting unfamiliar live versions.

Status date: August 10, 2026

---

Key Takeaways

• A captured historical list names ten Epstein-branded websites.
• Epstein’s sex offender registration attachment identifies six additional sites maintained by third party reputation managers.
• A November 2011 letter from Darren Indyke notified the New York Sex Offender Registry that Epstein had opened the Twitter account jeffreyepstein1. A January 2012 filing disclosed a wider network of email accounts, social profiles, hosted blogs, and domains.
• An April 2012 proposal prepared for Epstein offered to suppress negative results by filling the first four pages of Google, Bing, and Yahoo with favorable articles, mini-sites, blogs, press releases, and social profiles.
• A May 2012 email delivered the Reputation Changer proposal directly to Epstein, discussed an earlier $2,149 charge from Integrity Defender, and asked Epstein whether he wanted to proceed.
• A January 2013 Reputation Changer update directly connects epstein.jeffrey.tumblr.com to planned guest posts and backlinks promoting Epstein’s websites and social accounts. The evidence appears in EFTA02565446.
• A September 2013 email documents Christina Galbraith saying that she uploaded a new image to Epstein’s Wikipedia biography and hoped it would push back the mug shot. Epstein was copied on the message, which also discussed renewing his science and education websites. The evidence appears in EFTA01959711.
• October 2012 records establish that Epstein approved a trial, that a $12,500 wire to Reputation Changer was ordered from his account, and that a campaign account and tracking dashboard were created.
• A November 2012 email documents article editing and approvals across Blogger, Weebly, and WordPress. It identifies a JeffreyEpsteinFinance.com document as the remaining deliverable from the campaign’s first month.
• A July 2013 letter from Darren Indyke states that a reputation provider created jeffrey@jeffreyepstein.org and associated websites and accounts. A January 2015 registry update reports claimed unauthorized access, website deletions, and account changes.
• A March 2014 email shows Christina Galbraith directing the promotion of favorable or unrelated exact-name search results, including pages that were not controlled by Epstein’s team.
• A later registry inventory associates Galbraith-linked email addresses with BrandYourself, Grant Watch, and Idealist accounts. The document does not independently prove who personally created each account.
• Contemporary reporting separately documents jeffreyepsteinsports.com and jeffreyepstein.net as parts of the reputation effort.
• The websites were not neutral biographies. They functioned together as a search-engine reputation network after Epstein’s conviction.
• The sites emphasized science, education, philanthropy, the United States Virgin Islands, and international affairs.
• Many stories recycled claims or events from years before their publication.
• Current registrations generally do not prove continued control by Epstein’s former organization. Several were created years after his death.
• jeffreyepstein.net is now controlled by a volunteer working with EpsteinWiki and redirects readers to the wiki as a preservation and public-accountability project.

---

Evidence Standard

This article uses six labels:

• Confirmed historical site: Supported by an archived page, a captured Epstein website list, an email, or contemporaneous reporting.
• Historically associated: Strong evidence connects the domain to Epstein’s reputation operation, even when a complete ownership record is unavailable.
• Attempted or proposed: Records show a plan or an effort to buy or build the domain, but not a completed purchase or confirmed launch.
• Later registration: The current registration began after the historical Epstein site disappeared or after Epstein died. A matching name does not prove the current registrant is connected to him.
• Unauthenticated or unsafe: A recreated page, redirect, or live site cannot be authenticated as original or presents a safety concern.
• Unresolved: The available evidence does not support a narrower classification. The missing evidence should be stated directly.

The reviewed WHOIS records describe current registrations. They do not by themselves establish who owned each name during Epstein’s lifetime.

---

Research Method and Limits

This article compares four kinds of evidence: Epstein’s internet-account disclosures, archived website captures, emails and proposals in the released files, and present-day registration records. Each source answers a different question.

• Registry disclosures identify internet properties associated with Epstein at different dates. The January 2012 filing adds social profiles, two foundation blog addresses, and jeffrey-epstein.com. A later attachment distinguishes ten branded websites from six sites created by retained reputation managers.
• Archived pages establish what a site published at a particular time. They do not necessarily identify the person who wrote the page or controlled the domain.
• Emails and proposals identify plans, participants, payments, search targets, and operational discussions. A proposed assignment does not prove that every named person performed the work.
• WHOIS and RDAP records establish current registration facts when those facts are public. Privacy services, shared parking infrastructure, and later registrations do not reveal a beneficial owner or prove continuity with Epstein’s organization.

The Internet Archive is incomplete. A first surviving capture is not necessarily the date a site launched, and a final capture is not necessarily the date it closed. When the record cannot answer a question, this article identifies the gap instead of assigning an owner or operator by inference.

---

The Known Domain Portfolio

Domain	Historical role	Evidence level	Status on August 10, 2026
jeffreyepsteinfoundation.com	Foundation and philanthropy branding	Confirmed historical list	Registered again in 2025. No connection to the original organization has been established.
thejeffreyepsteinfoundation.com	Foundation, science, event, and photograph archive	Confirmed by the January 2012 registry inventory and February 2012 archive	The current registration began December 24, 2023. Continuity with the historical Blogger site is not established.
jeffreyepsteinfoundation.blogspot.com	Foundation blog	Confirmed historical registry inventory	The address currently redirects to a Blogger sign in page. Its historical and current account controllers are not publicly identified.
jeffrey-epstein.com	Exact name domain	Confirmed historical registry inventory	The current registration began August 11, 2019. Continuity with the historical registration is not established.
jeffreyepsteinscience.com	Science patronage and scientist associations	Confirmed historical site	Registered again in 2020. A collected redirect produced a fake security warning. Researchers should use archived captures.
jeffreyepstein.org	General philanthropy and reputation hub	Confirmed historical site	Archived in 2010 and 2013. The current registration dates to 2016 and is not the original registration.
jeffreyepstein.us	Purpose not independently established	Confirmed historical list	Registered again in 2026. The collected address did not resolve.
jeffreyepsteinblog.com	Jeffrey Epstein VI Foundation blog	Confirmed historical site	Registered again in 2024. The collected live page was blank.
jeffreyepsteinforum.com	Foundation and science material	Confirmed historical site	Registered again in 2023 and currently parked for sale.
jeffreyepsteinusvi.com	Virgin Islands philanthropy claims	Confirmed historical site	Registered again in 2023 and currently parked for sale.
jeffreyepsteineducation.com	Education and academic philanthropy claims	Confirmed historical site and May 2013 archive	Registered again in 2023 and currently parked for sale.
jeffreyepsteininternational.com	Diplomacy and international affairs claims	Confirmed historical site	Registered again in 2023 and currently parked for sale.
jeffreyepsteinnewyork.com	New York press release and reputation hub	Confirmed historical site and May 2013 archive	Registered again in 2023. The collected address did not resolve.
jeffreyepsteinsports.com	Sports themed reputation content	Confirmed by reporting and archived material	Recreated in 2026 by an unidentified purchaser. The recreation has not been authenticated as original.
jeffreyepstein.net	Exact name reputation site	Historically associated	Now controlled by an EpsteinWiki volunteer and redirected to EpsteinWiki for preservation and public accountability.
jeffreyepstein.co	Science, philanthropy, and innovation reputation site	Confirmed by EFTA records and archived material	Registered again February 6, 2026. It is parked, and the public record does not disclose the beneficial owner.
jeffreyepsteininfo.com	General philanthropy and biography reputation site	Confirmed by EFTA records, archived material, and links from Blogspot	Registered again February 13, 2026. It is parked, and the public record does not disclose the beneficial owner.
jeffreyepsteinfinance.com	Finance and business reputation site	Confirmed by EFTA records and archived material	Registered again February 6, 2026. It is parked, and the public record does not disclose the beneficial owner.
jeffreyepstein93.wordpress.com	Third party reputation blog	Confirmed by EFTA records and posts dated 2012	Still publicly accessible. The current WordPress account controller is not disclosed.
jeffreyepsteins.blogspot.com	Third party reputation blog	Confirmed by EFTA records and posts dated 2012	Still publicly accessible. The current Google account controller is not disclosed.
jeffreyepstein93.jux.com	Third party reputation page	Confirmed by EFTA records	No longer accessible. Current ownership of jux.com does not identify the historical subdomain controller.
epstein.jeffrey.tumblr.com	Third party reputation blog connected to the Reputation Changer dashboard	Confirmed by January 2013 correspondence in EFTA02565446	The address currently returns a site unavailable message. Its historical and current account controllers are not publicly identified.

The ten names in the captured portfolio are visible in the historical domain list. The January 2012 registry inventory adds thejeffreyepsteinfoundation.com, jeffreyepsteinfoundation.blogspot.com, and jeffrey-epstein.com. The additional sports and dot-net domains are supported by reporting and archived material discussed below.

The six contractor-maintained sites appear on EFTA01136494. The document expressly separates those properties from Epstein’s ten disclosed websites.

---

Domain History and Current Status Timeline

The surviving evidence supports a phased history rather than one continuous website operation.

Period	Documented development	Evidence and limitation
September 2010	Al Seckel proposed using favorable material and technical intervention to displace negative search results about Epstein.	EFTA02421209 documents the proposal.
October 2010	A written strategy proposed two primary Epstein websites and three subject focused sites intended to influence searches for his name.	EFTA00754635, EFTA00754636, and EFTA00754637.
October 29, 2010	The science, philanthropy, and sports websites were reported as launched.	The released correspondence was reconstructed and reported by Cronkite News.
November 5, 2010	A Google results screenshot showed three targeted favorable websites appearing on the first page of the captured search.	EFTA00752512. One screenshot documents one search at one time. It does not establish identical results for every user.
August 2011	Epstein requested that a website be taken down.	The released email chain was reported by Cronkite News. The request concerned one website and does not establish that the entire network was discontinued.
November 1, 2011	Darren Indyke notified the New York Sex Offender Registry that Epstein had opened the Twitter account jeffreyepstein1.	EFTA01110814. Twitter notifications sent to jeevacation@gmail.com also connect that address to the account in EFTA00686405 and EFTA00719817. These records do not identify who personally wrote each post.
January 24, 2012	Epstein submitted an updated internet inventory listing email addresses, Twitter accounts, profiles, social networks, hosted blogs, and domains.	EFTA00586845 and EFTA00586846. The filing documents accounts reported to the registry but does not establish who operated each account every day.
April 27, 2012	Reputation Changer prepared a personalized proposal offering to suppress negative results by creating and ranking favorable online assets.	EFTA01176548 through EFTA01176557. The proposal alone does not establish acceptance or payment.
May 10, 2012	An adviser delivered the Reputation Changer proposal directly to Epstein, discussed dissatisfaction with Integrity Defender, and asked whether Epstein wanted to proceed.	EFTA02698102 and EFTA02698103. The correspondence establishes direct delivery and active consideration, but not final approval at that time.
October 11 and 12, 2012	Epstein approved trying Reputation Changer for two months. Christina Galbraith said she would begin working with the company and described existing work that included a USVI website, search optimization, BusinessWire articles, and planned Reputation Changer coordination.	EFTA02562081. The correspondence documents Epstein’s approval and Galbraith’s intention to begin the engagement.
October 15, 2012	Correspondence stated that Epstein would begin with a one month Reputation Changer trial costing $12,500. The company was expected to schedule a call with one of its journalists before beginning the suppression work.	EFTA01983825 and EFTA01983826.
October 16, 2012	Harry Beller instructed a JPMorgan representative to wire $12,500 from Epstein’s account to Reputation Changer LLC through Wells Fargo Bank. The reference identified the payment as “Jeffrey Epstein, 1 Month Trial.”	EFTA01580804. This establishes a payment instruction from Epstein’s account.
October 17, 2012	Epstein received instructions for accessing a Reputation Changer account and campaign tracking dashboard.	EFTA01993247. The message shows that an account and dashboard had been established. It does not prove that Epstein personally logged into the dashboard.
November and December 2012	Reputation Changer documented production of three websites, three press releases, twelve blog articles, and eight guest posts. Philippe Han explained that articles were published gradually to create repeated instances of new content for search engines. He also described guest posts that generated links through writer credits, identified three websites as Reputation Changer’s production track, and discussed edits and delays affecting the finance website.	EFTA00876323, EFTA02024988 through EFTA02024994, and EFTA01804621. The records document production and distribution but do not prove that every planned item was ultimately published.
January 2, 2013	A campaign participant reported reviewing links through the Reputation Dashboard and requested corrections. The message identified a broken WordPress link, inappropriate images on blog links, too few guest blog articles, a misclassified education website, and social media profiles associated with people other than Epstein.	EFTA01910318. The message demonstrates active quality control through the campaign dashboard. It also reveals errors in the manufactured online network.
January 17, 2013	Reputation Changer representative Philippe Han sent Christina Galbraith a detailed update on the second month of the campaign. He described press releases, sponsored reviews, guest posts, and articles intended for websites that Reputation Changer said it controlled.	EFTA02565443 through EFTA02565448.
January 17, 2013	Han stated that one planned guest post would link to jeffreyepsteinforum.com and epstein.jeffrey.tumblr.com. Other planned links included jeffreyepstein.org, jeffreyepsteinscience.com, and twitter.com/Epstein_jeffrey.	EFTA02565446. This directly places the Tumblr account inside the paid campaign. It does not establish who created or personally operated the account or whether the planned post was ultimately published.
2012 and 2013	A contractor managed website cluster used WordPress, hosted blogs, consecutive Google Analytics identifiers, cross links, directory listings, social media accounts, and sponsored material.	EFTA01136494, the Reputation Changer correspondence, archived source code, and surviving website captures document the cluster.
July 30, 2013	Indyke told the Florida Department of Law Enforcement that jeffrey@jeffreyepstein.org and associated internet properties had been created by an outside reputation provider.	EFTA00306059 and EFTA00306060. The letter records counsel’s explanation but does not independently verify every assertion it contains.
March 24, 2014	Galbraith instructed Tyler to promote exact name pages that were “not our websites.” She also discussed Google crawling and considered creating another artificial intelligence website on a different domain and server.	EFTA01928953 and EFTA01928954. The pages appear to concern unrelated people with the same name and should not be described as fabricated without additional evidence.
July 27, 2014	Galbraith requested access to the .net website so she could update its content, sitemap, and Google Analytics. She also asked for changes promoting iCog Labs, Humanity Plus, and Novamente LLC and described linking the website to blogs and artificial intelligence researchers backed by Epstein.	EFTA00994273. The correspondence documents direct content and analytics management. It does not establish that every requested change was published.
January 13, 2015	Indyke reported claimed unauthorized access to a website and account, followed by website deletions and account changes. Epstein signed the registry update.	EFTA01070877 through EFTA01070882. The filing supplies counsel’s explanation but does not identify or independently establish the alleged hackers.
2018	A later registry inventory attributed numerous accounts to third party reputation providers and associated Galbraith linked email addresses with specific reputation, directory, nonprofit, and social media accounts.	EFTA02445696 and EFTA02445699. The inventory identifies reported account information but does not independently establish who created or operated every account.
January 17, 2019	Galbraith contacted Epstein’s office, described having worked for his foundation, and offered future assistance in exchange for occasional use of its conference room.	EFTA02275605 and EFTA02275606. The message documents outreach, not renewed employment or acceptance of the proposal.
After 2019	Historical domains expired, changed hands, redirected elsewhere, or were registered by new owners.	Current registration records can establish later registration dates and technical providers, but privacy services frequently prevent identification of beneficial owners. Later ownership must not be attributed to Epstein or his contractors without supporting evidence.
2026	Several historical names were registered again after major document releases. jeffreyepstein.net was acquired by an EpsteinWiki volunteer for preservation and public accountability.	Current registration records and the documented volunteer acquisition establish the later history. The acquisition is not a continuation of Epstein’s former reputation campaign.

---

Documentary Evidence of the Online Reputation Operation

April and May 2012: Reputation Changer’s Proposed Search-Suppression Campaign

On April 27, 2012, Reputation Changer LLC prepared a ten-page “Reputation Changer Action Plan” specifically for Jeffrey Epstein. The proposal recommended enrolling Epstein in the company’s “Reputation Clearing Action Plan” to suppress negative search results associated with his name.

The proposed campaign was explicitly designed to change what members of the public encountered when searching for Epstein. Reputation Changer proposed to:

• suppress negative search-engine listings
• fill the first four pages of Google, Bing, and Yahoo with favorable material
• register multiple mini-sites hosted on independent servers
• create original articles, press releases, blogs, social-media profiles, and other favorable content
• submit articles to more than 500 online directories
• distribute press releases to the Associated Press and other media outlets
• place backlinks in articles, press releases, blogs, and newly created websites
• syndicate content through media sites owned by the reputation company
• monitor search rankings and provide monthly progress reports

The proposed team included search-engine optimization specialists, web developers, journalists, social-media specialists, public-relations personnel, internet marketers, and Google consultants. Reputation Changer offered to create and rank at least two favorable assets within five business days and twelve within sixty days. The quoted price was $7,500 for the first month and $5,000 per month thereafter until the negative listings were suppressed to the client’s satisfaction.

The May email establishes that the proposal reached Epstein directly and that someone working on his behalf compared competing firms. At that point in the chronology, the reviewed evidence did not yet establish Epstein’s approval or payment.

Later records resolve much of that uncertainty. In October 2012, Epstein approved a trial, a $12,500 wire to Reputation Changer was ordered from his account, and Epstein received instructions for accessing a Reputation Changer campaign dashboard. A November 2012 email then documented article editing and approvals across Blogger, Weebly, and WordPress. Together, these records establish that the relationship progressed from proposal to an active production campaign. They do not establish that Epstein personally operated the accounts or that every proposed article was ultimately published.

According to the email, Reputation Changer submitted Epstein’s name to an internal ethics committee and agreed to accept him if he wished to proceed. The sender attached the personalized proposal, highlighted its pricing, and said additional favorable content would be published while Epstein considered it.

The email described the technical objective as “dis-associative work.” The sender explained that favorable press could outrank negative reporting, but that the combinations of Epstein’s name and negative article titles also needed to be weakened within search engines.

The May email establishes that the proposal reached Epstein directly, that someone working on his behalf compared competing firms, and that Epstein was being asked to approve the campaign. It also indicates that Integrity Defender had already been engaged or had billed the reputation operation.

At the May 2012 stage, the correspondence established that Epstein had received and was considering the proposal. Later October records document his approval of a trial, a $12,500 wire instruction, and access to a Reputation Changer campaign dashboard. The records do not independently confirm that the receiving bank completed the transfer or establish the total amount ultimately paid.

The proposal and follow-up correspondence are preserved in EFTA01176548, EFTA01176550, EFTA01176554, EFTA01176555, EFTA01176556, EFTA01176557, EFTA02698102, and EFTA02698103.

Additional messages discussing work with “Reputation” and the company’s search results appear in EFTA02550125 and EFTA01901932.

October 2012: Epstein Authorized and Funded the Reputation Changer Trial

Records from October 2012 close two significant gaps in the earlier evidence. They document Epstein’s written approval of a Reputation Changer trial and a subsequent instruction to wire the company $12,500.

On October 11, 2012, Christina Galbraith sent Epstein an update describing work she had already completed. She reported creating an eight page website at jeffreyepsteinusvi.com, optimizing the site for search engines, publishing six articles with two more scheduled, optimizing articles through BusinessWire, posting material on science discussion sites, and arranging a call with Reputation Changer.

Galbraith asked whether Epstein wanted to conduct a two month test with Reputation Changer. Epstein replied, “ok lets try two months.” On October 12, Galbraith confirmed that she would begin working with Reputation Changer and would verify the exact cost with Epstein and Lesley Groff. The complete email chain appears in EFTA02562081.

Additional correspondence dated October 15 stated that Epstein intended to begin with a one month trial costing $12,500. The message explained that the payment would not commit him to subsequent months and that Reputation Changer would schedule a call with one of its journalists before beginning the suppression phase. That correspondence appears in EFTA01983825 and EFTA01983826.

An October 16, 2012 memorandum from Harry Beller instructed a JPMorgan representative to wire $12,500 from Epstein’s account to Reputation Changer LLC through Wells Fargo Bank. The reference identified the payment as “Jeffrey Epstein, 1 Month Trial.” The wire instruction appears in EFTA01580804.

On October 17, 2012, one day after the wire instruction, Epstein received an email explaining how to access his Reputation Changer account. The message provided the company website, login information, and instructions for opening the campaign dashboard to examine how Reputation Changer was tracking his account. The email appears in EFTA01993247.

The October 17 email supplies additional evidence that the relationship progressed beyond a proposal and payment request. By that date, Reputation Changer had made an account and tracking dashboard available for Epstein’s campaign. The email does not establish whether Epstein personally accessed the dashboard, what measurements it displayed, or whether the company produced the promised search results.

Together, these records establish that the campaign progressed beyond a proposal. Epstein personally approved a trial, Galbraith said that work with Reputation Changer would begin, a $12,500 payment instruction was issued from Epstein’s account, and dashboard access was subsequently provided.

The records establish authorization and a payment instruction for the first month. They do not confirm that the receiving bank completed the transfer, establish whether a second monthly payment was made, or identify every website, article, account, and search result created during the engagement.

November 2012: Reputation Changer Produced Articles Across Multiple Platforms

November and December 2012: The First Month Content Operation

The surviving correspondence provides a detailed account of Reputation Changer’s first month of production for Jeffrey Epstein.

On November 26, 2012, Reputation Changer senior client account manager Philippe Han thanked a campaign participant for returning edited articles. Han listed content prepared for Blogger, Weebly, and WordPress. The planned sets included pages labeled “Lander,” followed by three additional blog articles for each platform. Han identified a JeffreyEpsteinFinance.com document as the final remaining item from the first month’s allocation. This exchange appears in EFTA00876323.

A November 28 review described the first month’s planned or completed production as:

• Three websites, with one still awaiting publication.
• Three press releases described as completed.
• Twelve blog articles, not all of which had been published.
• A guest article campaign that one participant initially described as ten articles.

Han corrected the guest article total to eight. He said two had already appeared and six remained outstanding. The first month review appears in EFTA02024993, while Han’s correction and explanation appear in EFTA02024991.

Han explained that the twelve blog articles would be published gradually. Each landing page would appear first, followed by additional articles every few days. He explicitly said this schedule was used because search engines favored repeated instances of new content appearing over time.

Han also explained how the guest article strategy produced links. With one exception, the guest posts were not directly about Epstein. They concerned subjects related to the host blogs. The promotional link appeared in the writer credit, which could claim that the supposed freelance writer had worked on another project such as jeffreyepsteinfinance.com.

Han said Reputation Changer worked with a network of highly ranked bloggers and had to offer stories to those publishers before receiving permission to contribute. He identified two guest posts that had already appeared, one on blogupstairs.com and another on onlyto.com. These websites should be classified as third party guest post placements, not as domains owned by Epstein.

On November 30, a redacted campaign participant asked Han to launch the finance website, report how many of the twelve blog articles had been published, and update the Reputation Changer dashboard with all published assets. The sender also stated that jeffreyepsteineducation.com was being built separately.

The sender asked Reputation Changer to promote five websites during the second month and described them as “3 of yours and 2 of mine.” The websites were listed in two groups:

• jeffreyepsteinusvi.com
• jeffreyepsteineducation.com

and:

• jeffreyepsteinfinance.com
• jeffreyepsteininfo.com
• jeffreyepstein.co

In context, this email identifies the first two as websites managed or built on the sender’s side and the final three as websites produced through Reputation Changer. This is evidence of operational responsibility, not necessarily legal domain ownership. The correspondence appears in EFTA02024989 and EFTA02024990.

Han subsequently explained that the finance content had been returned to Reputation Changer’s editors for on page optimization before being sent to the development team for construction. He expected the complete finance website to become publicly accessible the following Monday.

Han also said the blogs were being created, that landing pages would appear before the additional articles, and that newly published material would be entered into the Command Center under “Reputational assets.” The correspondence appears in EFTA02024988.

A separate email later forwarded to Epstein explained another delay affecting the finance website. Han said a writer had been assigned to rewrite the site according to the recipient’s instructions. Han also said he had changed the recipient’s Command Center password to make it easier to remember. The correspondence appears in EFTA01804621 and EFTA01804622.

These records establish that the Reputation Changer engagement included writers, editors, developers, press releases, staged blog publication, guest post placements, backlink creation, dashboard tracking, password management, and planning for a second month.

They do not identify every writer, prove that every proposed item was published, or establish that Epstein personally operated the websites. They do show that the campaign progressed well beyond a proposal and into coordinated production and distribution.

January 2013: The Dashboard Connected Reputation Changer to Specific Online Assets

On January 2, 2013, an Epstein associated sender contacted Philippe after reviewing the links displayed in the Reputation Changer dashboard. The message requested corrections to several items connected to the campaign.

The sender reported that a page on jeffreyepstein93.wordpress.com led nowhere, objected to images appearing through the Jux blog links, and noted that only six guest blog articles had been posted when eight or ten were apparently expected. The sender also stated that jeffreyepsteineducation.com was a main website rather than a minisite.

The message further complained that social media profiles displayed in the dashboard belonged to different people rather than Jeffrey Epstein. This could reflect a tracking or classification error, the inclusion of unrelated people who shared Epstein’s name, or another campaign practice. The email does not establish that Reputation Changer created or controlled those unrelated profiles.

The complete message appears in EFTA01910318.

This evidence establishes that the Reputation Changer dashboard remained operational in January 2013 and was being reviewed against expected campaign assets and deliverables. It connects the dashboard to a WordPress property, Jux blog links, guest blog placements, jeffreyepsteineducation.com, and social media profiles. It does not independently establish that Reputation Changer created every listed asset or identify the authors of the underlying content.

January 2013: Reputation Changer Linked the Campaign to Tumblr

A January 17, 2013 campaign update directly connects the Tumblr account epstein.jeffrey.tumblr.com to Jeffrey Epstein’s paid reputation management operation.

Reputation Changer representative Philippe Han told Christina Galbraith that three guest posts were being prepared. Each post was intended to create links to selected websites and social media accounts associated with Epstein’s campaign.

The planned links were:

• jeffreyepstein.org
• twitter.com/Epstein_jeffrey
• jeffreyepsteinforum.com
• epstein.jeffrey.tumblr.com
• jeffreyepsteinscience.com

Han stated that the second guest post would link to jeffreyepsteinforum.com and epstein.jeffrey.tumblr.com. He expected the guest posts to be completed within two to three weeks. The campaign update appears in EFTA02565446.

The same update described several other campaign components:

• Three PR Newswire releases supporting jeffreyepstein.org, jeffreyepsteinusvi.com, and jeffreyepsteinscience.com.
• Three sponsored reviews promoting jeffreyepstein.org, jeffreyepsteinforum.com, and jeffreyepsteinscience.com.
• An interview style guest post intended for publication on what Han described as a high ranking blog.
• Four news style articles intended for websites that Reputation Changer said it controlled.
• The named websites included indyposted.com, interpacket.com, dictated.com, and segment.com.

The complete correspondence appears in EFTA02565443, EFTA02565444, EFTA02565445, EFTA02565446, EFTA02565447, and EFTA02565448.

This evidence places epstein.jeffrey.tumblr.com inside the paid Reputation Changer campaign. It connects the Tumblr account to Epstein’s forum, branded websites, Twitter account, sponsored material, and planned guest posts.

The correspondence does not establish who originally registered or personally operated the Tumblr account. It also does not prove that every proposed guest post or sponsored article was ultimately published.

March 2014: Promoting Unrelated Same-Name Search Results

A March 24, 2014 email provides direct evidence that Epstein’s reputation operation attempted to influence search results without relying only on websites it controlled.

In the message, Christina Galbraith told Tyler that they needed to “PUSH ‘Jeffrey Epstein’ title links that are not our websites.” She identified pages about other people who shared Epstein’s name, including a Disney Parks blogger, a facial plastic surgeon, a physician, and a Kaye Scholer partner.

Galbraith observed that pages using the exact name “Jeffrey Epstein” were more effective than pages using “Jeff Epstein.”

The same email discussed problems with Google’s robots failing to crawl an Edge page, moving favorable material onto Google’s second page, launching another artificial-intelligence site, deciding whether a .com would be more effective than a .net, using a different server, and planning future press material.

The communication shows a strategy of promoting unrelated exact-name results so they would occupy search space that might otherwise display reporting about Epstein. It also supports the conclusion that multiple domains, extensions, and hosting arrangements were being considered as part of the search strategy.

The listed same-name pages should not be described as fabricated or controlled by Epstein’s team without additional evidence. The email instead shows that apparently independent pages were selected for promotion because their titles contained Epstein’s full name.

The correspondence appears in EFTA01928953 and EFTA01928954.

Later Registry Inventory Connects Galbraith-Associated Emails to Reputation Accounts

A later sex offender registry attachment contains an extensive inventory of internet accounts associated with Epstein’s reputation operation. The attachment states that the accounts, websites, blogs, and social-media profiles were created, administered, operated, and managed by independent third-party reputation providers engaged by Epstein.

That description represents the position supplied in the registry documentation and should not be treated as an independent audit of who controlled each account.

The inventory nevertheless supplies important account-level evidence. It associates christina@jeffreyepstein.org with BrandYourself and Grant Watch, and it associates galbraith_christina@yahoo.com with Idealist.

It also lists numerous business directories using addresses associated with jeffreyepstein.org, GoDaddy entries for jeffreyepstein.org, jeffreyepsteinusvi.com, and jeffreyepstein.net, and accounts across Blogspot, LinkedIn, Google, Flickr, Twitter, grant directories, and other services.

These entries connect email identities associated with Christina Galbraith to particular parts of the reputation network. They do not, by themselves, establish that Galbraith personally registered, authored, or operated every listed account.

The inventory begins at EFTA02445696, and the page containing the Galbraith-associated addresses is EFTA02445699.

The 2018 Request to Authenticate the Registry Page

On February 6, 2018, attorneys for Bradley Edwards served requests for admission asking Epstein to admit that an attached printout of his New York Sex Offender Registry page was authentic and that the information it contained was accurate.

The request appears in EFTA00808498. The attached public registry printout begins at EFTA00808501.

This filing shows that Epstein’s public registry page was placed into litigation and that Edwards’s attorneys formally sought its authentication.

It is a request for admission, not Epstein’s answer. Unless the response or a court ruling is located, it should not be described as Epstein’s admission that the page was authentic or accurate. The exhibit also does not independently authenticate every earlier internet-notification letter or establish who operated every historical account.

January 2019: Galbraith Described Her Prior Foundation Work

A January 2019 email further corroborates Galbraith’s previous relationship with Epstein’s foundation.

In a message forwarded by Lesley Groff, Galbraith contacted Epstein and Richard Kahn and wrote, “Since working for your foundation, I continued to publish as a journalist.” She described later work involving genetic vectors and business development for scientific laboratories.

Galbraith asked whether she could occasionally use the foundation’s Lexington Avenue conference room and offered to perform work for the foundation in exchange. Groff replied that she would forward the message.

The email supports the conclusion that Galbraith regarded her earlier activities as work performed for Epstein’s foundation and shows that she remained able to contact members of his office in January 2019. It does not establish that Epstein accepted her proposal, granted office access, or rehired her.

The forwarding message and Galbraith’s email appear in EFTA02275605 and EFTA02275606.

---

Why the Websites Existed

Epstein’s web network emerged after his criminal case had made his name inseparable from the abuse of girls. The sites attempted to create a different online identity. Their recurring themes included:

• scientific patronage
• educational philanthropy
• support for universities and individual researchers
• charitable work in the Virgin Islands
• international diplomacy and peace initiatives
• personal access to prominent scientists, academics, and political figures

A syndicated version of a New York Times report said Epstein created at least six such sites beginning in 2010.

The Daily Beast later described more than a dozen URLs that repeated similar claims and visual designs.

Forbes, The Verge, and Bloomberg have reported on the paid search-engine and reputation work behind this wider operation.

An email indexed as EFTA00753570 discussed the Google position of jeffreyepstein.org and a science site, then proposed adding links and interviews to improve their placement. That document is direct evidence that search visibility was being monitored and actively managed.

The operation did not erase the criminal record. It tried to surround it with a larger volume of flattering material.

---

The 2010 Search-Suppression Plan

The strongest evidence of purpose comes from the September and October 2010 correspondence.

In EFTA02421209, Epstein and Seckel discussed whether positive articles were needed to displace negative results.

The October plan preserved in EFTA00754635, EFTA00754636, and EFTA00754637 proposed two sites that would openly promote Epstein’s science and charitable activity and three “pseudo-sites” designed around sports, cooking, and photo or video sharing.

The sports site was intended to rank for the name Jeffrey Epstein while appearing to be written by another person with the same name. The proposed cooking and sharing sites have not been shown to have launched. They remain proposals, not confirmed websites.

The documents and reporting identify a proposed division of labor:

• Al Seckel would oversee the project and communicate with Epstein.
• Michael Keesling would manage content for the pseudo-sites and hired writers in the Philippines, according to released correspondence reconstructed by Cronkite News.
• Isabel Maxwell, Christine Maxwell, Pablos Holman, Paul Kirkaas, and Baron Reichart appeared in the proposal as possible search, technical, or consulting resources. Their presence in a plan does not establish what work each person ultimately performed.
• Gregory Markel of Infuse Creative was approached and declined the work after raising concerns about the allegations and conviction, according to a released email quoted by Cronkite News.

Epstein replied that money had been sent in EFTA00778138. Cronkite News reports that Keesling agreed to the project for $25,000.

On October 29, Seckel reported the launch of jeffreyepsteinscience.com, jeffreyepstein.org, and jeffreyepsteinsports.com.

Case Study: JeffreyEpsteinSports.com

The sports site provides the clearest end-to-end example of how the strategy worked.

1. A pseudo-site was proposed to capture searches for the name Jeffrey Epstein without appearing to be an official Epstein philanthropy page.
2. Content was assigned to outside writers because Seckel said he did not know enough about sports to produce it himself.
3. Articles repeatedly used Epstein’s name and linked into the favorable network. EFTA02421114 preserves discussion of the content, while EFTA00751527 addresses the site’s claimed anonymity.
4. The November 5 Google screenshot in EFTA00752512 showed the strategy achieving significant first-page visibility in that captured search.
5. Funding disputes followed. Cronkite News reports that Epstein objected in December 2010 that the operation could collapse over a $2,500 shortfall.
6. In August 2011, Epstein asked that a website be taken down. The sports domain later lapsed and passed through unrelated uses.

The sequence documents both the intent and the limits of the operation. The campaign could influence a captured results page, but it required continuing money, content, technical work, and monitoring.

---

The Historical Foundation Blog

An archived capture of The Jeffrey Epstein VI Foundation Blog used jeffreyepsteinblog.com. Its navigation included Home, Press, Photos, Our Forum, and Contact. The page described Epstein as an investment manager and science philanthropist.

Its photo pages displayed Epstein with scientists, academics, donors, and public figures. Captions named Howard Gardner, Leon Black, Brian Boyd, Henry Rosovsky, David Gergen, Eric Lander, and George Church.

A photograph or caption proves an encounter or a claim made by the website. It does not prove that every person endorsed Epstein’s conduct or knew about his crimes.

The archived page is preserved through the Internet Archive.

---

Domain by Domain Findings

JeffreyEpsteinFoundation.com

The domain appears in the captured historical portfolio and fits the umbrella branding of the Jeffrey Epstein VI Foundation.

The current WHOIS capture shows a registration created on August 4, 2025. That date is six years after Epstein’s death, so the current registration cannot be treated as proof of original ownership or continuity.

Researchers can check the Wayback Machine history and the current WHOIS record.

JeffreyEpsteinScience.com

This was one of the most visible reputation sites. It promoted Epstein as a supporter of physics, genetics, mathematics, artificial intelligence, and other research. Contemporary press releases repeatedly cited it as a source.

A 2013 promotional release is preserved by PRWeb.

The current registration was created on November 9, 2020 and therefore is not the original registration. It uses Cloudflare nameservers.

During the present review, a redirect associated with the collected domain material produced a fake computer-security alert. Because the exact redirect chain may change, EpsteinWiki links to the Wayback history and WHOIS record, not the live site.

JeffreyEpstein.org

This general reputation hub appeared in 2010 and was monitored for its Google ranking. A December 2010 version survives in the Internet Archive.

EFTA00753570 records discussion of its search position.

A September 2013 archive shows the later site titled Jeffrey Epstein Philanthropy with the slogan “Supporting innovation in science, education and international peace accords.”

Its navigation included recipients, press, a forum, and contact pages. Articles cross-linked to jeffreyepsteinscience.com and jeffreyepsteininternational.com. The page used GoDaddy Website Builder 6.1.2 and listed 575 Lexington Avenue, 4th Floor, New York.

These details establish the site’s function and its relationship to other branded properties. The donation, affiliation, and institutional claims published on it remain Epstein-controlled promotional claims unless independently corroborated.

The current WHOIS record begins in 2016. It is therefore a later registration and should not be conflated with the archived 2010 site. See the current WHOIS record.

JeffreyEpstein.us

This name appears in the captured historical portfolio. The present registration was created on February 7, 2026. The supplied www capture returned NXDOMAIN.

There is not yet enough evidence to identify the current controller. See WHOIS and the Wayback index.

JeffreyEpsteinBlog.com

This domain hosted the Jeffrey Epstein VI Foundation blog and its photo gallery. Its historic purpose is established by the archived page.

The current registration began on October 2, 2024, and the captured live page was blank. See the archived photo page and WHOIS.

JeffreyEpsteinForum.com

Contemporary reporting identified this as one of Epstein’s namesake promotional sites.

The current registration began on March 3, 2023 and is parked for sale. See the Wayback index and WHOIS.

JeffreyEpsteinUSVI.com

This site promoted Epstein’s claimed charitable activity in the United States Virgin Islands.

A 2012 item about the Rising Stars Youth Steel Orchestra cited the domain as its source.

The current registration began on March 3, 2023 and is parked for sale. See the archived history and WHOIS.

JeffreyEpsteinEducation.com

This domain promoted educational giving and academic relationships. Contemporary reporting identified it as one of the reputation sites created after Epstein’s release.

The May 6, 2013 archive identifies the site as Jeffrey Epstein Education and describes it as part of the Jeffrey Epstein VI Foundation.

Its pages promoted claimed support for early education, Head Start, charter schools, the New York Academy of Art, and the Institute for Advanced Study.

The page cross-linked to jeffreyepsteinnewyork.com and jeffreyepstein.org, used GoDaddy Website Builder 6.1.2, and listed 575 Lexington Avenue in New York.

These are facts about what the site published. They are not independent verification of every donation or institutional affiliation it claimed.

The current registration began on March 3, 2023 and is parked for sale. See the Wayback history and WHOIS.

JeffreyEpsteinInternational.com

This site presented Epstein as involved in diplomacy and Middle East peace work.

One press release connected the Jeffrey Epstein VI Foundation to the International Peace Institute and is preserved in the files as EFTA02006494.

The domain’s claims are evidence of how Epstein marketed himself. They are not independent proof that he created or directed the institutions and initiatives described.

The current registration began on March 3, 2023 and is parked for sale. See the Wayback history and WHOIS.

JeffreyEpsteinNewYork.com

The May 26, 2013 archive establishes this as an operating promotional site titled Jeffrey Epstein New York.

Its navigation included New York News, Archives, New York Press, About, and Contact. The page republished or presented promotional stories about charter schools, education, and the New York Academy of Art.

It explicitly listed jeffreyepsteineducation.com and jeffreyepstein.org as sources, used GoDaddy Website Builder 6.1.2, and displayed the Jeffrey Epstein VI Foundation name and 575 Lexington Avenue, 4th Floor, New York.

This archive upgrades the domain from a name appearing only on a portfolio list to a confirmed historical reputation site. It also establishes coordinated cross-linking with the education and dot-org properties.

It does not independently prove the charitable contributions or institutional relationships asserted in the site’s promotional copy.

The present registration began on December 24, 2023. A supplied capture of the www address returned NXDOMAIN.

See the complete Wayback history and WHOIS.

A Coordinated Branded Site Cluster

The three reviewed 2013 captures provide direct evidence that the branded sites functioned as an interconnected publishing cluster rather than isolated pages.

Archived site	Page title or identity	Cross-links visible in the capture	Shared technical and address evidence
jeffreyepsteinnewyork.com	Jeffrey Epstein New York and New York News	Education and dot-org sites	GoDaddy Website Builder 6.1.2; 575 Lexington Avenue, 4th Floor
jeffreyepsteineducation.com	Jeffrey Epstein Education	New York and dot-org sites	GoDaddy Website Builder 6.1.2; 575 Lexington Avenue
jeffreyepstein.org	Jeffrey Epstein Philanthropy	Science and international sites	GoDaddy Website Builder 6.1.2; 575 Lexington Avenue, 4th Floor

The repeated builder version, address, content, and cross-links are strong evidence of coordinated construction and distribution.

The pages also demonstrate how one Epstein-branded site could cite another Epstein-branded site as a source, creating the appearance of multiple corroborating publications without providing independent verification.

JeffreyEpsteinSports.com

This site is not visible in the captured ten-domain list, but its role is documented by archived material and later investigation.

Cronkite News reconstructed its history. Epstein’s team launched it with science and general reputation sites in October 2010.

A Japanese entity acquired the domain in April 2012. It later carried unrelated family and commercial content, became inactive, and was recreated after the 2026 document release.

The 2026 recreation should not be presented as an authentic surviving Epstein site. It is a later reconstruction by an unidentified purchaser.

See the Wayback history.

JeffreyEpstein.net

Reporting shows that Epstein’s reputation team pursued this exact-name domain by early 2014.

Forbes reported that Tyler Shears created the site and managed jeffreyepstein.org as part of paid reputation work.

The domain now has a different public purpose. A volunteer acquired jeffreyepstein.net for EpsteinWiki, and it redirects to the wiki.

This is a preservation and accountability use, not evidence that the current domain is part of Epstein’s old network.

See the Wayback history and JeffreyEpstein.net.

Late November 2012 correspondence provides direct evidence supporting the separation between the two website groups. A redacted campaign participant asked Reputation Changer to promote “3 of yours and 2 of mine.” The listed websites indicate that jeffreyepsteinfinance.com, jeffreyepsteininfo.com, and jeffreyepstein.co belonged to Reputation Changer’s production track, while jeffreyepsteinusvi.com and jeffreyepsteineducation.com were being built or managed separately by the sender. The correspondence appears in EFTA02024989 and EFTA02024990. This establishes operational attribution, not necessarily legal ownership of the domain registrations.

---

The 2011 and January 2012 Internet Disclosures

On November 1, 2011, Darren Indyke notified the New York Sex Offender Registry that Epstein had opened a Twitter account using the name jeffreyepstein1.

The letter is preserved as EFTA01110814. An identical copy also appears as EFTA00306045.

The registry returned the notice because it had not been signed by Epstein. In a subsequent letter, EFTA00686364, Epstein stated that he had signed the notification and expressly confirmed that he opened the jeffreyepstein1 account.

This is stronger than an attorney reporting the account on his behalf.

Twitter service emails provide a separate connection between the account and Epstein’s known jeevacation@gmail.com address.

EFTA00686405 is an October 30, 2011 follower notification addressed to that email account and naming @jeffreyepstein1.

EFTA00719817 is a November 28, 2011 message telling “jeffrey epstein” that the service had missed him at the same Twitter handle.

These records establish the account connection. They do not establish who personally wrote each post or managed the account on a particular day.

On January 24, 2012, Epstein submitted another update to the registry. EFTA00586845 is the cover letter.

The attached inventory, stamped EFTA00586846, listed the following internet infrastructure:

• five email addresses
• Twitter names jeffrey_epstein and jeffreyepstein1
• Google Plus, LinkedIn, Yahoo, Flickr, Twitter, and Facebook profiles or networks
• the custom Blogger address thejeffreyepsteinfoundation.com
• the hosted Blogger address jeffreyepsteinfoundation.blogspot.com
• jeffreyepstein.org
• jeffrey-epstein.com
• jeffreyepsteinfoundation.com

This filing is important because it documents a platform layer around the domain portfolio. The operation did not consist only of websites.

It also used email identities, social accounts, hosted blogs, and profiles that could publish, cross-link, and distribute the same favorable material.

An archived February 2012 capture confirms that thejeffreyepsteinfoundation.com was a Blogger site titled The Jeffrey Epstein Foundation.

Its source identifies Blogger blog ID 7786059209366880856. The site published foundation descriptions, event notices, photographs with scientists, and a link to a foundation Facebook page.

The archive establishes what the site published and how it was hosted. It does not independently verify the promotional claims in its posts.

The current registration for thejeffreyepsteinfoundation.com began on December 24, 2023, according to the Verisign RDAP record.

The current registration for jeffrey-epstein.com began on August 11, 2019, according to its Verisign RDAP record.

Neither later registration establishes continuity with the addresses reported in 2012. The Blogspot address currently redirects to a Blogger sign-in page, and its controller is not publicly identified.

---

A Shared 2023 Registration Cluster

Four current domains share the same registration date, registrar, pair of IP addresses, and parking configuration:

• jeffreyepsteineducation.com
• jeffreyepsteinforum.com
• jeffreyepsteininternational.com
• jeffreyepsteinusvi.com

Each was created on March 3, 2023, used GoDaddy, resolved to 3.33.130.190 and 15.197.148.33, and displayed a sales landing page in the supplied captures.

This technical overlap is consistent with common acquisition or management, but it is not proof. GoDaddy parking infrastructure can create shared technical characteristics.

Public records do not establish the person or company behind the cluster, so this article does not assign an owner.

---

Sites Maintained by Third-Party Reputation Managers

Epstein’s sex offender registration attachment contains a broader internet inventory spanning four pages.

The first pages list vehicles, aircraft, telephone numbers, email accounts, ten websites, social profiles, business directories, and media accounts.

The final page identifies six additional properties under the heading “Additional Websites and Blog Sites Maintained by Third Parties With Content Relating to Philanthropic, Science or Business Related Activities of Jeffrey Epstein.”

The six disclosed properties are:

• www.jeffreyepstein.co
• www.jeffreyepsteininfo.com
• www.jeffreyepsteinfinance.com
• www.jeffreyepstein93.wordpress.com
• www.jeffreyepsteins.blogspot.com
• www.jeffreyepstein93.jux.com

The distinction matters.

The note on EFTA01136494 states that Epstein retained third parties to provide reputation-management services. It says those providers independently created accounts, websites, blog sites, email addresses, and other web-based content about Epstein.

It further says the properties were “neither created nor used” by Epstein.

That disclaimer does not make the sites unrelated. The same paragraph says Epstein retained the service providers and was disclosing the sites as the providers identified them.

The proper classification is therefore contractor-maintained reputation infrastructure, not personally operated Epstein websites and not unrelated fan pages.

The July 2013 FDLE Email Inquiry

On July 25, 2013, the Florida Department of Law Enforcement sent an inquiry to jeffrey@jeffreyepstein.org asking whether the address was used by a person required to register as a sex offender.

Darren Indyke answered on Epstein’s behalf on July 30.

In EFTA00306059, Indyke stated that an internet reputation-management provider retained by Epstein had established the address.

He described the provider as independently creating internet accounts, websites, blogs, associated email addresses, and other content concerning Epstein’s business, scientific, and philanthropic activities.

EFTA00306060 states that the address was associated with multiple links, websites, and accounts.

This is direct documentary evidence of contractor-controlled infrastructure. It is also a statement from Epstein’s lawyer, not an independent technical audit.

Indyke’s additional assertion that Epstein never accessed or used the address should therefore be attributed to the letter rather than treated as independently proven.

The January 2015 Registry Update

On January 13, 2015, Indyke sent the New York Sex Offender Registry an updated internet inventory.

EFTA01070877 and EFTA01070878 report that a website and an internet account created by reputation providers had been accessed and used by unrelated third parties without authorization.

Indyke said that a provider responded by deleting several websites, changing account-access information, and adding and deleting internet accounts. Epstein signed and dated the letter beneath a confirmation statement.

The updated list retained four custom website addresses:

• www.jeffreyepstein.org
• www.jeffreyepsteinblog.com
• www.jeffreyepsteinusvi.com
• www.jeffreyepstein.net

The additional third-party section retained two hosted blogs:

• www.jeffreyepstein93.wordpress.com
• www.jeffreyepsteins.blogspot.com

Those entries appear on EFTA01070881 and EFTA01070882.

Compared with the broader 2013 disclosure, the 2015 inventory documents a substantial contraction or modification of the reported network.

It does not establish the exact deletion date for every omitted site, prove that every omitted domain was offline, or independently identify the people described as hackers.

JeffreyEpstein.co: Summary

This exact address appears on EFTA01136494. It is a country-code domain ending in .co, not a truncated .com address.

Archived evidence shows that the site was active by April 2013. The earliest successful root capture located for this review is dated April 22, 2013.

The site called itself Jeffrey Epstein: Science Philanthropy and Innovation. It promoted Epstein’s scientific relationships, charitable claims, conferences, and ideas.

Its source identifies WordPress 3.5.1, the Universal Analytics identifier UA-36021399-1, the WP Customer Reviews plugin, and assets loaded through flare360.info.

Those markers support comparison with the related contractor-maintained sites but do not independently establish the date the site first became public.

See the April 2013 archived page.

The archived code identifies a WordPress 3.5.1 site and Google Analytics property UA-36021399-1. It also loaded social-media plugin files through a flare360.info path labeled for jeffreyepsteinco.

Those details connect it technically to the information and finance sites discussed below.

The historical registration lapsed. The current domain was created on February 6, 2026 and is parked through Spaceship.

Its registrant is represented by Withheld for Privacy ehf in Reykjavik, Iceland. That is a privacy service, not the demonstrated beneficial owner.

The current registrar record therefore establishes the registrar, registration date, and privacy layer, but it does not identify the purchaser.

JeffreyEpsteinInfo.com: Summary

This domain appears on EFTA01136494 as a third-party-maintained reputation site.

An archived January 2013 page identifies its title as Jeffrey Epstein: A Foundation for Philanthropy.

The site promoted claims about science, medicine, ideas, and charitable giving. Its source contains upload paths dated November 2012, consistent with earlier construction but not conclusive proof of a public launch date.

The earliest successful root capture located for this review is January 9, 2013.

See the January 2013 archived page.

The archived source contains Google Analytics property UA-36021399-2, immediately following the identifier used by jeffreyepstein.co.

It also used the same WordPress era and the same customer-review plugin. The still-public Blogspot site repeatedly links to jeffreyepsteininfo.com, independently confirming that it served as a central destination within the 2012 contractor network.

The historical registration later lapsed. The current domain was created on February 13, 2026 through Namecheap and displays a recently registered domain parking page.

Its public record uses Withheld for Privacy ehf.

The Verisign registry record and Namecheap registrar record do not reveal the beneficial owner.

JeffreyEpsteinFinance.com: Summary

This domain appears on EFTA01136494 as a reputation site concerning Epstein’s business activities.

An archived May 2013 version called itself Jeffrey Epstein: Career in Finance. Its pages promoted Epstein’s Bear Stearns career, investing, real estate, media interests, and relationship with Leslie Wexner.

Its source contains upload paths dated December 2012, consistent with earlier construction but not conclusive proof of a public launch date.

See the May 2013 archived page.

Its source contains Google Analytics property UA-36021399-3. This completes a consecutive sequence with the .co and information sites.

It also used the same WordPress generation and customer-review plugin.

The historical registration lapsed. The current domain was created on February 6, 2026 through Namecheap and is parked.

Public registration data again identifies Withheld for Privacy ehf rather than the purchaser.

The Verisign registry record and Namecheap registrar record do not establish continuity with Epstein’s former contractors.

JeffreyEpstein93.wordpress.com

This hosted WordPress address appears on EFTA01136494. It remains publicly accessible at JeffreyEpstein93.wordpress.com.

The site contains five promotional posts dated from November 29 through December 7, 2012. Their subjects include Epstein’s biography, medical research, conferences, and philanthropy.

The account displays the author name “Jeffrey Epstein.” That display name is not proof that Epstein personally wrote the posts. The EFTA note says third-party reputation providers independently created this class of site.

Because this is a hosted subdomain, WHOIS identifies Automattic as the owner of wordpress.com, not the person or contractor controlling the individual blog.

The present WordPress account controller is not publicly identified. Continued public availability also does not show that the account is actively maintained.

JeffreyEpsteins.blogspot.com

This Blogspot address appears on EFTA01136494. It is distinct from the custom domain jeffreyepsteinblog.com, although both used blogging infrastructure.

The blog remains publicly accessible as Jeffrey Epstein’s Blog.

It contains four promotional posts dated from November 29 through December 7, 2012. The posts discuss philanthropy, education, and Virgin Islands programs, and repeatedly direct readers to jeffreyepsteininfo.com.

Those live links help reconstruct the original contractor network.

The current profile displays “Unknown.” Google owns the blogspot.com domain, but the identity of the Google account that created or now controls this particular blog is not public.

As with the WordPress site, the 2012 post dates establish the content timeline, not personal authorship by Epstein.

JeffreyEpstein93.jux.com

This Jux-hosted address appears on EFTA01136494. The individual page is no longer accessible, and a usable archived copy has not yet been recovered.

Jux was a hosted publishing platform. Ordinary registration records therefore describe the apex domain jux.com, not the person who created the Epstein subdomain.

The current Jux registry record shows a registration dating to 1997 and a current GoDaddy registrar.

It does not identify the historical subdomain account holder and does not establish any connection between the current apex-domain controller and Epstein.

The defensible conclusion is limited. Epstein’s registration attachment identifies this subdomain as a contractor-maintained reputation property. The original account creator and current account status remain unknown.

---

Detailed Findings and Shared Technical Fingerprint of the Contractor Sites

The archived source code supplies stronger evidence of common management than visual similarity alone.

Site	Earliest activity supported by the site	Google Analytics property	Shared technology
jeffreyepstein.co	Archived root from April 2013	UA-36021399-1	WordPress 3.5.1, WP Customer Reviews, social-plugin assets through flare360.info
jeffreyepsteininfo.com	Source paths dated November 2012; archived root from January 2013	UA-36021399-2	Same WordPress era and WP Customer Reviews plugin
jeffreyepsteinfinance.com	Source paths dated December 2012; archived root from May 2013	UA-36021399-3	Same WordPress era and WP Customer Reviews plugin

The identifiers share the same numeric base and have consecutive suffixes in the legacy UA-XXXXXX-YY format.

That pattern is consistent with related properties created under the same Universal Analytics account, especially when combined with the shared WordPress generation, plugins, timing, and promotional design.

It supports common or coordinated technical management, but the identifiers alone do not prove who configured the sites.

The common technical fingerprint is now supported by direct operational correspondence. In November 2012, a campaign participant grouped jeffreyepsteinfinance.com, jeffreyepsteininfo.com, and jeffreyepstein.co as three websites produced through Reputation Changer. Philippe Han separately described the finance content passing through Reputation Changer’s editors and development team before publication. See EFTA02024988 and EFTA02024990. The consecutive Analytics identifiers therefore corroborate the documentary attribution rather than standing alone as the primary basis for it.

See Google’s explanation of Universal Analytics tracking IDs.

The current registration pattern is separate from the historical website network. jeffreyepstein.co and jeffreyepsteinfinance.com were re-registered on February 6, 2026, approximately two and a half hours apart. jeffreyepsteininfo.com followed one week later, on February 13, 2026.

All three registrations use the same Iceland based privacy service. A privacy service conceals the registrant’s public identity and is not evidence that the service itself owns or controls the domains.

The timing is consistent with a coordinated acquisition, but public registration records do not identify the purchaser or establish continuity with Epstein, Reputation Changer, or the historical website operators.

jeffreyepstein.co and jeffreyepsteinfinance.com were re-registered on February 6, 2026, about two and a half hours apart. JeffreyEpsteinFinance.com

This domain appears in EFTA01136494 as a reputation site concerning Epstein’s business activities. An archived May 2013 version called itself Jeffrey Epstein: Career in Finance. Its pages promoted Epstein’s Bear Stearns career, investing, real estate, media interests, and relationship with Leslie Wexner. See the May 2013 archived website.

The archived source contains upload paths dated December 2012. This is consistent with the development period documented in the Reputation Changer correspondence, although an upload date does not independently establish the public launch date.

A November 26, 2012 email identified a JeffreyEpsteinFinance.com document as the remaining deliverable from Reputation Changer’s first month. A campaign participant replied that the finance website was being edited. The exchange appears in EFTA00876323.

Additional correspondence explains the production process. Philippe Han said the finance content passed through Reputation Changer’s editors for on page optimization before being sent to its development team for construction. Han expected the complete website to become publicly accessible the following Monday. See EFTA02024988.

A November 30 email described five websites as “3 of yours and 2 of mine.” In context, jeffreyepsteinfinance.com, jeffreyepsteininfo.com, and jeffreyepstein.co were the three websites associated with Reputation Changer’s production track. jeffreyepsteinusvi.com and jeffreyepsteineducation.com were being built or managed separately by the redacted sender. See EFTA02024989 and EFTA02024990.

A separate email later forwarded to Epstein explained that a writer had been assigned to rewrite the finance website according to the recipient’s instructions. The same message discussed access to the Reputation Changer Command Center. See EFTA01804621 and EFTA01804622.

Philippe Han also explained that guest posts could create promotional links through writer credits. His example stated that a fictional freelance writer could be described as having worked on projects such as jeffreyepsteinfinance.com. This demonstrates how the finance website could be promoted through articles that were not directly about Epstein. See EFTA02024991.

The archived source contains Google Analytics property UA-36021399-3. This completes a consecutive sequence with the Analytics identifiers used by jeffreyepstein.co and jeffreyepsteininfo.com. The three sites also used the same WordPress generation and customer review plugin. The technical evidence corroborates the documentary attribution to a coordinated production track.

The historical registration later lapsed. The current domain was registered on February 6, 2026 through Namecheap and is parked. The current registration does not establish continuity with Reputation Changer, Epstein, or the historical website. See the Verisign registration record.followed one week later.

All three records use the same Iceland-based privacy service.

The timing is consistent with a coordinated acquisition, but privacy services are widely used and may be applied by default. Public records therefore do not establish a common buyer or continuity with the historical contractors.

JeffreyEpsteinFinance.com: Detailed Documentary and Technical Evidence

This domain appears in EFTA01136494 as a reputation site concerning Epstein’s business activities. An archived May 2013 version called itself Jeffrey Epstein: Career in Finance. Its pages promoted Epstein’s Bear Stearns career, investing, real estate, media interests, and relationship with Leslie Wexner. See the May 2013 archived website.

The archived source contains upload paths dated December 2012. This is consistent with the development period documented in the Reputation Changer correspondence, although an upload date does not independently establish the public launch date.

A November 26, 2012 email identified a JeffreyEpsteinFinance.com document as the remaining deliverable from Reputation Changer’s first month. A campaign participant replied that the finance website was being edited. The exchange appears in EFTA00876323.

Additional correspondence explains the production process. Philippe Han said the finance content passed through Reputation Changer’s editors for on page optimization before being sent to its development team for construction. Han expected the complete website to become publicly accessible the following Monday. See EFTA02024988.

A November 30 email described five websites as “3 of yours and 2 of mine.” In context, jeffreyepsteinfinance.com, jeffreyepsteininfo.com, and jeffreyepstein.co were the three websites associated with Reputation Changer’s production track. jeffreyepsteinusvi.com and jeffreyepsteineducation.com were being built or managed separately by the redacted sender. See EFTA02024989 and EFTA02024990.

A separate email later forwarded to Epstein explained that a writer had been assigned to rewrite the finance website according to the recipient’s instructions. The same message discussed access to the Reputation Changer Command Center. See EFTA01804621 and EFTA01804622.

Philippe Han also explained that guest posts could create promotional links through writer credits. His example stated that a fictional freelance writer could be described as having worked on projects such as jeffreyepsteinfinance.com. This demonstrates how the finance website could be promoted through articles that were not directly about Epstein. See EFTA02024991.

The archived source contains Google Analytics property UA-36021399-3. This completes a consecutive sequence with the Analytics identifiers used by jeffreyepstein.co and jeffreyepsteininfo.com. The three sites also used the same WordPress generation and customer review plugin. The technical evidence corroborates the documentary attribution to a coordinated production track.

The historical registration later lapsed. The current domain was registered on February 6, 2026 through Namecheap and is parked. The current registration does not establish continuity with Reputation Changer, Epstein, or the historical website. See the Verisign registration record.

JeffreyEpstein.co: Detailed Documentary and Technical Evidence

This exact address appears in EFTA01136494. It is a country code domain ending in .co, not an incomplete .com address.

A November 2012 email provides additional evidence about its role in the reputation campaign. The sender asked that five Epstein websites be promoted and described them as “3 of yours and 2 of mine.” The formatting groups jeffreyepsteinusvi.com and jeffreyepsteineducation.com together, followed by jeffreyepsteinfinance.com, jeffreyepsteininfo.com, and jeffreyepstein.co. This supports the conclusion that the final three sites were on the Reputation Changer production track. It does not, by itself, establish the domains’ legal ownership. The email appears in EFTA02024990.

Archived evidence shows that the site was active by April 2013. The earliest successful root capture located for this review is dated April 22, 2013. The site called itself Jeffrey Epstein: Science Philanthropy and Innovation and promoted Epstein’s scientific relationships, charitable claims, conferences, and ideas. See the April 2013 archived page.

The archived source identifies WordPress 3.5.1, the WP Customer Reviews plugin, assets loaded through flare360.info, and Google Analytics property UA-36021399-1. The related information and finance sites used UA-36021399-2 and UA-36021399-3. These consecutive identifiers and shared technical components support coordinated management of the three websites, although they do not independently identify the individual who configured them.

The historical registration later lapsed. The current domain was created on February 6, 2026 and is parked through Spaceship. Its public registration record identifies Withheld for Privacy ehf, a privacy service, rather than the beneficial owner. The current registrar record establishes the registration date, registrar, and privacy layer but does not identify the purchaser or demonstrate continuity with Epstein’s former contractors.

JeffreyEpsteinInfo.com: Detailed Documentary and Technical Evidence

jeffreyepsteininfo.com appears in EFTA01136494 as one of the internet properties created and managed by third party reputation management providers working for Epstein.

A November 2012 email provides additional evidence about the website’s place in the campaign. The sender asked that five Epstein websites be promoted and described them as “3 of yours and 2 of mine.” The formatting groups jeffreyepsteinusvi.com and jeffreyepsteineducation.com together, followed by jeffreyepsteinfinance.com, jeffreyepsteininfo.com, and jeffreyepstein.co. This is consistent with the final three sites being produced or managed through the Reputation Changer campaign. The email appears in EFTA02024990. The message supports an operational connection, but it does not independently establish legal ownership of the domains.

An archived January 2013 version called itself Jeffrey Epstein: A Foundation for Philanthropy. The website promoted claims about Epstein’s involvement in science, medicine, education, ideas, and charitable giving. Its source contains upload paths dated November 2012, which are consistent with construction during the reputation campaign but do not conclusively establish when the website first became publicly available.

The earliest successful root capture located during this review is dated January 9, 2013. See the January 2013 archived website.

The archived source contains Google Analytics property UA-36021399-2. The related jeffreyepstein.co website used UA-36021399-1, while jeffreyepsteinfinance.com used UA-36021399-3. The three consecutive identifiers strongly support coordinated technical management.

The information website also used the same generation of WordPress and the same WP Customer Reviews plugin found on the related .co and finance websites. The still accessible Jeffrey Epstein Blogspot site repeatedly links to jeffreyepsteininfo.com, providing additional evidence that it served as a central destination within the 2012 promotional network.

The historical registration later lapsed. The current domain was created on February 13, 2026 through Namecheap and displays a recently registered domain parking page. Its public registration information uses Withheld for Privacy ehf rather than identifying the purchaser. The Verisign registry record and Namecheap registrar record establish the current registration date and registrar but do not reveal the beneficial owner.

The present registration should therefore be treated as separate from the historical reputation campaign unless additional evidence establishes continuity between the current registrant and Epstein’s former contractors.

---

The Wider Distribution Network

The registration attachment shows that the operation extended far beyond standalone domains.

EFTA01136493 and EFTA01136494 list profiles or business-directory entries across services including Blogspot, Facebook, LinkedIn, Myspace, Photobucket, Pinterest, PR.com, StumbleUpon, Technorati, Twitter, Vimeo, Wikipedia, Yahoo, Yelp, YouTube, and numerous local business directories.

These should not be counted as domains Epstein owned.

They should be treated as distribution accounts and citation nodes that could multiply the appearance of favorable content across search results.

The breadth of the list strengthens the conclusion that the campaign involved coordinated search saturation, not merely a handful of personal websites.

---

Reconstructing the Distribution Network

The disclosure shows how one favorable claim could be multiplied without becoming independently verified.

A foundation statement could appear first on an Epstein-branded domain, then be reposted to a contractor blog, distributed through PR.com or another press-release channel, listed on business directories, linked from a social profile, and cited by another Epstein-branded site.

Search engines could then display several URLs that ultimately traced back to the same promotional source.

The 2013 archive cluster demonstrates this directly. jeffreyepsteinnewyork.com, jeffreyepsteineducation.com, and jeffreyepstein.org cross-linked to one another, shared a website builder and Lexington Avenue address, and treated other Epstein-branded pages as sources.

The Blogspot site repeatedly directed readers to jeffreyepsteininfo.com.

These are documented examples of circular distribution.

The correct evidentiary rule is therefore source tracing. The number of pages repeating a claim does not equal the number of independent confirmations.

Researchers should follow each story back to its earliest known publisher and determine whether the outside page performed any independent reporting.

Documented Platform Inventory

EFTA01136493 and EFTA01136494 identify a large distribution footprint.

Clearly legible entries include:

• Owned or branded website services: GoDaddy-hosted websites and a site entry described as Webbs.
• Hosted publishing: Blogger, Blogspot, Weebly, WordPress, and Jux. EFTA00876323 documents edited article sets prepared for Blogger, Weebly, and WordPress.
• Documented guest post placements: blogupstairs.com and onlyto.com. Philippe Han identified these as two completed guest post placements during the first month. They should be classified as third party publishing locations, not as Epstein owned domains. See EFTA02024991
• Social and public profiles: Facebook, Google Plus, LinkedIn, Myspace, Photobucket, Pinterest, SodaHead, StumbleUpon, Technorati, Twitter, Vimeo, Yahoo, and YouTube.
• Press and content distribution: PR.com, Digg, Delicious, Gather, and Topix.
• Business and local directories: 411, AmericanTowns, Best of the Web, Bing Local, Chamber of Commerce, Citysearch, CitySquares, eLocal, EZlocal, Factual, GetFave, Google Maps, HopStop, Local.com, Manta, MapQuest, MerchantCircle, Patch, ShowMeLocal, Superpages, Switchboard, Tupalo, USCity.net, WhitePages, Yellowbook, YellowBot, YellowPageCity, Yelp, and Yext.
• Reference and discovery services: AboutUs and Wikipedia.

Several names in the scan are degraded or ambiguous. The images of EFTA01136493 and EFTA01136494 remain the controlling sources for exact historical spelling.

Inclusion in the disclosure means the account was associated with the online inventory supplied to registration authorities. It does not establish that Epstein personally created or used every account.

---

Domains Epstein Tried to Buy

JeffreyEpstein.com

Emails reported by Domain Incite show an effort to buy jeffreyepstein.com for $1,000 in 2013.

The available evidence does not show that the purchase was completed.

This address belongs in an attempted-acquisition list, not a confirmed-ownership list.

---

Names That Should Not Be Misattributed

Jeevacation.com

Epstein used the email address jeevacation@gmail.com, but that does not prove he owned the matching web domain.

Public registration evidence indicates jeevacation.com was created after his death.

It should not be listed as one of his websites without new historical ownership evidence.

Financial.net

Online posts have circulated an unsupported claim involving an address at financial.net.

No reliable evidence reviewed for this article establishes it as an Epstein-controlled domain. It remains excluded.

---

People Connected to the Online Reputation Operation

Tyler Shears

Forbes reported that a person named Tyler Shears created jeffreyepstein.net, managed jeffreyepstein.org, and received at least $50,000 for reputation-related work.

The emails identify a narrow professional role involving search results, websites, links, and favorable material.

Because the released correspondence does not provide enough unique identifying information to safely match the email identity to one particular public profile, this article does not attach an outside biography to the name.

Al Seckel

Emails and reporting connect Seckel to efforts to improve Epstein’s online image and manage information. He was married to Isabel Maxwell and his body was found at the bottom of a ravine in France it had been devoured by animals beyond recognition.

Relevant starting points include EFTA02418404, EFTA00754643, and the evidence linked in The Fancy Comma’s Seckel investigation.

Isabel Maxwell

The October 2010 plan, as reconstructed by Cronkite News from EFTA00754635, EFTA00754636, and EFTA00754637, listed Isabel Maxwell among proposed search consultants.

That supports a proposed role in the plan. It does not, by itself, establish what work she performed, what she knew about Epstein’s crimes, or whether she controlled a particular site.

Pablos Holman

Pablos Holman is a self described hacker, inventor, and technology futurist whose connection to Epstein’s reputation campaign began earlier than his introduction of search specialist Tyler Shears.

In September 2010, Al Seckel told Epstein that he and Holman had discussed making damaging Google results about Epstein “basically disappear.” Seckel estimated that the project would cost approximately $20,000 to $25,000 and said they knew the appropriate people to hire. Epstein then asked whether favorable articles would be needed to displace the damaging material. The exchange appears in EFTA02421209.

The October 2010 written strategy also listed Holman among the proposed search, technical, and consulting resources. That plan appears across EFTA00754635, EFTA00754636, and EFTA00754637.

These documents establish that Seckel represented Holman as participating in the early discussions and included him in the proposed technical team. They do not establish that Holman personally edited Wikipedia, illegally accessed a computer system, controlled any particular Epstein website, or completed every task described in the proposal.

Holman later connected Epstein with Tyler Shears, who performed documented website and search reputation work. Holman’s involvement should therefore be distinguished from Shears’s separately documented services and payments.

Christine Maxwell, Paul Kirkaas, and Baron Reichart

Christine Maxwell, Paul Kirkaas, and Baron Reichart also appeared in the October 2010 proposal as possible search, technical, or consulting resources. Their inclusion is documented in EFTA00754635, EFTA00754636, and EFTA00754637.

Being named in a proposal does not establish that each person accepted the assignment, received payment, performed the proposed work, controlled an Epstein website, or knew the complete purpose of the campaign. Stronger conclusions require separate communications, invoices, payment records, work products, or testimony.

The Unidentified Hackers

The 2010 reputation proposal also referred to an unidentified group of “hackers” and allocated $2,500 for their proposed work. The related planning material appears in EFTA00754643.

The available record does not identify these individuals or establish whether the proposed payment was completed. They should not automatically be identified as Pablos Holman, Vincenzo Iozzo, or any other named technical consultant without additional evidence.

The reference is nevertheless important because it shows that Epstein’s proposed reputation operation included a technical component described by its organizers as hacking. That component existed alongside website creation, search engine manipulation, favorable content production, Wikipedia activity, and efforts to suppress damaging search results.

Philippe Han and Reputation Changer

Philippe Han is identified in the released correspondence as a senior client account manager for Reputation Changer.

On November 26, 2012, Han documented returned edits and approvals for Jeffrey Epstein articles prepared for Blogger, Weebly, and WordPress. He also identified a JeffreyEpsteinFinance.com document as the remaining item from the campaign’s first month and referred to preparing the strategy for the following month.

A January 2013 update from Han later described guest posts, sponsored reviews, press releases, search results, social media accounts, and articles intended for websites that Reputation Changer said it controlled.

The November production email appears in EFTA00876323. The January campaign update appears in EFTA02565443 through EFTA02565448.

These records establish Han’s account management role in the reputation campaign. They do not establish that he personally wrote every article or personally registered every account. Nothing in these records connects him to Epstein’s trafficking crimes.

The Unidentified Hackers

The 2010 reputation proposal also referred to an unidentified group of “hackers” and allocated $2,500 for their proposed work. The related planning material appears in EFTA00754643.

The available record does not identify these individuals or establish whether the proposed payment was completed. They should not automatically be identified as Pablos Holman, Vincenzo Iozzo, or any other named technical consultant without additional evidence.

The reference is nevertheless important because it shows that Epstein’s proposed reputation operation included a technical component described by its organizers as hacking. That component existed alongside website creation, search engine manipulation, favorable content production, Wikipedia activity, and efforts to suppress damaging search results.

Michael Keesling

The 2010 plan assigned Keesling responsibility for content on the pseudo-sites.

Cronkite News reports from released correspondence that Keesling hired writers in the Philippines and agreed to perform the work for $25,000.

This establishes a reported content and search-optimization role. It does not establish involvement in Epstein’s trafficking crimes.

Gregory Markel and Infuse Creative

Markel is important because the record shows a refusal.

According to a released email quoted by Cronkite News, Markel declined the project after explaining that his company would not take the assignment if the allegations and conviction were true.

He should be listed as a contacted vendor who declined, not as a participant in the operation.

Christina Galbraith

Galbraith appears in later reputation correspondence as a media, content, and public-relations contact for the Jeffrey Epstein VI Foundation.

In September 2013, Galbraith told Tyler Shears that she had uploaded a new image to Epstein’s Wikipedia biography with “proof of ownership” and hoped it would push the mug shot farther down the page. Epstein was copied on the email. The same message asked Shears about renewing Epstein’s science and education websites through GoDaddy. The correspondence appears in EFTA01959711. It documents Galbraith’s involvement in Wikipedia presentation and domain maintenance, but it does not identify the Wikipedia account used or establish how long the replacement image remained visible.

In March 2014, she instructed Tyler to promote exact-name pages that were “not our websites,” discussed Google crawling and ranking, and proposed another artificial-intelligence site using a different domain or server.

Those messages appear in EFTA01928953 and EFTA01928954.

A later registry inventory associates christina@jeffreyepstein.org with BrandYourself and Grant Watch and galbraith_christina@yahoo.com with Idealist.

The inventory appears in EFTA02445699.

This links Galbraith-associated email identities to specific reputation accounts but does not independently prove who created or operated each account.

In January 2019, Galbraith wrote that she had previously worked for Epstein’s foundation and offered future work in exchange for occasional use of its conference room.

The message appears in EFTA02275605 and EFTA02275606.

It documents her description of the prior relationship and an attempt to reconnect, not renewed employment or approval of her request.

Vincenzo Iozzo and the Alleged “Personal Hacker”

A separate FBI record raises questions about another cybersecurity expert connected to Jeffrey Epstein. This allegation must not be confused with the documented 2010 reputation campaign.

In EFTA01683874, an FBI informant alleged in 2017 that Epstein had a “personal hacker.” The individual was not named in the publicly released record. According to the informant, the person was born in Calabria, Italy, specialized in discovering vulnerabilities affecting Apple iOS, BlackBerry devices, and the Firefox browser, and developed offensive cyber tools.

Those identifying details closely resemble the professional history of Italian cybersecurity researcher Vincenzo Iozzo. Reporting by TechCrunch found that Iozzo communicated with Epstein and arranged meetings with him between 2014 and 2018. The released correspondence reportedly contains more than 2,300 documents mentioning Iozzo.

However, the FBI record contains an informant’s allegations, not a verified FBI finding. Iozzo has denied being Epstein’s hacker or conducting hacking work for him. He has said that his interactions with Epstein concerned possible business opportunities, markets, and emerging technologies that did not develop into completed projects.

No evidence reviewed for this article establishes that Iozzo participated in the 2010 search manipulation operation, edited Epstein’s Wikipedia page, managed Epstein’s websites, or performed reputation work for him. He belongs on this page as a separately documented cybersecurity connection and the apparent subject of an unverified informant allegation, not as a proven member of Epstein’s reputation management team.

---

Documented and Reported Payments

The available record establishes that the operation was paid work, but it does not yet provide a complete ledger.

Amounts below are limited to what the cited documents or reporting support.

Recipient or service	Amount	What the evidence supports	Source and limitation
Michael Keesling and the proposed pseudo-site work	$25,000	Agreed fee for content and search work described in the 2010 plan.	Cronkite News reporting from released correspondence. EFTA00778138 separately records Epstein saying money had been sent. The public record reviewed here does not supply a complete invoice and bank-transfer chain.
Tyler Shears	At least $50,000	Payment for later website and search-reputation work.	Forbes. This article should be updated when the corresponding invoices or transfers are individually indexed in Epstein Data.
Integrity Defender	$2,149 fee discussed	A May 2012 email said the provider was not showing enough progress and proposed deducting its fee.	EFTA02698102. The email supports an existing charge or engagement but does not supply an invoice, payment confirmation, or full scope of work.
Reputation Changer LLC	Initial proposal of $7,500 for the first month and $5,000 monthly thereafter; later trial instruction for $12,500	The April proposal described one pricing structure. October records document Epstein’s approval of a trial, a $12,500 wire instruction, and creation of a campaign account and dashboard. November correspondence documents first month article production across Blogger, Weebly, WordPress, and JeffreyEpsteinFinance.com.	EFTA01176557, EFTA02562081, EFTA01983825, EFTA01580804, EFTA01993247, and EFTA00876323. The records establish approval, a payment instruction, an account, a dashboard, and active production. They do not establish the total amount ultimately paid across the entire engagement.
Unnamed or multiple reputation firms	Up to $12,500 per month	Maximum monthly fee described among proposals and arrangements reviewed by reporters.	Bloomberg. This is not a claim that every provider received that amount.
Continuing 2010 operation	$2,500 shortfall discussed	Evidence of a funding dispute that threatened continued operation.	Cronkite News. The amount is evidence of the dispute, not the total campaign cost.

The payment evidence currently proves that Epstein funded reputation activity. It does not yet permit a complete total.

A defensible financial ledger still requires underlying invoices, recipient accounts, payment dates, bank records, and a domain or task linked to each transfer.

---

How the Network Worked

The evidence supports a recurring process:

1. Create multiple exact-name domains around favorable subjects.
2. Publish similar biographies, donation claims, photographs, and press releases across them.
3. Link the sites to one another and to outside articles.
4. Monitor Google placement for searches of Epstein’s name.
5. Add interviews and inbound links to raise favorable pages.
6. Use prestigious institutions and well-known people as reputational signals.
7. Generate enough content that crime reporting competed with Epstein-controlled material in search results.

The sites therefore matter as evidence of reputation management, narrative laundering, and institutional access.

They are not evidence that every featured person participated in the operation or knew why an image or name was being used.

---

Search Results Before and After the 2010 Campaign

The surviving record does not provide a complete neutral data set for every Google user. It provides dated snapshots and contemporaneous discussions sufficient to show active measurement.

Date or phase	Evidence	What can safely be concluded
Before September 2010	Emails describe negative articles, conviction-related terms, and unfavorable search visibility as the problem to solve.	Epstein and his advisers were concerned about the prominence of reporting about his crimes.
September and October 2010	EFTA02421209 and the October proposal.	The team developed a deliberate plan to replace or push down unfavorable results using favorable and pseudo-site content.
October 29, 2010	Three sites were reported launched.	The plan moved from proposal to at least partial execution.
November 5, 2010	EFTA00752512.	In the captured search, three desired properties appeared on the first page and only two prominent negative articles remained there.
November 2011 through January 2012	EFTA01110814, EFTA00686364, EFTA00586845, and EFTA00586846.	Registry records document the jeffreyepstein1 Twitter account and a wider network of emails, profiles, hosted blogs, and domains.
April and May 2012	Reputation Changer prepared a personalized suppression proposal, and an adviser delivered it directly to Epstein after comparing other firms.	The campaign was actively considered. The reviewed evidence does not establish Epstein’s acceptance or payment to Reputation Changer.
2012 through 2013	Contractor sites, cross-linked branded pages, hosted blogs, and directories.	The reputation effort continued in new forms after the first Seckel phase.
March 2014	Galbraith directed the promotion of unrelated exact-name results and discussed another site, domain extension, separate server, press material, and Google crawling.	The team deliberately promoted favorable pages it did not control. The record does not show that those independent pages were fabricated.
2019	Previously published favorable material was reexamined and some pages were removed by publishers.	The later removals do not erase their earlier potential contribution to search results.

This evidence demonstrates intent, implementation, and at least one measured result.

It does not establish what every person saw when searching Epstein’s name, how long each ranking lasted, or that the campaign alone caused an individual or institution to associate with him.

---

Wikipedia and Reference Page Activity

Wikipedia mattered because its prominence could influence both readers and search results. Released correspondence describes efforts to change Epstein’s biography, replace unfavorable material, add philanthropy claims, and reduce the visibility of his criminal record. The records also document resistance from volunteer editors who reversed some changes.

A September 16, 2013 email provides direct evidence of an effort to change the image displayed on Epstein’s Wikipedia biography. Christina Galbraith told Tyler Shears that she had “uploaded a new WIKI image with proof of ownership” and hoped it would “push back the mug shot.” Epstein was copied on the email. The message appears in EFTA01959711.

The same email asked whether the science and education websites could be renewed through GoDaddy. In context, this appears to refer to Epstein branded science and education sites, although the message does not provide both complete domain names. This connects Wikipedia work, domain maintenance, and reputation management within the same correspondence.

The email establishes that Galbraith reported uploading a replacement image and that Epstein was kept informed. It does not, by itself, identify the Wikipedia account used, establish how long the replacement image remained visible, or prove that the attempt permanently displaced the mug shot.

EFTA00753570 documents related search placement discussions involving Epstein’s websites. The broader strategy described in EFTA02421209 and reporting by Forbes, The Verge, and Edit History further connects Wikipedia to the reputation campaign.

The evidence supports the conclusion that Epstein’s advisers attempted to influence his Wikipedia presentation. It does not justify attributing every disputed edit to Epstein, Galbraith, Shears, or another specific person without supporting account, IP address, timing, and edit history evidence.

---

Why This Mattered to Survivors and the Public

This was not ordinary branding conducted in a factual vacuum.

Epstein had already been convicted when the 2010 campaign was designed. The negative material being targeted included reporting about his sexual offenses and treatment of girls.

Replacing that material with philanthropy, science, education, and diplomacy pages could make accurate information about his record less visible to people deciding whether to meet him, accept money, visit his properties, introduce students, or enter a professional relationship.

The released plan and ranking discussions establish that suppressing or displacing negative information was an intended goal.

The evidence does not permit EpsteinWiki to calculate how many people were misled, identify every institutional decision affected by the search results, or claim that the campaign alone enabled later abuse.

Those questions require testimony and institutional records.

The public interest is nevertheless clear. Reputation infrastructure can affect whether survivors are believed, whether warnings are found, and whether a convicted offender regains access to institutions.

Preserving these sites is therefore part of preserving the history of how Epstein attempted to rebuild legitimacy after conviction.

---

Related EpsteinWiki Research

Readers should compare this domain history with EpsteinWiki’s broader documentation of the Jeffrey Epstein evidence archive, the organizations promoted by his foundations, the people named in the reputation proposals, and the businesses that funded or administered his operations.

---

Current Safety Warning

Old domains can be re-registered by anyone. A familiar historical name may now host advertising, malware, impersonation, or fabricated archives.

Researchers should:

• open archived pages through the Internet Archive
• check WHOIS creation dates before attributing ownership
• avoid entering personal information on current sites
• avoid downloading files from unfamiliar live domains
• preserve screenshots, timestamps, and redirect chains
• distinguish an authentic archive from a later recreation

---

Unanswered Questions

• Who originally registered each of the ten portfolio domains, and on what dates?
• Which contractor created the consecutive UA-36021399 Analytics properties and built the three related WordPress sites?
• Which payments correspond to domain purchases, hosting, search-engine optimization, press-release distribution, and reputation monitoring?
• What person or company controlled flare360.info when the Epstein-site assets were hosted there?
• Who acquired the four-domain cluster in March 2023?
• Who controls the remaining current registrations?
• Are additional branded sites preserved in emails but absent from the captured portfolio?
• Which universities or organizations knowingly supplied biographies, links, or content?

---

Yes. Make these three changes.

1. Replace the existing combined Pablos Holman paragraph

Under People Connected to the Online Reputation Operation, delete the subsection titled:

Christine Maxwell, Pablos Holman, Paul Kirkaas, and Baron Reichart

Replace it with these two subsections:

Pablos Holman

Pablos Holman is a self described hacker, inventor, and technology futurist whose connection to Epstein’s reputation campaign began earlier than his introduction of search specialist Tyler Shears.

In September 2010, Al Seckel told Epstein that he and Holman had discussed making damaging Google results about Epstein “basically disappear.” Seckel estimated that the project would cost approximately $20,000 to $25,000 and said they knew the appropriate people to hire. Epstein then asked whether favorable articles would be needed to displace the damaging material. The exchange appears in EFTA02421209.

The October 2010 written strategy also listed Holman among the proposed search, technical, and consulting resources. That plan appears across EFTA00754635, EFTA00754636, and EFTA00754637.

These documents establish that Seckel represented Holman as participating in the early discussions and included him in the proposed technical team. They do not establish that Holman personally edited Wikipedia, illegally accessed a computer system, controlled any particular Epstein website, or completed every task described in the proposal.

Holman later connected Epstein with Tyler Shears, who performed documented website and search reputation work. Holman’s involvement should therefore be distinguished from Shears’s separately documented services and payments.

Christine Maxwell, Paul Kirkaas, and Baron Reichart

Christine Maxwell, Paul Kirkaas, and Baron Reichart also appeared in the October 2010 proposal as possible search, technical, or consulting resources. Their inclusion is documented in EFTA00754635, EFTA00754636, and EFTA00754637.

Being named in a proposal does not establish that each person accepted the assignment, received payment, performed the proposed work, controlled an Epstein website, or knew the complete purpose of the campaign. Stronger conclusions require separate communications, invoices, payment records, work products, or testimony.

2. Add this directly after the new sections

Place this after Christine Maxwell, Paul Kirkaas, and Baron Reichart and before Michael Keesling.

The Unidentified Hackers

The 2010 reputation proposal also referred to an unidentified group of “hackers” and allocated $2,500 for their proposed work. The related planning material appears in EFTA00754643.

The available record does not identify these individuals or establish whether the proposed payment was completed. They should not automatically be identified as Pablos Holman, Vincenzo Iozzo, or any other named technical consultant without additional evidence.

The reference is nevertheless important because it shows that Epstein’s proposed reputation operation included a technical component described by its organizers as hacking. That component existed alongside website creation, search engine manipulation, favorable content production, Wikipedia activity, and efforts to suppress damaging search results.

3. Add a separate clarification section before the payments section

Place this after all the named participant profiles and immediately before Documented and Reported Payments.

Vincenzo Iozzo and the Alleged “Personal Hacker”

A separate FBI record raises questions about another cybersecurity expert connected to Jeffrey Epstein. This allegation must not be confused with the documented 2010 reputation campaign.

In EFTA01683874, an FBI informant alleged in 2017 that Epstein had a “personal hacker.” The individual was not named in the publicly released record. According to the informant, the person was born in Calabria, Italy, specialized in discovering vulnerabilities affecting Apple iOS, BlackBerry devices, and the Firefox browser, and developed offensive cyber tools.

Those identifying details closely resemble the professional history of Italian cybersecurity researcher Vincenzo Iozzo. Reporting by TechCrunch found that Iozzo communicated with Epstein and arranged meetings with him between 2014 and 2018. The released correspondence reportedly contains more than 2,300 documents mentioning Iozzo.

However, the FBI record contains an informant’s allegations, not a verified FBI finding. Iozzo has denied being Epstein’s hacker or conducting hacking work for him. He has said that his interactions with Epstein concerned possible business opportunities, markets, and emerging technologies that did not develop into completed projects.

No evidence reviewed for this article establishes that Iozzo participated in the 2010 search manipulation operation, edited Epstein’s Wikipedia page, managed Epstein’s websites, or performed reputation work for him. He belongs on this page as a separately documented cybersecurity connection and the apparent subject of an unverified informant allegation, not as a proven member of Epstein’s reputation management team.

---

Source List

Primary and Documentary Sources

• Epstein Files Research Database
• EFTA00753570, search-ranking and site-promotion discussion
• EFTA02006494, international foundation press release
• EFTA02418404
• EFTA00754643
• EFTA02421209, September 2010 proposal to alter search results
• EFTA00754635, first page of the October 2010 search strategy
• EFTA00754636, continuation of the October 2010 search strategy
• EFTA00754637, proposed personnel and responsibilities
• EFTA00778138, Epstein’s response to the proposal
• EFTA00752512, November 2010 Google-results screenshot
• EFTA02421114, sports-site content discussion
• EFTA00751527, explanation of the sports blog’s anonymity
• EFTA01110814, November 1, 2011 Indyke notice reporting the jeffreyepstein1 Twitter account
• EFTA00306045, duplicate copy of the November 1, 2011 Twitter notice
• EFTA00686364, Epstein’s signed confirmation that he opened the jeffreyepstein1 account
• EFTA00686405, October 2011 Twitter notification connecting jeevacation@gmail.com to the account
• EFTA00719817, November 2011 Twitter service message for the same account
• EFTA00586845, January 24, 2012 registry-update cover letter
• EFTA00586846, January 2012 email, social-profile, hosted-blog, and domain inventory
• EFTA01176548, April 2012 Reputation Changer proposal cover
• EFTA01176550, proposal executive summary and favorable-content plan
• EFTA01176554, recommended search-suppression methodology
• EFTA01176555, mini-sites, hosting, articles, backlinks, press releases, and syndication
• EFTA01176556, proposed team and ranking guarantee
• EFTA01176557, proposed Reputation Changer pricing
• EFTA02698102, May 2012 email delivering the proposal to Epstein and discussing Integrity Defender
• EFTA02698103, continuation reproducing the proposed suppression methods
• EFTA02550125, message discussing work with “Reputation”
• EFTA01901932, discussion of Reputation Changer’s national and local search results
• EFTA01136491, first page of the sex offender registration attachment
• EFTA01136492, email and internet information
• EFTA01136493, disclosed websites and online accounts
• EFTA01136494, third-party reputation websites and explanatory note
• EFTA00306059, Indyke’s July 2013 response to the FDLE email inquiry
• EFTA00306060, continuation of the July 2013 FDLE response
• EFTA01928953, March 2014 instructions to promote exact-name pages that were not Epstein-controlled sites
• EFTA01928954, Google crawling, press release, AI site, domain extension, and hosting discussion
• EFTA01070877, January 2015 registry update reporting unauthorized access
• EFTA01070878, continuation and signatures of Indyke and Epstein
• EFTA01070881, updated 2015 website and online-account inventory
• EFTA01070882, continuation listing two remaining third-party-hosted blogs
• EFTA00808498, 2018 request for admission seeking authentication of the registry page
• EFTA00808501, attached public registry printout
• EFTA02445696, beginning of the later internet-account registry attachment
• EFTA02445699, registry-account inventory containing Galbraith-associated email addresses
• EFTA02275605, January 2019 message forwarded by Lesley Groff
• EFTA02275606, Galbraith’s description of prior foundation work and proposal to reconnect
• Archived JeffreyEpstein.org, December 2010
• Archived The Jeffrey Epstein Foundation Blogger site, February 2012
• Archived JeffreyEpstein.org, September 2013
• Archived JeffreyEpsteinEducation.com, May 2013
• Archived JeffreyEpsteinNewYork.com, May 2013
• Archived Jeffrey Epstein VI Foundation Blog photos
• Archived JeffreyEpstein.co, April 2013
• Archived JeffreyEpsteinInfo.com, January 2013
• Archived JeffreyEpsteinFinance.com, May 2013
• Live contractor-maintained WordPress blog
• Live contractor-maintained Blogspot blog
• Current JeffreyEpstein.co registrar record
• Current JeffreyEpsteinInfo.com registry record
• Current JeffreyEpsteinInfo.com registrar record
• Current JeffreyEpsteinFinance.com registry record
• Current TheJeffreyEpsteinFoundation.com registry record
• Current Jeffrey-Epstein.com registry record
• Current JeffreyEpsteinFinance.com registrar record
• Current Jux.com registry record
• Google documentation for Universal Analytics tracking IDs
• 2012 Rising Stars item citing JeffreyEpsteinUSVI.com
• EFTA02565446, January 2013 Reputation Changer update connecting epstein.jeffrey.tumblr.com to planned guest posts and campaign backlinks
• EFTA01959711, September 2013 email documenting the attempted Wikipedia image replacement and discussion of renewing Epstein’s science and education websites
• EFTA00876323, November 2012 Reputation Changer article approvals and JeffreyEpsteinFinance.com editing
• EFTA01804621, finance website rewrite, writer assignment, and Command Center password
• EFTA02024988, finance website optimization and development workflow
• EFTA02024989, request to launch the finance website and update published assets
• EFTA02024990, five website list and “3 of yours and 2 of mine” attribution
• EFTA02024991, staged blog publication and guest post backlink method
• EFTA02024993, first month production review

Additional Documentary Sources, Reporting, and Analysis

This bibliography collects the major reporting located during the present review. It should remain expandable as additional international reporting, independent investigations, and newly indexed evidence are identified.

• Cronkite News, the afterlife of JeffreyEpsteinSports.com
• Domain Incite, Epstein’s effort to acquire JeffreyEpstein.com
• Forbes, Epstein’s Google-search manipulation operation
• The Verge, Epstein emails and online reputation management
• Bloomberg, payments to reputation firms
• The Guardian, reputation-management documents
• The Daily Beast, Epstein’s network of promotional URLs
• Yahoo News, Epstein’s post-conviction press machine
• Edit History, investigation of possible Wikipedia editing
• The Fancy Comma, Al Seckel and science-reputation work
• Aftenposten, Norwegian reporting on Epstein’s search manipulation and its possible effect on what prospective contacts found online
• La Repubblica, Italian reporting on Al Seckel and the reputation campaign
• Facta, Italian analysis of Google-search and Wikipedia manipulation
• GIGAZINE, Japanese reporting on search and Wikipedia activity
• The Indian Express, international reporting on the cost and institutional effect of the campaign

Evidence	What it documents
EFTA02421209	Al Seckel told Epstein that he and Pablos Holman had discussed making damaging Google results disappear for approximately $20,000 to $25,000.
EFTA00754635	Part of the October 2010 written reputation strategy and proposed technical team.
EFTA00754636	Additional portion of the proposed websites, search, content, and technical strategy.
EFTA00754637	Additional portion of the proposed campaign and people presented as possible resources.
EFTA00754643	Planning material referring to unidentified hackers and the proposed technical budget.
EFTA00778138	Epstein responded to the proposal by stating that money had been sent. The document does not establish the final recipient of every payment.
EFTA01683874	FBI record containing an informant’s unverified allegation that Epstein had a personal hacker.