RiskIQ Campaign Observations

RiskIQ is tracking domains and hostnames containing the last name of each of the four presidential candidates––Jorgensen, Biden, Trump and Hawkins. This information is being released to increase visibility about the infrastructure and aid those who wish to investigate it further. See our FAQ below for answers to common questions.


!!! new domains in 24-hours

!!! new hosts in 24-hours

!!! total observations since July 4th, 2020


!!! new domains in 24-hours

!!! new hosts in 24-hours

!!! total observations since July 4th, 2020


!!! new domains in 24-hours

!!! new hosts in 24-hours

!!! total observations since July 4th, 2020


!!! new domains in 24-hours

!!! new hosts in 24-hours

!!! total observations since July 4th, 2020


The information is made available solely for general information purposes. RiskIQ does not warrant the accuracy, completeness or usefulness of this information. Any reliance you place on such information is strictly at your own risk. We disclaim all liability and responsibility arising from any reliance placed on such materials by you or by anyone who may be informed of any of its contents. By making this information available, RiskIQ is not endorsing either or any candidate.

Investigate the Content

If you'd like to investigate the infrastructure mentioned within this website, sign-up for a free RiskIQ Community account. Go direct to candidate infrastructure by searching for "jorgensen", "hawkins", "trump" or "biden" directly from the home page.

Acceptable Use

Not for commercial use without permission. RiskIQ must be linked and noted as an objective source of information where information is any content from this web page and any content associated with RiskIQ Campaign Observation files. Commercial use inquiries can be directed to support@riskiq.com.

About RiskIQ

RiskIQ is the leader in digital attack surface management, providing the most comprehensive discovery, intelligence, and mitigation of threats associated with an organization's digital presence. With more than 75 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social and mobile exposures. Trusted by thousands of security analysts, security teams, and CISO's, RiskIQ's platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk, and take action to protect the business, brand, and customers.

Holly Hitchcock
Front Lines Media


What are you measuring?

We measure how often a candidate name appears within a domain or hostname. Each occurrence is counted as a single data point.

How can you see this information?

RiskIQ uses a combination of Internet scanning, web page crawling and other technologies to collect information from the open web.

Are all these observations malicious?

No. RiskIQ is presenting the data as-is. Much of the infrastructure is liable to be benign, though some could be used for malicious purposes.

How do I know if a domain or host is malicious?

In order to determine this, you will need to perform an investigation on the infrastructure.

Do you know who registered this infrastructure?

Not entirely. During the registration process, information is supplied and will sometimes be present within a WHOIS record. RiskIQ collect WHOIS records, but may not be able to get all details needed to understand who registered the website.

Why are you sharing this data?

RiskIQ believes in a community defense model. By releasing this information, more people can become aware of its existence and investigate anything that appears suspicious. Working together increases the odds that an attack can be prevented.

Can I download data older than 7 days?

Yes. RiskIQ has collected data since July 4th, 2020. You can download any daily file using this URL, https://campaign-public-domains.s3-us-west-1.amazonaws.com/campaign-2020MMDD, where MM would be replaced with the month and DD would be replaced with the day.

Can I access all statistics from every day?

Yes. A JSON file containing all statistics can be found here.