Don't let fake election websites fool you before 2026 midterms

You spot a campaign shirt online that makes you laugh. The site carries the candidate's name. It also has polished product photos and a familiar checkout page. So, you assume the store supports the campaign.

A fake election website can copy enough campaign cues to make that assumption feel reasonable. Your money and personal information could then reach an operator with no verified campaign connection.

New research provided to CyberGuy by WhoisXML API, an internet intelligence company that analyzes domain, IP and DNS data, tracked 62,081 election-named domains created since September 2025. Researchers identified 13,645 addresses that read like campaign sites based on their names.

The research classifies only a portion of the domains as campaign-style addresses. Legitimate campaigns, supporters, merchants and domain investors may control many of them. However, researchers also found live storefronts that used candidates' names while selling merchandise and accepting donation-style payments. That smaller group creates the clearest risk for you.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?" , has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com .

Why fake election websites surge before the midterms

National elections create a rush for online real estate. Campaign teams want memorable web addresses before someone else claims them. Supporters may launch fan pages, while merchants see an opportunity to sell political products. Impersonators can follow the same naming formula.

According to WhoisXML API, nearly 46% of the curated campaign-style set used structures such as "[name]for[office]" or "for[state]." Domains referencing congressional races appeared most often. Senate-themed names came next. State names also appeared across about one-third of the curated set. Texas led with 537 registrations. Florida, Georgia, Ohio and Colorado followed.

Those names feel familiar because real campaigns use the same structure. As a result, a questionable domain can look credible before you open the page. Across the domains studied, researchers said 90% hid the registrant's identity. In addition, 88% carried a one-year registration term. Privacy protection and short registration terms can have legitimate uses. Still, those details deserve more attention when a new site also copies campaign branding or asks for money.

A small change in a domain can hide in plain sight. WhoisXML API highlighted massiemoneybomb[.]us, which closely resembled the established massiemoneybomb[.]com fundraising address . The main difference appeared after the final dot.

That change may look obvious on a large computer screen. However, it becomes easier to miss on a phone, especially when a text or social media post opens the page directly. Researchers also examined kenpaxton[.]us. They said the domain was 58 days old when captured, while kenpaxton[.]com dated back to 2008.

The newer site reportedly sold supportive campaign products alongside merchandise criticizing the same candidate. That unusual mix offers a clue that the store may lack an official connection. Yet many shoppers will focus on the product photos or the price. A polished checkout can make the entire operation feel established. Alexandre François, the WhoisXML API domain scam researcher behind the study, told CyberGuy that AI can help operators build convincing websites quickly and at scale. That makes it even harder to judge a campaign page by its appearance alone.

Political merchandise may cost you more than the price on the screen. According to the research, some storefronts allowed visitors to add donation-style payments of up to $1,000 to a shopping cart. The sites then processed the payment through their own checkout flows.

One store reportedly continued accepting a donation-style payment after the candidate's official ActBlue page stopped taking contributions. The checkout requested a full name, street address, email address and phone number. It also collected payment card details.

A familiar payment processor can make that form feel safe. However, its presence only shows how the payment moves through the checkout. It cannot confirm that the candidate authorized the store or that the campaign receives the money.

François said the study found no direct evidence that donors lost money or had their data misused. "Only the payment platforms could see whether a donor lost money or had data misused, and their data was not part of this study," he told CyberGuy. The findings support caution rather than a claim that every highlighted site committed fraud.

Domain registration records can expose useful clues before or after a website launches. Researchers can review the creation date, registrar, paid registration period and privacy status. Sometimes, the records also identify the owner or registrant country. However, each clue has limits.

Many legitimate website owners use privacy services to keep home addresses and contact details out of public databases. Campaigns may also register several defensive domains so impersonators cannot claim them first. A one-year registration term also appears across ordinary websites. Price and convenience often drive that choice.

The risk grows when several details point in the same direction. A nearly copied domain may lead to a new storefront with an unofficial donation flow. A mismatched disclaimer adds another concern.

For federal political committees, public websites generally need a disclaimer that identifies who paid for t...

Indexed and credited by AIPROPX. Originating outlet: Fox News. Open at source →