The 2026 Midterm Domain Threat Surface, Four Weeks Out

ZeroFox Signals Research began scoping the 2026 federal election domain threat surface in June and has observed it continuously since early July. For three months we have been observing it, enriching it, and following how election-adjacent domain infrastructure is being registered, held, and in a few cases reconfigured in ways that warrant watching ahead of Election Day. None of the domains we tracked has served malicious content yet. What we found is a small inventory of brand-string registrations that an operator could turn into a donation or voter-information phish in minutes, buried in a much larger pile of noise that defenders have to clear first. With Election Day now four weeks out, this piece shares what the quarter of observation taught us about the shape of the threat, why donors and voters should take it seriously, and what campaigns, committees, donation platforms, and civic infrastructure teams still have time to do about it.

1. Scope of the research

The universe of possible strings that a threat actor could weaponize as an election-adjacent domain name is enormous. During the scoping phase in June we assembled a catalog of several hundred candidate strings covering federal election authorities, donation platforms, party committees, PACs, individual battleground candidates on both sides of the aisle, voter-facing mechanics like registration and absentee ballots, and the TLDs that exist specifically for political use (.vote, .democrat, .republican, and .gop), which are candidate spaces for impersonation on their own because the suffix itself carries political authority. The catalog is so large that attempting a single piece against all of it would produce a full-blown survey rather than an actionable one, so we focused on three brands that concentrate the highest-impact harm at the federal level, and we picked them symmetrically to stay politically neutral and focused strictly on the threat landscape.

We also deliberately scoped the research to federal-election domain threats. State-level and local-election impersonation is a real and separate landscape with its own state authorities, its own candidate rosters, and its own scale, and it is not covered here. Anyone building a comprehensive election-threat monitoring program will need to layer state and local coverage on top of what follows.

2. The three brands

The three seed brands we tracked for the full quarter are:

• ActBlue, the small-dollar donation platform that carries the Democratic side of federal political fundraising, where impersonation converts to stolen payment credentials and donor identity leakage.
• WinRed, the mirror donation platform on the Republican side, with an identical threat model and identical severity.
• vote.gov, the official federal voting information site, managed by GSA’s Technology Transformation Services in partnership with the EAC and CISA, which sends voters to their state registration sites. Impersonating it enables PII harvesting, voter suppression through false date and location information, and fake registration flows that never reach a state election office.

Each of these three anchors a distinct high-severity harm category, and together they share an observation window that lets us see what threat actors are doing across the federal electoral surface at the same moment in time.

3. What adversary positioning looks like

Registrations that could be used against these three brands show up in three recurring shapes, and all three were present from the beginning of the research window.

Fresh lookalike registrations. These are brand-string second level domains registered inside the current election cycle, on heavily abused top-level domains, through frequently abused registrars, and hiding behind Cloudflare or free hosting. Some of them resolve today, while others are likely being held for activation closer to Election Day.

Cluster registrations. These are multiple sibling domains carrying the same naming pattern, registered across different registrars over a period of weeks or months but pointed at the same nameserver and hosting profile,which can indicate an operator building capacity across the cycle, although at least one cluster we examined closely this quarter proved to be an unrelated betting brand.

Subdomain impersonation. Here the target brand appears as the leading labels of a hostname under an attacker-controlled or attacker-adjacent second level domain, so the impersonation lives entirely inside the subdomain namespace of a third-party domain and requires no new registration, which means it bypasses any monitoring program that only watches newly registered domains.

Across the three brands we identified roughly 700 second-level lookalike candidates in early July and 160 vote.gov subdomain-impersonation candidates, with around 175 of the second level domains resolving at that point in time. The rest of this piece covers what three months of continuous observation showed us about how that population moved.

4. The three-month view at a glance

Between early July and the first week of October 2026, the three brands continued to generate measurable adversary activity. The numbers below walk from the raw universe of observations down to the subset that actually warrants a defender’s attention.

Most of the raw universe is noise, made up of substring collisions in unrelated English words (impactblue, contactblue, abstractblue, contractblue, winreducer, winreddit, and the winreddy family of personal names), subdomains inside multi-tenant hosting platforms where the brand string lands in the wildcard portion of someone else’s hostname, and ambient DNS backscatter. Removing those categories leaves 101 plausible brand-related second level domains against ActBlue in the quarter, 111 against WinRed, and no confirmed vote.gov lookalikes once the kinetiq cluster is set aside (see 6.2). That is the volume of new entries a defender had to triage against these three targets during the quarter.

The set for the window includes both freshly registered second level domains and previously dormant ones that generated new DNS activity during the quarter, and that reactivation is itself a signal worth tracking separately. Because these numbers count new entries in one quarter, the cumulative queue going into October is larger, numbering in the hundreds for each of ActBlue and WinRed.

5. Three months later, still registered and resolving

Every second level domain in the table below that we flagged in early July is still registered and resolving three months later, but not all of them are pre-positioned infrastructure. Several sit on registrar parking pages, actblues[.]com is a Microsoft sinkhole registered in 2016, actblue[.]ai redirects to a Senate press release about ActBlue, and the 77winred and 789winred entries belong to Vietnamese online betting brands (see 6.1). What remains is a smaller set of brand-string registrations from the current cycle that stay on our watch list.

The three 77winred domains we flagged in July as a possible operator footprint against WinRed are still live, but further enrichment showed they are not aimed at WinRed at all, as described in the next section.

6. What appeared during the window

6.1. The 77winred cluster belongs to a Vietnamese betting brand, not WinRed

What looked in July like three related domains is now a footprint of eleven second level domains carrying the same token across ten TLDs, all of them behind Cloudflare’s nameservers. The token is not WinRed. 77Win is a Vietnamese online betting operator that promotes itself under tags including 77winred, and the live pages confirm it: 77winred[.]bet and 77winred[.]xyz serve Vietnamese sports betting sites branded “77Win Red”, and 77winred[.]com serves a Portuguese-language slots page. 789winred[.]com from the table in section 5 redirects to 789win7[.]me, another Vietnamese betting brand.

Two nameserver pairs recur across the cluster, with cheryl + glen on both .pro and .win and amy + nolan on both .bet and .ws, which fits a single gambling operator spreading mirror domains across TLDs. These domains are serving gambling content today rather than being held for activation, so we have removed them from the WinRed queue. They are a good example of the substring collisions described in section 4. A token that matches WinRed exactly can still belong to an unrelated business, and only content and context separate the two.

6.2. The kinetiq cluster targets a crypto protocol, not vote.gov

Ten second level domains were registered on .xyz through NICENIC INTERNATIONAL GROUP CO., LIMITED, a Hong Kong registrar with a well-documented abuse history, over a two-day window at the end of September 2026. All ten follow the same naming pattern, combining the token kinetiq with variants of govern, govt, and governance, and all of them were set up to carry vote as the leading subdomain label. We first read these as vote.gov lookalikes. They are more likely aimed at Kinetiq, a liquid staking protocol on Hyperliquid whose KNTQ token holders vote on protocol governance and whose legitimate domain, kinetiq[.]xyz, sits on the same TLD. A fake governance-voting page is a common lure for wallet-draining phishing, and nothing in these names points to a US election. Their delegations appeared at the .xyz parent zone within the hour after registration.

Seven of the ten carry both serverHold and clientHold in their EPP status. clientHold is set by the registrar, NICENIC in this case, while serverHold is set by the .xyz registry, and both have the same practical effect of removing the domain from the TLD zone file so that it no longer resolves. Having both statuses on the same seven second level domains means that both parties in the registration chain independently acted to take them out of the zone, and the delegation activity on those seven stopped on October 1 or 2, which is consistent with the holds being applied around then. The result is that seven members of a coordinated cluster were removed from the DNS, and we did not observe any of them serving content before the holds.

The remaining three, kinetiq-govern[.]xyz, kinetiqgoverns[.]xyz, and kinetiq-govt[.]xyz, carry no hold status and remain delegated to Cloudflare. Each now has a vote subdomain that resolves through Cloudflare and returns HTTP 404, so none is serving content yet. The cluster should be read as seven on hold and three still open, and the open three belong in a crypto-phishing queue for Kinetiq rather than in an election-threat queue.

6.3. A WinRed-named Cloudflare Worker, not yet serving phishing content

The free-hosting lane, which we identified early in our monitoring as a serious gap in most defenders’ coverage, has one WinRed-named instance on Cloudflare Workers:

• solitary-breeze-0ccasecurewinredcom[.]jungcheoljo089[.]workers[.]dev

The hostname embeds “securewinredcom” after the worker name, on a free Cloudflare Workers subdomain that required no registration, comes with HTTPS provided by Cloudflare, and has no registrar-level enforcement path. The page has returned HTTP 200 across repeated observations through early October 2026, but what it serves is “Hello World!”, the default Cloudflare Workers template. Nothing on it impersonates WinRed today. The name is the signal, because the owner can replace the default page with a phishing kit at any time without changing the hostname.

6.4. winredirect[.]com moved off Cloudflare’s proxy onto dedicated hosting

In July, winredirect[.]com was six days old, sitting behind Cloudflare, with a name that was semantically loaded for a donation platform. By October its A record pointed directly at 38[.]11[.]91[.]144, a dedicated IP announced by PEG TECH INC (AS54600) from Cogent-allocated address space, with ports 80, 443, 18111, and 887 open, a combination that points to an active service rather than a parked page or a static landing site. The domain still uses Cloudflare’s nameservers, so only the proxy has been switched off.

The change was almost certainly a deliberate configuration choice, but it is not by itself evidence of malicious intent. “winredirect” may also be an unrelated “win redirect” name, and as of this writing we have not observed content that impersonates WinRed. We are keeping  it on the watch list because this kind of hosting change can precede activation, and we would escalate on any observed WinRed-themed content.

6.5. Fresh election-cycle registrations landing in September

Two second level domains stamped for the November 2026 cycle were registered in September 2026 and currently resolve:

• vote-for-gov[.]com, registered through GoDaddy on September 5, 2026, resolving to GoDaddy’s hosting front end on Amazon Global Accelerator
• vote-4-segovia-nov-2026[.]site, registered through Name.com on September 12, 2026, resolving to Vercel on 216[.]150[.]16[.]129 and 216[.]150[.]1[.]193

Both are late-cycle registrations with explicit date and candidate framing in the name. We observed no content on either. The names are consistent with legitimate campaign or advocacy use as well as impersonation, so we treat them as watch items. 

7. What we had to update in our view

Beyond the reassessments in sections 6.1 through 6.3, two more patterns that looked suspicious in our first weeks of observation did not hold up over the longer window.

7.1. Candidate-site winred subdomains appear to be legitimate donation redirects

While monitoring the broader winred namespace we observed several hostnames in the shape winred[.][.]com:

• winred[.]jimjordanforcongress[.]com
• winred[.]joelombardofornv[.]com
• winred[.]mattjacobsforcongress[.]com
• winred[.]votelujan[.]com

At first glance these look like the subdomain impersonation pattern described earlier, but on enrichment all of them are CNAMEs to secure[.]winred[.]com, which points in turn to WinRed’s platform at secure-winred-com[.]revv[.]co on 104[.]19[.]211[.]89 and 104[.]19[.]212[.]89. The most likely explanation is that these are legitimate campaign sites pointing a winred subdomain at WinRed’s platform infrastructure for donation processing. That reading is not certain, however. Resolving to WinRed’s infrastructure today says nothing about who controls the DNS for these hostnames, and whoever does control it can change the A record, remove the CNAME, or point the subdomain elsewhere at any moment, so these hostnames stay on our watch list rather than being cleared outright. The pattern is also useful context for defenders because it shows what the legitimate winred redirect footprint looks like when triaging future impersonation attempts in the same shape.

7.2. actblue-support[.]fm and claim-actblue[.]fm were never activated

Both of these showed up in our July observations with naming patterns that fit phishing geometry, and three months later neither name exists in DNS, so whoever held them let them go without ever serving content on them. Cases like these are the reason the triage queue has to be re-evaluated continuously, since a candidate that looks live one week may be gone the next and a candidate that looks dormant may surface months later with content, and only continuous monitoring rather than point-in-time scans protects a brand or a civic infrastructure target through a full election cycle.

8. A brief note on registry-level DNS wildcards

Researchers hunting for election-related domains on the Philippine ccTLD will likely come across a large number of [.]ph names built on the ActBlue brand and similar strings, all resolving to 45[.]79[.]222[.]138 an Akamai (Linode) address that issues a TLS certificate on demand for whatever name is requested. These names are not registered, and the resolution is neither new behavior nor a threat actor operation. The dotPH registry has a longstanding practice of wildcarding every string its authoritative nameservers receive queries for and returning the same IP address, and the practice has been raised with them repeatedly without change, so these [.]ph results reflect that wildcard rather than active phishing infrastructure.

9. What this means for the final 30 days

Three patterns are worth watching between now and Election Day.

Activation of pre-positioned registrations. The brand-string registrations from the spring and summer that are not parked, sinkholed, or owned by unrelated businesses make up the inventory we  will watch most closely through November 3. None of them has served malicious content yet, and thethe first appearance of HTTP content or a new TLS certificate on any of these second level domains should be treated as a leading indicator and acted on within the hour.

Content moving off CDNs onto dedicated hosting. The move of winredirect[.]com from Cloudflare’s proxy to a PEG TECH IP with unusual high ports open is the kind of hosting change that can precede activation of something more than a static page, though benign explanations are common. 

Free hosting as the phishing destination. Serverless edge platforms, free static site hosts, application deployment platforms, and free TLDs remain the easiest way to serve election-themed phishing without a registration footprint, and the WinRed-named Worker described above shows how little it takes, since its hostname already exists and swapping the default page for a phishing kit would take minutes. Monitoring programs that only watch newly registered domains will not see this layer at all.

10. How ZeroFox has been covering this surface, and how we can help

The picture above comes from three months of continuous monitoring on these three brands, and that monitoring is what ZeroFox runs against the public attack surface every day for the organizations that need it, including donation platforms, political committees, civic technology providers, government agencies, and enterprises whose employees are targeted by election-themed phishing in the final weeks of any cycle.

Across the capabilities that ZeroFox brings to this problem:

• Discovery. Continuous, broad-spectrum observation of the public attack surface tuned to the brands, candidates, and civic infrastructure that matter to each customer, with coverage that reaches the registration layer, the hosting layer, the content layer, and the social and messaging layer in parallel.
• Validation. The triage work that separates real impersonation from defensive registrations, political speech, unrelated brand collisions, and personal names, so that the queue a customer acts on is the one that matters.
• Disruption. ZeroFox pursues takedowns of what we validate through the registries, registrars, hosting providers, CDN abuse teams, and social platforms that control the enforcement path, and we watch for rebounds so that threats stay down after the first takedown. In parallel, validated threats flow into the ZeroFox Global Disruption Network, a network of more than 80 partners spanning ISPs, registrars, social platforms, and browsers, so that the same infrastructure gets blocked across the Internet while a takedown is still in progress.
• Awareness and reporting. Longitudinal visibility like the three-month view in this piece, delivered to customers so that platform operators, campaigns, committees, and civic infrastructure teams can see what is coming at them and plan accordingly.

If your organization has exposure to the 2026 election cycle, whether as a campaign, a committee, a donation platform, a civic technology provider, a state election authority, or an enterprise whose employees will be targeted by election-themed phishing in the final weeks, reach out through [email protected]. We are already watching this surface, and we can watch yours too.

The final weeks of a cycle are when any pre-positioned infrastructure is most likely to be put to use. The queue we are tracking today is larger than it was in July, and is likely to keep growing between now and November 3.