helpfulexperts.com — The First Subpoena and the Hidden Start of the SDNY Investigation
Investigation Report — February 24, 2026
Based on forensic analysis of the DOJ EFTA production (2.73M pages) and external research
Executive Summary
The first grand jury subpoena in the entire SDNY Epstein investigation was not about sex trafficking. It was about wire fraud.
On July 13, 2017, Acting U.S. Attorney Joon H. Kim signed a grand jury subpoena to Google, Inc. requesting all accounts associated with the domain helpfulexperts.com — a Google Workspace email domain registered since December 2006 that has left virtually zero trace on the public internet. The subpoena was issued under USAO Reference No. 2017R00550, citing 18 U.S.C. §§ 1341 and 1343 (mail fraud and wire fraud). A 180-day non-disclosure order, signed by Magistrate Judge Andrew J. Peck the previous day, prohibited Google from notifying anyone.
This subpoena is the only document in the entire 2.73M-page EFTA production that mentions helpfulexperts.com. The domain never appears in any seized email, financial record, or investigative memo. Despite being registered for 19 years, it has zero Google search results, zero media mentions, and zero Wayback Machine content snapshots. Yet as of December 2025, someone is still paying to maintain it — with all four domain protection flags enabled.
Every public source — PBS, NBC, NPR, the FBI's own records — states that the SDNY Epstein investigation began on December 6, 2018, prompted by the Miami Herald's "Perversion of Justice" series. This subpoena proves that SDNY had an active grand jury investigation 17 months earlier, operating under a different case number and different statutory authority. The public timeline of the Epstein investigation is wrong.
The Subpoena: EFTA00153743
The 9-page document (EFTA00153743, Dataset 9) contains:
- Pages 0-2: Application for a §2705(b) Non-Disclosure Order (sealed)
- Page 3: Cover letter from the AUSA to Google, Inc.
- Page 4: Grand Jury Subpoena face page
- Page 5: Rider (the operative demands)
- Page 6: Non-disclosure request
- Page 7: Declaration of Custodian of Records template
- Page 8: Signed Non-Disclosure Order (Magistrate Judge Andrew J. Peck, July 12, 2017)
Case Details
| Statutes | 18 U.S.C. §§ 1341 (mail fraud), 1343 (wire fraud) |
| Acting U.S. Attorney | Joon H. Kim |
| Magistrate Judge | Andrew J. Peck |
| Target | Google, Inc., 1600 Amphitheatre Parkway, Mountain View, CA |
The Rider
The rider requests all records for accounts associated with specific identifiers — the first bullet point is redacted in the production — plus "any other accounts associated with the domain 'helpfulexperts.com.'" The full demands include:
All email accounts hosted by Google using the domain name "helpfulexperts.com"
All subscriber identifying information (name, username, address, phone numbers, email addresses, DOB, SSN, network addresses, MAC addresses, browser/OS information)
Session times, durations, and IP addresses
Length of service and types of service utilized
Means and source of payment for services (credit card or bank account numbers)
Account notes, logs, and customer-service communications
Investigative files or user complaints concerning the subscriber
The redacted identifier above the helpfulexperts.com reference indicates prosecutors already knew of at least one specific account on the domain. They were asking Google to confirm it and reveal any others.
The Non-Disclosure Order
The §2705(b) application states that "the attached subpoena relates to an ongoing criminal investigation that is neither public nor otherwise known to all targets of the investigation." The 180-day non-disclosure order prohibited Google from notifying any subscriber about the subpoena until approximately January 2018.
Two Case Numbers, Two Investigations
The most significant finding in the corpus is that the helpfulexperts subpoena was filed under a completely different case number from the main Epstein sex-trafficking investigation.
| Case Number | First Appearance | Statutes | Subject |
| ------------- | ----------------- | ---------- | --------- |
| 2017R00550 | July 13, 2017 | §§ 1341, 1343 | Mail fraud, wire fraud |
| 2018R01618 | December 19, 2018 | §§ 1591, 371, 1594(c), 2422(b) | Sex trafficking, conspiracy |
USAO reference numbers in the format "YYYYR#####" designate grand jury investigations. The "2017" prefix indicates this investigation was opened in calendar year 2017 — 17 months before the sex-trafficking case (2018R01618) came into existence.
The later Google subpoenas — October 23, 2019 (EFTA00082565) and August 26, 2020 — all cite the trafficking case number 2018R01618 and the trafficking statutes. The July 2017 subpoena is the only document in the corpus filed under 2017R00550. No other EFTA references this case number.
Yet the subpoena appears in the EFTA production. The DOJ produced only documents responsive to the Epstein Files Transparency Act. Its inclusion means the Department considers this July 2017 fraud investigation part of the Epstein matter.
The Conventional Timeline Is Wrong
Every authoritative public source dates the SDNY Epstein investigation to late 2018:
- PBS: "FBI agents and the U.S. attorney's office in Manhattan began a new investigation into Epstein" on December 6, 2018
- NBC News: "In late 2018, a series of Miami Herald stories about the plea deal prompted federal prosecutors to take a fresh look"
- FBI Records (per Just Security): "On 12/06/2018, FBI NY initiated a case after Southern District of New York (SDNY) contacted FBI NY regarding several victims"
This subpoena proves that SDNY had an active grand jury — with a signed non-disclosure order, a specific target (helpfulexperts.com), and identified statutes (fraud) — in July 2017. This predates:
- The publicly reported FBI case opening by 17 months (December 6, 2018)
- Epstein's SDNY arrest by 24 months (July 6, 2019)
The Political Context of July 2017
The subpoena was signed during a specific political window:
- March 11, 2017: President Trump fires Preet Bharara as SDNY U.S. Attorney (after Bharara refuses to resign)
- July 12-13, 2017: Kim signs the helpfulexperts subpoena
- January 5, 2018: Geoffrey Berman takes over as Interim U.S. Attorney; Kim's acting period ends
- December 6, 2018: FBI NY opens the sex-trafficking case
- July 6, 2019: Epstein arrested
The investigation was initiated under Kim's leadership, months before Berman took office. Whether the fraud investigation continued under Berman, was paused, or was folded into the later trafficking case cannot be determined from the corpus.
The 524-Day Gap
After the July 13, 2017 subpoena, there are no further subpoenas in the EFTA production until December 19, 2018 — a 524-day gap, the longest in the entire investigative timeline. The Prosecutorial Query Graph flags this as a CRITICAL temporal gap (Gap ID 750).
This gap has three possible explanations:
The fraud investigation continued but its records were filed under 2017R00550, and only the initial subpoena was included in the EFTA production. The rest may exist in sealed court files.
The investigation was paused or dormant during the leadership transition from Kim to Berman.
The investigation concluded and was later reopened under different authority when the Miami Herald reporting created public pressure.
The December 2018 subpoenas that end the gap target entirely different entities — Oath Holdings/Yahoo for Epstein's personal email accounts ([email protected], [email protected], etc.) and Microsoft for [email protected]. These use the sex-trafficking case number 2018R01618. The helpfulexperts.com domain is never mentioned again.
The Ghost Domain
helpfulexperts.com is one of the most thoroughly invisible domains on the internet.
Registration and Maintenance
| Registrar | GoDaddy.com, LLC |
| Last Updated | December 23, 2025 |
| Protection Flags | clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited |
| Registrant | Redacted (GoDaddy WHOIS privacy) |
All four client-side domain lock flags are enabled — the maximum protection posture available from a registrar. The domain was updated as recently as December 23, 2025. Someone is still actively maintaining and paying for this domain nearly 20 years after registration.
DNS Infrastructure
The domain's DNS records confirm it was a Google Apps (now Google Workspace) domain with full email capability:
| ------------- | ------- | --------- |
| A | 216.239.32/34/36/38.21 | Google Blogger custom domain IPs |
| MX | aspmx.l.google.com (+ 6 alternates) | Google Workspace email — full mail configuration |
| CNAME (www) | ghs.google.com | Google Hosted Services |
| CNAME (start) | ghs.google.com | Google Apps dashboard/start page |
| SOA serial | 2016050400 | DNS zone last updated ~May 4, 2016 |
The MX records prove that @helpfulexperts.com email addresses existed and were hosted by Google. The subpoena's request for "all email accounts hosted by Google using the domain name 'helpfulexperts.com'" was precisely targeted — prosecutors knew the domain ran Google-hosted email.
The SOA serial date of May 2016 indicates the DNS zone was last structurally modified over a year before the subpoena, suggesting the domain's technical infrastructure was established well in advance of the investigation.
Internet Presence
| Google: "helpfulexperts.com" | Zero |
| Google: "helpfulexperts" | Zero |
| Google: "helpful experts" + Epstein | Zero |
| Wayback Machine content snapshots | Zero (7 captures, all redirects to dead Google page) |
| CourtListener: "helpfulexperts" | Zero |
| Forum posts, social media, link directories | Zero |
A domain registered for 19 years with zero internet footprint is extraordinary. No website content was ever captured by the Wayback Machine. No one has ever linked to it, mentioned it, or referenced it anywhere on the public internet. The only evidence it exists is its DNS records, its WHOIS entry, and one page of one subpoena in the EFTA production.
Current Behavior
Visiting helpfulexperts.com in a browser (verified February 24, 2026) produces:
HTTP 301 redirect to start.helpfulexperts.com
HTTP 302 redirect to partnerpage.google.com/helpfulexperts.com
Google 404 error
The partnerpage.google.com service was Google's AdSense for Domains program, which displayed advertisements on parked custom domains. Google shut down this service effective February 10, 2026.
No Return, No Response
There is no Google return for the July 2017 subpoena anywhere in the EFTA corpus. The Prosecutorial Query Graph flags all three Google subpoenas as having "no matched returns" (Gap IDs 35, 43, 101), but the automated matching system failed to link the later returns that do exist:
| Subpoena | Return Found? | Details |
| ---------- | -------------- | --------- |
| July 2017 (helpfulexperts) | No | No return exists in production |
| December 2018 (Epstein emails) | Yes | Google produced records January 15, 2019 (EFTA00170256) for jeevacation, jeeitunes, jeffreyepsteinorg accounts |
| October 2019 (Maxwell) | Yes | Google produced records December 30, 2019 (EFTA00082559) for Maxwell accounts |
| August 2020 (unidentified) | Yes | Google responded September 1, 2020 (EFTA00019636), partially objecting |
The absence of a return for the helpfulexperts subpoena likely reflects that the return was filed under the separate case 2017R00550 and was either not included in the EFTA production or remains sealed. It is also possible Google found no responsive records, though this seems unlikely given the domain's active Google Workspace configuration.
The NDO Expiration Email
On February 21, 2020, an AUSA emailed colleagues (EFTA00029774, Dataset 8):
"FYI, our NDO for the subpoenas we cut at the beginning of the case for Epstein's email accounts has expired, so they're going to notify (unclear to me who they'll notify, of course). I have no problem with that, but let me know if you think there are any issues there."
The reply: "Thanks, agree that shouldn't be a problem."
The phrase "subpoenas we cut at the beginning of the case for Epstein's email accounts" likely refers to the December 2018 Google and Yahoo subpoenas, but the characterization of "the beginning of the case" is ambiguous — it could encompass the July 2017 subpoena as well. The AUSA's reference to "Epstein's email accounts" implies the helpfulexperts.com domain was considered part of the Epstein email infrastructure.
The Full Google Subpoena Timeline
Phase 1: The Fraud Investigation (Case 2017R00550)
| July 12, 2017 | Magistrate Judge Peck signs NDO | EFTA00153743 p.8 |
| July 13, 2017 | Grand jury subpoena to Google re: helpfulexperts.com | EFTA00153743 |
524-day gap — no further subpoena activity in the production
Phase 2: The Sex-Trafficking Investigation (Case 2018R01618)
| Dec 12, 2018 | Preservation request to Oath Holdings (Yahoo) | EFTA00037896 |
| Dec 19, 2018 | Subpoena to Google — jeevacation, jeeitunes, jeffreyepsteinorg | (referenced in return) |
| Jan 15, 2019 | Google return — 3 account info files | EFTA00170256 |
| Aug 1, 2019 | FBI subpoena tracking email — Amazon non-responsive | EFTA01660712 |
| Aug 15, 2019 | NDO calendar cancellation — Google/Apple/Oath | EFTA00014338 |
| Oct 23, 2019 | Subpoena to Google — Ghislaine Maxwell accounts | EFTA00082565 |
| Dec 30, 2019 | Google return — Maxwell account info | EFTA00082559 |
| Feb 21, 2020 | AUSA email — NDO for Epstein email subpoenas expired | EFTA00029774 |
| Aug 2, 2020 | Discovery review — Google responses marked "No issues" | EFTA00074886 |
| Aug 26, 2020 | Subpoena to Google — partially objected | (referenced in return) |
| Sep 1, 2020 | Google return — partial compliance, some objections | EFTA00019636 |
What We Don't Know
Who registered helpfulexperts.com. Historical WHOIS records from before GDPR privacy (pre-2018) might reveal the registrant, but these require paid database subscriptions (DomainTools, WhoisXML API) to access.
What the redacted identifiers are. The first bullet point on the rider — the specific email addresses or account identifiers prosecutors already knew about — was redacted from the EFTA production.
What Google produced in response. No return for this subpoena exists in the corpus. It may be sealed under the separate case number 2017R00550.
Why the domain has zero internet presence. A Google Workspace domain registered since 2006, actively maintained through 2025, with full email infrastructure — and yet no email from or to @helpfulexperts.com appears anywhere in the 2.73M-page production, and no trace of it exists on the public internet. This level of invisibility is consistent with a domain used exclusively for private communication.
Who is still maintaining the domain. Someone renewed helpfulexperts.com as recently as December 23, 2025, and has all four domain protection flags enabled. Nineteen years of registration fees for a domain that serves no visible content.
Whether the fraud investigation (2017R00550) produced additional records that were either not included in the EFTA production or remain sealed.
Structural Observations
1. The Investigation Had an Earlier, Unreported Phase
The existence of case number 2017R00550 proves that SDNY was investigating Epstein-related matters under fraud statutes in mid-2017 — well before any public reporting or the Miami Herald series that is universally credited with triggering the investigation. The fraud investigation may have been the precursor to, or ran parallel with, the sex-trafficking case that ultimately led to the July 2019 indictment.
2. The Fraud-to-Trafficking Pivot
The shift from §§ 1341/1343 (fraud) to §§ 1591/371 (trafficking/conspiracy) between 2017 and 2018 suggests the investigation's focus evolved. Bloomberg reported in October 2025 that the original 2007 Florida investigation had a money-laundering probe examining "every financial transaction conducted by Epstein and his six businesses" dating to 2003. The 2017 fraud statutes are consistent with a financial investigation that predated the trafficking focus.
3. helpfulexperts.com Was Communication Infrastructure
The domain's technical profile — Google Workspace email, Google Hosted Services web presence, 19 years of registration with maximum protection flags — indicates it was purpose-built communication infrastructure. The subpoena's focus on email accounts, subscriber information, and payment records confirms prosecutors were interested in who was communicating through this domain and how it was funded.
4. Total Compartmentalization
Despite triggering the first subpoena in the investigation, "helpfulexperts" never appears in any of the 2.73M pages of seized communications, financial records, or investigative materials. Whatever role this domain played, it was compartmentalized from Epstein's other documented activities. No email from @helpfulexperts.com appears in any seized device, email account, or financial record in the production.
Document Summary
| EFTA | Dataset | Pages | Type | Description |
| ------ | --------- | ------- | ------ | ------------- |
| EFTA00153743 | 9 | 9 | Subpoena | July 2017 Google subpoena — helpfulexperts.com (Case 2017R00550) |
| EFTA00082565 | 9 | 9 | Subpoena | Oct 2019 Google subpoena — Maxwell (Case 2018R01618) |
| EFTA00091937 | 9 | 9 | Subpoena | Oct 2019 Google subpoena — Maxwell duplicate |
| EFTA00029774 | 8 | 1 | Email | Feb 2020 AUSA email — NDO expired for email subpoenas |
| EFTA00170256 | 9 | 3 | Return | Jan 2019 Google return — Epstein email accounts |
| EFTA00082559 | 9 | 4 | Return | Dec 2019 Google return — Maxwell accounts |
| EFTA00019636 | 8 | 4 | Return | Sep 2020 Google return — partial objections |
| EFTA01660712 | 10 | 3 | Email | Aug 2019 FBI subpoena tracking — Amazon non-responsive |
| EFTA00074886 | 9 | 4 | Email | Aug 2020 discovery review — Google responses |
| EFTA00037896 | 8 | 1 | Email | Dec 2018 preservation request to Oath Holdings |
Methodological Notes
Corpus search: FTS5 and LIKE searches for "helpfulexperts" (one word), "helpful experts" (two words), and "@helpfulexperts" across all 2,770,154 pages of full_text_corpus.db. Only one page (EFTA00153743, page 5) contains any match.
PQG cross-reference: The Prosecutorial Query Graph database (257 subpoenas, 2,018 demand clauses) identifies EFTA00153743 as Subpoena 214 with 15 rider clauses, and flags the subsequent 524-day gap as Gap ID 750 (CRITICAL severity).
External research: Wayback Machine (web.archive.org), live DNS lookups, WHOIS queries, Google searches for "helpfulexperts.com," "helpfulexperts," and "helpful experts" + Epstein all returned zero substantive results. The domain has no internet footprint beyond its DNS/WHOIS records.
Dataset verification: All cited EFTAs verified against documents table in full_text_corpus.db. None appear on the DOJ confirmed-removal list (doj_audit/CONFIRMED_REMOVED.csv).
Media coverage: Zero results as of February 24, 2026. No journalist, researcher, or commentator has ever publicly written about helpfulexperts.com, the July 2017 subpoena, USAO reference 2017R00550, or the pre-December 2018 phase of the SDNY investigation.
Analytical neutrality: The report presents what the documents show. The 524-day gap may reflect sealed proceedings, a dormant investigation, or records filed under a separate case number. The absence of a Google return may reflect sealed filings or negative results. We state what can be verified and identify what remains unknown.
External Sources
All external claims in this report are independently verifiable:
| Miami Herald "Perversion of Justice" series (Nov 2018) | Miami Herald |
| Preet Bharara fired March 11, 2017 | NPR |