WhoisXML API
DOMAIN THREAT REPORT
13 JUL 2026
Domain intelligence · July 2026

Over 62,000 domains reference the 2026 U.S. midterm elections

62,081 distinct domains registered during the September 2025 – July 2026 period reference the 2026 U.S. midterm elections, spanning both generic election language and names that point at specific candidates and races. This report profiles the 13,645 candidate-specific names — those naming a specific candidate, office, state or donation channel — across creation dates, registrars, registrant emails, name servers and naming intent, up from 13,321 in the 29 June baseline after a further 324 were registered between 30 June and 12 July. Full data access is available to verified organizations through our research and media collaborations program.

Curated domains
13,645
candidate-specific subset
New since baseline
324
registered 30 Jun–12 Jul
[name]for[office]
46%
6,229 domains
No mailbox
90%
12,347 domains
Built to expire
88%
single-year registration

The scale of election-related registrations

election-related · Sep 2025 – Jul 2026

Domains that reference the 2026 U.S. midterm elections — both generic terms like vote, election and congress and names that point at specific candidates and races — have been registered at a rising pace since the start of the September 2025 – July 2026 period, reaching 62,081 distinct domains by 12 July 2026.

vote
33,157
domains
election
10,740
domains
congress
7,420
domains
senate
2,156
domains
midterm
250
domains
Distinct domains by creation month; Jul is partial (to the 12th). These figures indicate overall volume only.

Some names warrant a closer look

narrowing the field

The figure above counts every election-related domain. This report focuses on the 13,645 of them whose names point at a specific candidate, office, state or donation channel.

Names this specific serve very different ends. Some are likely legitimate — campaign, advocacy, supporter, media, journalism, research or commentary sites. Others match patterns used in past cycles to mimic a candidate or campaign, or to set up donation pages that misdirect contributions.

A domain's name rarely shows on its own whether it belongs to a real campaign or a deceptive one. The registration record behind it offers useful signals — when the domain was created, which registrars and name servers it shares with other domains, and whether the registrant's identity is published or hidden. The sections that follow profile these so investigators can decide which names to examine first.

The names studied

scope of this report

The dataset is the set of current domain registrations whose names combine a person or place with an office or candidacy cue — constructions such as [name]for[office] and [name]4[office]. That core campaign pattern accounts for 6,229 of the 13,645 domains (45.7%). The breakdown below groups names by the office they reference; categories overlap, since a single name can cite more than one.

congress
3,702
domains · e.g. nagyforcongress.org
senate
1,267
domains · e.g. karrforsenate.com
governor
845
domains · e.g. burkettforgovernor.ai
state & local office
1,010
domains · e.g. murphyfordelegate42a.net
general election terms
551
domains · e.g. voteharris4district1.org

Names also encode geography. About 4,716 of the 13,645, roughly a third, carry the name of a U.S. state, a cut that overlaps the office groupings above since a name can cite both an office and a place. The twenty states appearing most often are below.

texas
537
domains · e.g. angiefortexas.com
florida
273
domains · e.g. berryforflorida.com
georgia
270
domains · e.g. brianforgeorgia.com
ohio
225
domains · e.g. blakeforohio.com
colorado
208
domains · e.g. curryforcolorado.com
kansas
185
domains · e.g. bakerforkansas.com
maine
170
domains · e.g. careyformaine.com
iowa
162
domains · e.g. brianforiowa.com
oregon
159
domains · e.g. chasefororegon.com
idaho
157
domains · e.g. caseyforidaho.com
arizona
140
domains · e.g. blairforarizona.com
california
139
domains · e.g. colinforcalifornia.com
montana
129
domains · e.g. aaronformontana.com
utah
119
domains · e.g. adamsforutah.com
indiana
116
domains · e.g. bairdforindiana.com
michigan
115
domains · e.g. aprilformichigan.com
nevada
113
domains · e.g. chrisfornevada.com
illinois
107
domains · e.g. craigforillinois.com
virginia
105
domains · e.g. bryceforvirginia.com
new york
98
domains · e.g. brucefornewyork.com
These figures should be read as a conservative floor. Broadening the term set (nicknames, ballot-measure and committee language, additional office titles), adding fuzzy and typo variants, and applying a historical WHOIS perspective that captures names registered and dropped over time would all expand the count beyond the 13,645 reported here.

The registrant landscape

registrant email pivots

Most of the dataset carries no individual registrant mailbox: 12,347 domains (90.5%) use privacy/proxy services, redaction, or list no registrant email at all. Only 1,298 (9.5%) expose a direct address, and these resolve to roughly 833 distinct senders — overwhelmingly small, single-campaign holdings rather than one dominant operator. Registrant emails are partially masked. A few representative portfolios:

28 domains
Registrar
Network Solutions
NS
bluehost.com
hughesforalaska.com
hughesforalaska.org
hughesforgovernor.com
+ 25 others
10 domains
Registrar
Network Solutions
NS
Network Solutions
perry4governor.com
perryforgovernor.net
perryforgovernor.org
+ 7 others
9 domains
Registrar
PDR Ltd. d/b/a PublicDomainRegistry.com
NS
whois.com
mahanforcongress.com
mahanforcongress.org
mahanforgovernor.org
+ 6 others
7 domains
Registrar
GoDaddy
NS
wordpress.com
danielsforcongress.com
gonzalesforsenate.com
gonzalezforsenate.com
+ 4 others
13,645
domains in scope
→
1,298
with a direct mailbox (9.5%)
→
~833
distinct senders
This dataset shows no single operator dominating. Registrant activity is widely distributed across many small holders — a pattern consistent with independent campaign, supporter and vendor registrations. For monitoring teams, the recurring small portfolios and shared service addresses remain useful pivot points. Click any email in the explorer below to isolate its sampled holdings.

Names that track the biggest campaigns

top-50 senate + house candidates

Across the whole set, the [name]for[office] naming pattern spans 6,229 domains, names built for candidates of every profile. Narrowing to the 50 best-funded Senate and 50 best-funded House campaigns of 2026, by receipts reported to the Federal Election Commission (FEC), 493 domains reference 75 of them. Those drawing the most are ranked here by the number of domains referencing each.

Candidate
Domains
Examples in the set
James TalaricoSenate · #2 by receipts
77
asiansfortalarico.com · asiansfortalarico.net · asiansfortalarico.org · electjamestalarico.com + 73 others
Graham PlatnerSenate · #7 by receipts
33
grahamformaine.co · grahamformaine.info · grahamformaine.net · grahamformaine.org + 29 others
Thomas MassieHouse · #33 by receipts
25
draftthomasmassie.com · officialthomasmassie.com · repthomasmassie.com · thomasmassie.ca + 21 others
Jasmine CrockettSenate · #12 by receipts
23
crockett2026.org · crockett2032.com · crockett2036.com · crockett4senate.com + 19 others
Julia LetlowSenate · #44 by receipts
20
julia-letlow-2026.com · julia-letlow-2026.info · julia-letlow-2026.live · julia-letlow-2026.org + 16 others
Nate MorrisSenate · #20 by receipts
19
natemorris.agency · natemorris.bet · natemorris.capital · natemorris.care + 15 others
David TroneHouse · #2 by receipts
17
davidtrone.info · davidtrone.net · davidtrone.org · davidtrone4congress.com + 13 others
Michael WhatleySenate · #21 by receipts
15
aboutmichaelwhatley.com · michaelwhatley.store · michaelwhatley2026.com · michaelwhatley4senate.com + 11 others
Jon OssoffSenate · #1 by receipts
13
jonossoff.store · jonossoff4president.com · jonossoff4senate.com · jonossoffforpresident.com + 9 others
Mallory McMorrowSenate · #19 by receipts
13
mallorymcmorrow.org · mallorymcmorrow.store · mallorymcmorrowforpresident.com · mcmorrow.online + 9 others
Ken PaxtonSenate · #32 by receipts
12
kenpaxton.store · kenpaxton.us · kenpaxtonfiles.com · kenpaxtonforsenate.com + 8 others
Roy CooperSenate · #4 by receipts
11
meetroycooper.com · officialroycooper.com · roycooper.store · roycooper.uk + 7 others
Ro KhannaHouse · #5 by receipts
10
congressmanrokhanna.com · forusrokhanna.com · meetrokhanna.com · myrokhanna.com + 6 others
Eric JonesHouse · #14 by receipts
10
ericjones.art · ericjones.co · ericjones.email · ericjones.net + 6 others
Alex VindmanSenate · #24 by receipts
9
alexvindman.ai · alexvindman.info · alexvindman.net · alexvindman.org + 5 others
Mike JohnsonHouse · #3 by receipts
8
mikejohnson.ai · mikejohnson.co · mikejohnson.life · mikejohnson.pro + 4 others
Kevin HernSenate · #15 by receipts
8
kevinhern4senate.com · kevinhernforoklahoma.com · kevinhernforsenate.co · kevinhernforsenate.com + 4 others
Mike CollinsSenate · #42 by receipts
8
meetmikecollins.com · mikecollins.dev · mikecollins.gop · mikecollins.org + 4 others
Dan GoldmanHouse · #16 by receipts
7
dangoldman.ca · dangoldmanforcongress.com · dangoldmanforcongress.net · dangoldmanforcongress.online + 3 others
John CornynSenate · #27 by receipts
7
firejohncornyn.com · johncornyn.store · senatorjohncornyn.com · stopjohncornyn.com + 3 others
Candidates are the 50 top-funded 2026 Senate and 50 top-funded House campaigns by total receipts reported to the FEC (Senate, House).

Merchandise and donation storefronts

Two registrant clusters

Two email addresses in the registration records each tie a cluster of sites together, 36 in one group and 42 in the other. Many are working shops selling campaign-style merchandise under a specific 2026 candidate’s name, with candidates from both major parties. The three live storefronts profiled below all belong to the first group.

36 domains
kenpaxton.us
grahamformaine.us
stevehiltonmerch.us
massiemoneybomb.us
+ 32 others
42 domains
karenbassformayor.us
badbunnybenito.us
lifeofashowgirl.us
officialgavinnewsom.us
+ 38 others
kenpaxton.usProfile 01
kenpaxton.us storefront
Created16 May 2026
Expires16 May 2027
Domain age58 days as of 13 Jul 2026
RegistrarNameCheap, Inc.
WHOIS serverwhois.nic.us
Name serverssean.ns.cloudflare.com
cruz.ns.cloudflare.com
RegistrantTrai Pham
StreetViet Nam
City / StateHCM / Viet Nam
Postal / Country70000 / VIETNAM
Emailwin•••[email protected]
Phone84934•••714
Compared with the candidate’s established domain
Established domainkenpaxton.com
First registered17 Mar 2008 · ~18 yrs
Registrar · NSGoDaddy · elma/gabe.ns.cloudflare.com
RegistrantHistoric “Paxton campaign” linkage (last known 2012–2022); now privacy-shielded
grahamformaine.usProfile 02
grahamformaine.us storefront
Created23 Jun 2026
Expires23 Jun 2027
Domain age20 days as of 13 Jul 2026
Matches Profile 01same registrant, email, name servers and registrar
RegistrarNameCheap, Inc.
WHOIS serverwhois.nic.us
Name serverssean.ns.cloudflare.com
cruz.ns.cloudflare.com
RegistrantTrai Pham
StreetViet Nam
City / StateHCM / Viet Nam
Postal / Country70000 / VIETNAM
Emailwin•••[email protected]
Phone84934•••714
Compared with the candidate’s established domain
Established domaingrahamforsenate.com
First registered10 Apr 2023 · ~3 yrs
Registrar · NSGoDaddy · alina/doug.ns.cloudflare.com
RegistrantPrivacy-shielded (Domains By Proxy)
massiemoneybomb.usProfile 03
massiemoneybomb.us storefront
Created5 May 2026
Expires5 May 2027
Domain age69 days as of 13 Jul 2026
Matches Profile 01same registrant, email, name servers and registrar
RegistrarNameCheap, Inc.
WHOIS serverwhois.nic.us
Name serverssean.ns.cloudflare.com
cruz.ns.cloudflare.com
RegistrantTrai Pham
StreetViet Nam
City / StateHCM / Viet Nam
Postal / Country70000 / VIETNAM
Emailwin•••[email protected]
Phone84934•••714
Compared with the candidate’s established domain
Established domainthomasmassie.com
First registered5 Dec 2008 · ~17 yrs
Registrar · NSNamecheap · candy/kyle.ns.cloudflare.com
RegistrantHistoric “Thomas Massie / self” (last known 2018); now privacy-shielded

Candidate-linked fields are historical “last known” snapshots, and all three established domains are now privacy-shielded — both routine, and neither a signal in itself. Mainstream registrars and Cloudflare name servers are common to look-alike and established domains alike, so the useful contrasts here are the registration age and the storefronts’ own openly published registrant details. WHOIS does not establish who operates a site or where any funds go.

The donation checkout, side by side

the storefronts above vs the official flow

The three look-alike storefronts profiled above each run their own donation checkout, shown here beside the candidate’s official contribution flow. Real campaign donations usually run on a dedicated fundraising domain rather than the candidate’s main site — WinRed and ActBlue for the two parties, and platforms like Anedot. A separate donation domain is therefore normal. The storefronts carry the candidate’s imagery and a donate button without those markers. A supporter’s safest move is to give through the link the campaign publishes on its own verified channels.

Ken PaxtonDonation checkout · side by side
Look-alike storefront · kenpaxton.us
kenpaxton.us donation checkout

General store checkout (Stripe merchant); a $5–$1,000 donation can be added to the cart

Official contribution flow · secure.winred.com
Ken Paxton official contribution page

WinRed, the Republican small-dollar conduit; benefits ‘Ken Paxton for Senate’

Graham PlatnerDonation checkout · side by side
Look-alike storefront · grahamformaine.us
grahamformaine.us donation checkout

General store checkout (Stripe merchant); a $5–$1,000 donation can be added to the cart

Official contribution flow · secure.actblue.com
Graham Platner official contribution page

ActBlue — benefits ‘Graham Platner, ME-Sen’; not accepting donations (Platner has exited the race)

Thomas MassieDonation checkout · side by side
Look-alike storefront · massiemoneybomb.us
massiemoneybomb.us donation checkout

General store checkout (Stripe merchant) with a live donation-messages feed

Official contribution flow · massiemoneybomb.com
Thomas Massie official contribution page

Anedot — benefits ‘Thomas Massie for Congress’, with FEC contribution-limit labels ($3,500 primary max)

Screenshots captured 13 July 2026; the official contribution pages are third-party platform pages (WinRed, Anedot, ActBlue) shown for comparison. Figures and claims on any of these pages are the sites’ own and are not verified here, and nothing shown establishes who operates a site or where any funds go.

Infrastructure breakdown

registrars · name servers · TLDs

How the registrations distribute across the supporting infrastructure. Counts reflect the full deduplicated dataset. Concentration is moderate: the top three registrars account for 64.6% of all domains, led by GoDaddy at 40.1%, and GoDaddy's name-server service carries 34.7% of the set.

Registrars

GoDaddy5,343
Squarespace1,734
Namecheap1,534
Wix602
Cloudflare470
Tucows422
Network Solutions375
Porkbun277

Name-server providers

domaincontrol.comGoDaddy4,619
cloudflare.comCloudflare1,594
googledomains.comGoogle1,487
registrar-servers.comNamecheap1,008
wixdns.netWix755
afternic.comGoDaddy / Afternic335
squarespacedns.comSquarespace257
dns-parking.comHostinger227

TLDs

.com9,380
.org1,593
.net636
.info241
.store211
.co161
.online149
.us136

Other naming intent

secondary keyword signals

Most names in the set stop at the office they cite. Only a minority add a secondary keyword that hints at what the site is for, so the themes below are best read as a supplementary signal. District and local-race language leads, ahead of explicit election-year tags. Fundraising, merchandise and opposition cues appear in smaller numbers. Themes overlap and describe apparent intent from the name only.

Districts & local races895tamerastrong4district2.com · davis4district4.com · jaredfordistrict1.com
Election-cycle terms656jkirkforcongress2026.com · edfitzgeraldforcongress2026.com · cameronchickforsenate2026.com
Merch & store23teamshopbooker.com · crockettandjonesstore.shop · talaricotexasstore.com
Fundraising & committees84donate2shields4governor.com · donatenowtomvoforcongress.com · donatetovicforsenate.com
Opposition & commentary21larisa4congress.exposed · svechin4congress.exposed · svechinforcongress.exposed

Analyst note

Commentary
Alexandre François

“ More than 62,000 election-related domains show how crowded the online election space has become. Campaign-style names, donation cues, and familiar candidate references can create trust very quickly, especially when legitimacy is hard to establish from the page alone. Within that volume, we also found clusters of sites with campaign-style shops, unofficial donation-style checkout flows, and registrant-country information pointing outside the U.S., details a voter would not see without investigating the underlying domain registration records. ”

Alexandre François
Domain Scams Researcher at WhoisXML API

Domain explorer

curated sample · 1,000 of 13,645 records
This explorer carries a curated 1,000-domain sample.

The complete dataset of 13,645 records — with full WHOIS detail, historical records, and ongoing monitoring of this and related naming patterns — is available to verified organizations through our collaboration program.

Request full access
DomainCreatedRegistrarRegistrant emailNS providerCountryThemes

About this report

methodology & notes

This report draws on WhoisXML API’s domain and DNS intelligence, covering current domain registrations whose names reference the 2026 United States midterm elections. It combines a 29 June 2026 baseline capture with a 13 July 2026 capture, unioned and deduplicated by domain name so each domain appears once. The candidate-specific figures reflect the complete 13,645-record set, of which 324 were registered between 30 June and 12 July 2026. The 62,081 scale figure covers the September 2025 – 12 July 2026 period; it combines these candidate-specific names with a broader pool of domains containing a generic election term (vote, election, congress, senate, midterm), counts each overlapping domain once, and indicates registration volume only. The candidate cross-reference matches names against the 50 best-funded 2026 Senate and 50 best-funded House campaigns (by total receipts reported to the Federal Election Commission), attributing a domain to a candidate only where the name appears in a clear campaign construction, so the counts are a conservative floor. The explorer presents a representative 1,000-record sample; registrant emails and phone numbers are partially masked, and the storefront clusters group domains by shared registrant email. Registrant details are self-declared in WHOIS and not independently verified, and privacy-proxied records reflect the proxy service’s address. Screenshots in the storefront section are live third-party pages shown for illustration; figures on them are those pages’ own, not verified here, and their inclusion is not a determination about any site or the destination of any funds. Naming themes and office categories describe apparent intent from keywords only. The 2026 midterm elections serve solely as a neutral registration-timing anchor: this report makes no claim about any party, candidate, campaign or outcome, and inclusion of a domain does not imply affiliation — many may be legitimate campaign, supporter, media or advocacy projects. All figures should be read as a conservative floor, current to 12 July 2026; the storefront screenshots were captured 13 July 2026.