Midterm Texts Promise Fake Checks and Open Recurring Donation Pages

Ahead of the November 3 US midterms, political texts claiming fake checks and voter-record errors led recipients to donation forms designed around repeat gifts. Between mid-August and late October 2026, the wave reached hundreds of thousands of texts sent from nearly 9,000 rotating phone numbers through 110 short redirect domains. It grew several times faster than SMS traffic overall during the same weeks. The messages claim that a "$5,000 DOGE check" is ready to ship, a tariff rebate is on hold, or a voter profile failed verification. No such payment or voter-record problem exists. Every link we followed led to a real political committee's donation page. Most links included a recurring=true parameter, and every form we could fully inspect offered a monthly gift and a second, dated gift scheduled around Election Day.

Key Takeaways

• This is the midterm-season wave of a political texting operation we first documented in April 2026. It uses the same redirect layer and rotating sender pools, but the volume and copy have changed.
• Fake-notice lures grew from about one text in six during the first half of 2026 to about one in five. Fake government payments rose from about 3% to 6%, fake voter-record problems rose from 4% to more than 6% and peaked near 9% in mid-October, and fake membership errors held steady at about 6%.
• The payment hook changed with the news cycle: "DOGE check" texts peaked in late September before giving way to "stimulus check" texts, while "sample ballot" texts appeared only during the last weeks before the vote.
• All 48 links we resolved led to committee pages on WinRed, 47 by HTTP redirect and one by page refresh, and 42 included recurring=true. Of the 13 such donation pages we rendered, 11 showed a monthly recurring box. Every one of those also offered a second automatic gift dated between October 30 and November 4.
• At least four landing pages repeat the text's theme in their titles, including a "DOGE Dividend Check" page and a "Voter Profile left INCOMPLETE" page. The text and page therefore function as one funnel.
• The redirect domains were registered in same-day batches with sequential privacy-service IDs. None identifies its owner or hosts anything beyond a redirect, a generic text opt-out form or a branded short-link placeholder. We cannot tell who operates them.

Background

In April 2026, we described a texting operation that used more than 200 short redirect domains to push deceptive political fundraising messages to real donation pages (Two Hundred Redirect Domains, One Real Donation Page). The donation pages belong to genuine, registered committees: party committees, joint fundraising committees, candidate committees and some third-party PACs. We have seen no fake committee pages. This post documents what the texts claim and how the forms they lead to are laid out.

WinRed is the main online donation processor for Republican committees. It launched in 2019 as the party's counterpart to ActBlue. Anedot is an independent processor used by many conservative committees and nonprofits. Both are legitimate services. In this traffic, they are the destination, not the sender.

The new copy draws its hooks from real news. In February 2025, public discussion of a "DOGE dividend" proposed a figure of about $5,000 per household. In 2025, the administration also floated tariff "rebate" or "dividend" checks of around $2,000. Neither had become a payment program as of early 2026 public reporting (Fox 5 Atlanta on the DOGE dividend). The texts present both as approved payments awaiting the recipient's confirmation.

Pre-checked recurring donation boxes have a public history. In 2021, the New York Times reported that donation forms with pre-checked weekly recurring boxes and a second "money bomb" box led to well over $100 million in refunds to donors during the 2020 cycle (Snopes summary). The Federal Election Commission asked Congress that year to ban pre-checked recurring contributions, and bills followed in the Senate and House (NBC News). We found no record that a ban became law. The forms in this wave use a similar two-box layout. We did not confirm whether the boxes start ticked.

Election offices have also warned about the voter-record messages. On September 17, 2026, Rhode Island's Department of State warned residents about a text asking them to confirm their identity for voter records and said its Elections Division had not authorized the message (WJAR). Officials in Pennsylvania (CBS Philadelphia) and Kentucky (WBKO) issued similar warnings during earlier cycles.

Discovery and Infrastructure

We looked for election-themed scams across email, SMS and Facebook ahead of the midterms. We found almost no voter-registration phishing, fake election-office sites or poll-worker job scams. Instead, one pattern dominated election-themed SMS traffic: short links on recently registered domains containing party and year tokens, sent from numbers that rarely appeared twice.

We built the domain set from redirect observations leading to WinRed, Anedot or PSQ Impact. We kept only domains used by ten or more distinct sending numbers and removed shortlinks belonging to a single committee's registered short code. That left 110 redirect domains. We then manually followed 48 observed links, twelve from each of the four fake-notice lure families, rendered 16 destination pages in full (13 reached through links carrying recurring=true, 3 controls), and checked the bare root of every domain named in this post for an owner.

None of the domains identifies an owner. Most redirect their bare root to the same generic text opt-out form, which asks for the sending number and the recipient's own number but provides no company name, privacy policy or contact address. A smaller group displays a branded short-link service's placeholder page. This suggests that the domain is connected to a customer account on that service; the service itself is a legitimate SaaS product. WHOIS records for the larger batches are hidden behind a privacy service. We could not determine who operates the domains, and neither the registration records nor the opt-out pages identify anyone.

How It Works

A recipient receives a text from an unfamiliar 10-digit number. The message names them, sometimes including an honorific and their zip code, and says that something is pending: a payment, a voter-record correction, a membership renewal or a gift. It then provides a short link, usually accompanied by a deadline such as "by 9 PM" or "before midnight" and an opt-out tail such as stop=end.

The link makes one hop. The redirect domain responds with an HTTP 302 leading to a committee's donation page on WinRed or, in a minority of cases, Anedot or PSQ Impact. Some links pass through t.ly, a public URL shortener, along the way. The destination URL carries campaign parameters and, in 42 of the 48 links we followed, recurring=true, often alongside money_pledge=true and a preset amount.

The donation pages we rendered use a shared template. A checkbox labelled "Make this a monthly recurring donation" appears under the amount buttons. It is configured with a monthly interval and an attribute connecting it to the link's recurring parameter. A callout beside it urges the donor to leave it on: "Keep this box checked if you want to 12X your impact", "KEEP THIS BOX CHECKED to help protect our GOP Majority", or "You will receive 90% FEWER texts just by keeping this box checked". A second box says, "Donate an additional [amount] automatically on" a fixed date. On pages reached through recurring=true links, those dates were October 30 or 31, or November 3 or 4. That language belongs to the donation pages themselves. We make no claim about any committee's role in writing or sending the texts. We also did not confirm in a live browser whether the boxes start ticked. We examined only how they are built and labelled.

A recipient who taps the link while believing they are confirming a check or correcting a voter record arrives at a donation form. The form offers a monthly gift and a second, dated gift around Election Day, with callouts asking the donor to keep the recurring box checked.

Sample Lures

All samples are SMS. We replaced recipient names, zip codes and reference digits with placeholders, defanged the links, and removed the slugs.

Fake government payment:

Mr. [recipient name], Your $5,000 DOGE Check is about to be delivered -
Please confirm your zip is [zip].

Confirm: maga26[.]org/[slug]

Stop=end

Fake tariff check with a shipping deadline:

[recipient name]- This one error in your application costs you EVERYTHING!

Your shipping is OVERDUE. Review now or the Tariff Check is ERASED>> us-gop[.]co/[slug]

Fake voter-record error:

[Submission Error]: Voter ID Signature Mismatch.

There was an entry conflict on your last attempt.

Confirm your details to resubmit: r-voter[.]co/[slug]

Fake ballot problem:

[recipient name], your sample ballot is BLANK.

Should Trump & the GOP assume your real ballot will be BLANK too?

RESPOND >> 26act[.]co/[slug]

stop2end

Fake membership error:

[APPLICATION ERROR] Your MAGA Membership application is ON HOLD pending your
response

Last chance to claim here: hxxps://[redirect domain]/[slug]

Stop=End

Technical Analysis

Lure Families

We sorted the wave's message text into families using ordered pattern matching, with the first match taking precedence. The five families below account for about a fifth of the wave. The remainder consists of petitions, surveys, explicit donation asks and news-style bait.

Family	Typical claim	Share, Jan to Jun 2026	Share, mid-Aug to Oct 2026
Fake government payment	"$5,000 DOGE check", "Trump check approved to ship", "tariff rebate on HOLD", "stimulus check alert"	about 3%	about 6%
Fake voter-status or ballot problem	"verify your voter profile", "Voter ID Signature Mismatch", "sample ballot is BLANK"	about 4%	about 6-7%
Fake membership or account error	"MAGA Membership application ON HOLD", "Gold Membership is 75% PAID"	about 7%	about 6%
Fake gift or award	"just DELIVERED, accept your MAGA gift"	about 2%	about 3%
Guilt or fake personal message	"you've GHOSTED MAGA leaders", "read my apology letter"	not measured	about 1%

The payment texts include fake reference numbers such as "DOGE ID#2837" and "DOGE-FILE_[zip]", as well as false attributions to public figures such as "Elon Musk has authorized Trump DOGE Checks". The voter-record texts never identify an election office. Instead, they depend on the recipient assuming that a "voter profile" is official.

Lure Mix Over Time

As the election approached, the payment and voter-record hooks traded places from week to week. The shares represent all texts sent that week through the wave's redirect domains. We omitted the partial week of October 26.

Week of	Fake payment	Mentions "DOGE"	Mentions "stimulus"	Fake voter record	Mentions "sample ballot"
Sep 7	10.3%	4.1%	1.4%	4.3%	0.1%
Sep 14	6.8%	3.8%	1.2%	4.4%	0.2%
Sep 21	5.2%	4.1%	0.6%	6.1%	0.1%
Sep 28	7.6%	5.9%	1.3%	7.8%	0.1%
Oct 5	6.0%	3.8%	2.2%	7.3%	0.2%
Oct 12	5.4%	1.8%	3.3%	8.6%	0.3%
Oct 19	4.3%	2.0%	2.0%	6.8%	0.4%

From late September onward, fake voter-record texts outnumbered fake payment texts each week. "DOGE" wording peaked during the last week of September, then declined by about two-thirds. Generic "stimulus check" wording rose until it matched "DOGE". "Sample ballot" texts remained rare, but their share rose from 0.1% of traffic in late September to 0.4% by mid-October.

Landing Pages

We rendered 16 destination pages in full: 13 reached through links carrying recurring=true and 3 controls without it.

Feature	Pages showing it
Monthly recurring checkbox tied to the link parameter	11 of 13 (the other 2 were too large to capture whole)
Second "donate an additional amount automatically on " box	11 of 11 pages showing the recurring box (dated Oct 30 to Nov 4), and 3 of 3 controls
Statically pre-checked box in the HTML	0
Page title or body repeats the text's theme	at least 4 (not every page was checked for this)

The dates in the second box clustered around October 30 and 31 and Election Day itself. The controls, which we reached through links without recurring=true, showed that the two-box design appears whether or not the link requests recurring. One control defaulted to a weekly gift running until December 20. Where we could read a "Paid for by" line, the pages belonged to joint fundraising committees, a national party committee, and third-party PACs or foundations.

Registration Cohorts

The redirect domains were purchased in batches. Cohorts registered with the same registrar on the same day follow common naming templates. The larger Tucows batches also have consecutive privacy-service customer IDs, which suggests that one registrant was behind each batch.

Registrar and date	Domains	Examples and pattern
Tucows, 2025-07-21	10	party-token hyphen pairs such as win-gop[.]org, win-red[.]net, 26-win[.]org, gop-wave[.]org
Tucows, 2025-12-30	6	year tokens: 26vote[.]co, rep2026[.]co, us-26[.]co, usa26[.]io, rght26[.]io, win26[.]io
Cloudflare, 2026-01-02	8	compound .com words built from gop or red plus txt, text, fund or give (the largest of several compound-word batches)
Tucows, 2026-04-02	3	26u5a[.]co, us-go[.]io, right26[.]co
Tucows, 2026-05-21	5	act-26[.]io, im-pact[.]io, red-go[.]io, gop-go[.]co, usa-250[.]co
Tucows, 2026-06-10	6	26-prefixed and .win names such as 26gop[.]org, 26text[.]win, gop-26[.]win, rep-26[.]win
Tucows, 2026-08-11	2	2026notice[.]com and a sibling with the same "check approved" template

Among domains with public registration dates, 65 predate June 2026 and 18 were registered afterward. These include individual domains purchased on September 24, 29 and 30, five weeks before the election. The older domains account for most of the traffic. The newest appear to be replacements purchased as the cycle peaked. Several January compound-word domains had stopped resolving by late October.

Domain Generation

The names use a small group of templates made from party, colour and year tokens:

Template	Examples	Approximate domains
party or colour token with hyphen	gop-wave[.]org, win-red[.]net, win-gop[.]org	about 50
token plus 26 or 2026 suffix	red-26[.]org, maga26[.]org, rep2026[.]co	22
26 or 2026 prefix	26vote[.]co, 26text[.]org, 26gop[.]org	17
compound words	gop or red plus txtnow, textme, fundit, giveit	15
usa-250 semiquincentennial token	usa-250[.]co	1

.co is the most common TLD, followed by .com, .org, .io, .net, .us and .win. There are also single examples using .vote, .red, .info and .la.

Link Grammar and Opt-Out Tails

The kit uses two main link shapes. Most messages contain a bare domain/slug without a scheme and with a 3 to 7 character lowercase slug. The compound-word batch uses https://e.<domain>/ with an 11-character mixed-case slug. A smaller group uses go., txt. or d. subhosts. The opt-out tail corresponds to the link shape:

Opt-out tail	Link shape that carries it
stop=end	bare domain links (by far the most common), occasionally subhosts
Stop2End, STOP to end	bare domain links only
STOPtoEND	bare domain links, rare on subhosts
Reply STOP to Opt-Out	e. hosts with 11-character slugs (compound-word batch)

Sender Pool

The numbers are disposable. More than half of the sending numbers we observed sent only one message, while fewer than one in six sent four or more. The pool is concentrated in the Washington metro area:

Area code	Region	Distinct sending numbers
571, 703	Northern Virginia	1,423
301, 240	Maryland	918
202, 771	Washington DC	895
804	Richmond, VA	350
330	Northeast Ohio	225
504	New Orleans	223

The six DC-area codes alone account for more than a third of all distinct numbers. The nine codes listed in the table account for close to half.

Destinations

Redirect observations from the wave's domains lead to more than 200 distinct committee donation pages:

Destination	Share of observed redirects
WinRed	about 88%
Intermediate hop through the public t.ly shortener (final page not recorded)	about 10%
Anedot	about 1%
PSQ Impact	under 1%
Individual committee or advocacy sites	about 1%

Each domain leads to many unrelated committees, unlike a branded shortlink belonging to a single committee. We cannot tell from this who operates the domains. Some redirects from us-gop[.]co passed through the t.ly shortener before reaching the committee page. That does not identify t.ly's own users.

Detection Observations

• A short link sent from a 10-digit number with no prior history, using a recently registered .co, .io, .org or .win domain containing party or year tokens, is consistent with this kit.
• Content alone does not establish attribution. The same fake-check and voter-profile scripts also appear on shortlinks tied to one identifiable committee's registered short code. The distinction is in the sender shape: a rotating long-code pool rather than one short code.
• On the landing side, it is worth recording recurring=true, money_pledge=true and a preset amount when they appear on a donation-platform URL reached from a text. A dated "additional automatic donation" box near Election Day is also worth recording.
• Payment claims that repeat the recipient's name, state or zip code appear account-specific. Recipients are least likely to question those messages.
• When the opt-out tails (stop=end, Stop2End, STOPtoEND) appear with the slug shapes described above, they cluster a newly observed domain into the same kit on first sighting.

Observed Redirect Domains

We observed these short domains carrying the texts described above to committee donation pages between August and October 2026. None identifies an owner, and we do not know who operates them. A domain's inclusion here describes its use in this traffic. The donation platforms WinRed, Anedot and PSQ Impact, the t.ly shortener and the committees behind individual pages are legitimate and do not appear in the list. All values are defanged.

Domain	Registrar and date	Root page
26u5a[.]co	Tucows, 2026-04-02	generic opt-out form
us-gop[.]co	GoDaddy, 2025-05-28	short-link service placeholder
26vote[.]co	Tucows, 2025-12-30	generic opt-out form
26-win[.]org	Tucows, 2025-07-21	generic opt-out form
rep-26[.]co	Tucows, 2025-08-14	generic opt-out form
win-gop[.]org	Tucows, 2025-07-21	generic opt-out form
ac-tion[.]io	Tucows, 2025-08-21	generic opt-out form
act-26[.]io	Tucows, 2026-05-21	generic opt-out form
gop-go[.]co	Tucows, 2026-05-21	generic opt-out form
2026notice[.]com	Tucows, 2026-08-11	generic opt-out form
maga26[.]org	not public	generic opt-out form
voterep[.]co	Tucows, 2026-01-29	generic opt-out form
truered[.]io	not public	generic opt-out form
26act[.]co	GoDaddy, 2026-06-11	branded short-link placeholder
26gop[.]org	Tucows, 2026-06-10	branded short-link placeholder
...		representative subset; 100+ redirect domains observed in this wave

Message Patterns

Pattern	Notes
`(check	refund
`(verify	confirm
please confirm your zip( code)? is \d{5}	personalized payment template
stop=end, Stop2End, STOPtoEND, Reply STOP to Opt-Out	kit opt-out tails

Conclusion

During the ten weeks before the vote, fake payments and broken voter records accounted for a growing share of this traffic. The payment hook shifted from "DOGE" to "stimulus", and "sample ballot" warnings appeared during the final weeks. At the end of the links, the donation forms pair a monthly gift with a second gift dated around Election Day. The redirect domains are cheap and anonymous, and new ones were still being registered five weeks before the election. We expect recount and certification hooks to appear on the same domains, but that is a forecast rather than an observation. The registration batches, link grammar and opt-out tails should remain consistent even when the wording changes.