Identifying election domain threats before they become attacks

COMMENTARY: As the 2026 midterm elections approach, there's one challenge that will extend well beyond November. Malicious actors could impersonate trusted election platforms to collect personal information, steal political donations or mislead voters. Distinguishing those potential threats from legitimate websites is becoming an important part of election security.

Election cycles create opportunities for cybercriminals and other malicious actors to use deceptive domains to disrupt campaigns, misdirect voters or steal funds. Impersonating platforms associated with political parties or election oversight is one-way attackers can exploit election activity, often in conjunction with DNS spoofing and other tactics such as phishing and smishing.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

The goals of these attacks often overlap, frequently focusing on exploits ranging from credential theft and financial scams to redirecting DNS traffic. The potential for malicious domain impersonation is a recurring concern that election security teams will need to address beyond the current cycle.

During three months of research leading up to the 2026 midterms, ZeroFox monitored more than 30,000 hostnames containing references to three prominent election platforms: ActBlue, WinRed and vote.gov. After filtering out unrelated domains and other false positives, our researchers identified just 78 high-confidence lookalikes. None of the tracked domains had served confirmed malicious content during the observation period, although some remained registered and could potentially be activated later.

Our research was timed to cover the lead-up to this year’s midterms, but it also holds lessons that can be applied to future elections, including the 2028 vote for president.

Separating potential threats from false alarms

Some suspicious domains can remain registered and dormant for months. They could be activated for a current election cycle or reused in future elections.

Related reading:

The potential combinations of election-related domain names are enormous, spanning government agencies, political parties, candidates, fundraising platforms and specialized top-level domains such as .vote and .gop. Rather than attempt to monitor every possible variation, ZeroFox focused its research on the three high-impact platforms mentioned above. The study concentrated on federal election activity, leaving state and local election infrastructure outside its scope. Each of the studied platforms would present distinct risks if impersonated by malicious actors:

Malicious actors can impersonate these brands in three key ways:

The research identified numerous election-related domain names that initially warranted closer examination. However, additional investigation showed that some had legitimate or unrelated purposes. For example, actblues.com was associated with a Microsoft sinkhole, indicating the domain had already been mitigated in the past, while a cluster of domains containing “77winred” belonged to an unrelated Vietnamese betting operation. Other domains remained on the watch list because their purposes were uncertain. These findings demonstrate why suspicious naming patterns alone are not sufficient to establish malicious intent.

All three potential methods of impersonation were present during our three-month research window. For instance, we identified about 700 second-level lookalike candidates across the three brands in July and 160 vote.gov subdomain-impersonation candidates. Closer investigation narrowed the field considerably, revealing how many initially suspicious domains were unrelated to election activity. The remaining candidates warranted continued observation, not because malicious content had been confirmed, but because changes in their configuration or behavior could signal a developing threat.

Signs of potential impersonation sites

In the runup to an election, whether this year’s midterms or any other election, it’s important to keep an eye out for three patterns:

Activation of pre-positioned registrations. The brand-string registrations that crop up in the months before an election should be watched closely as election day nears. The first appearance of web content or a new TLS certificate on second-level domains that could be used for impersonation should be treated as a leading indicator and prompt additional investigation.

Sites moving off content delivery networks (CDNs) onto dedicated hosting. For example, moving a site such as winredirect.com from a CDN proxy to another hosting provider, with unusual high-numbered ports open, could precede the activation of a dynamic page. And although legitimate sites do the same thing, it bears watching.

Free hosting as the phishing destination. Serverless edge platforms, free static site hosts, application deployment platforms and free top-level domains remain the easiest way to serve election-themed phishing without a registration footprint. One site our team examined was serving default content, but its configuration illustrated how easily that page could potentially be replaced with phishing content without registering a new domain. A monitoring program that looked only for newly registered domains would miss such a move.

Preparing for 2028 and Beyond

The 2026 midterms offer an important lesson for future election security efforts: Not every suspicious domain represents an active threat, but neither should an inactive domain automatically be considered harmless.

As election security teams prepare for future cycles, including the 2028 presidential election, intelligence gathered today can help establish a clearer picture of recurring domain patterns, identify meaningful changes and reduce the time spent investigating false positives. The goal is not simply to find more suspicious websites, but to recognize which ones actually require action.