The official web addresses of 276 US towns and counties now serve gambling or spam pages, most of them Indonesian online slots, according to a census of 15,751 local governments published by Mysterium VPN on 28 October. A companion census found 42% of county election websites still on domains anyone can register, days before the 3 November midterms.
The two studies describe one problem from opposite ends. The first counts what became of old official addresses once local governments stopped renewing them. The second counts the election offices still running on the kind of domain that ends up in the first study’s tables. Both datasets were collected on 17 October 2026.
What happened to the old official addresses?
Of the 12,791 local governments whose listed website could be read, 2,220 (17%) are listed at an address that no longer reaches them. For 499 (3.9%), the address now serves someone else. The other 1,721 (13%) are dead: the domain is gone, has no web host, never answers or shows an error page. A further 2,960 sites refused automated visitors, and the researchers left them out of every rate rather than guess.
The starting list was Wikidata, the structured database behind Wikipedia’s infoboxes and Google’s knowledge panels, which records an “official website” for 15,751 US counties and municipalities. The team added every county and city domain in CISA’s .gov registry, visited all 17,907 hosts once, followed every redirect and classified the final page with published rules. Registration records came from RDAP, the registration data protocol that succeeded WHOIS.
| What the old address serves now | Places |
|---|---|
| Gambling, betting, adult or pharmacy spam | 276 |
| An unrelated live site | 137 |
| Parked, for sale or an expired-domain lander | 56 |
| A redirect network reselling the clicks | 30 |
| In someone else’s hands | 499 |
Size predicts the outcome. 28% of readable addresses for towns under 1,000 people have lapsed, against 4% for cities over 100,000. Roughly 2.7 million Americans live somewhere whose listed address now belongs to someone else, and 26 million somewhere whose listed address has gone dark. Among states with at least 40 places read, Kentucky (33%), Arkansas (31%) and Colorado (31%) have the highest lapsed shares.
Who is buying the lapsed domains?
Gambling operators, mostly Indonesian ones. Of the 275 addresses serving gambling or spam, 35 of which belonged to counties, 184 carry Indonesian-language “slot gacor”, “togel” and “situs judi” pages. Vietnamese betting and pirate football-streaming brands hold 39, English-language casino and sportsbook affiliates 25, and Chinese-language casino or adult sites 10. Payday lenders, Thai and Korean gambling, Russian-language adult pages and pharmacy spam account for the last 17.
The cases read like a drop-catcher’s shopping list. Worth County, Missouri, population about 2,000, still has worthcounty.us in its Wikipedia infobox. Registry records show the name was registered on 16 September 2026 through NameCheap, and a month later it served an Indonesian lottery dashboard from behind Cloudflare. Grafton County, New Hampshire, moved to graftoncountynh.gov; its old graftoncountynh.us was re-registered on 10 November 2025 and now forwards to a Vietnamese casino brand. Jackson County, Ohio’s jacksoncountygovernment.org bounces a visitor through six other domains, an education blog and a restaurant menu among them, before landing on an Indonesian slot page.
Registration dates show how the names changed hands. Of 462 taken-over domains with a registry record, 158 (34%) were created in 2023 or later, 92 of them in the first nine and a half months of 2026. In a control group of 593 domains that still serve their government, two were. A domain that expires and is registered again gets a fresh creation date, the signature of drop-catching: automated re-registration the moment a registry releases a name. GoDaddy (139) and NameCheap (103) are the registrars of record for the most taken-over names. Among names registered since 2025, Namecheap leads, followed by Dynadot, the Singapore registrar Gname and Spaceship.
Why would a casino want a county’s old domain?
For the links, not the county. An address printed on letterheads for fifteen years is still linked from Wikipedia, state municipal directories, local news archives and old press releases, and search engines still weigh those links. Google classes the practice as spam. Its spam policies define expired domain abuse as buying an expired domain and repurposing it “primarily to manipulate search rankings”, and two of the examples Google gives are affiliate content on a domain once used by a government agency and casino content on a former elementary school’s site.
The plumbing is built to be hard to pull out. 88% of the gambling addresses sit behind Cloudflare, which hides the real host. More than half (146) do not serve the gambling page themselves but forward the visitor to it, and 67 of those pass through two or more other domains on the way: other expired names bought for the same job, including a youth soccer club, a tomato festival, a lighting shop and a Detroit church. Nine chains run through the same traffic broker and end on a Spotify track. That is how a traffic distribution system treats a visitor it has no buyer for, such as a scanner on a datacenter address. Such systems typically reserve the paying destination for phones and home connections.
None of this is new in kind. Backlinking.com’s October 2026 audit of 3,692 domains sold at auction, reported by Casino.org, found at least 448 had become gambling sites, with buyers paying $22.3 million for the whole set. One was the former site of the Queen’s Green Canopy, a UK Platinum Jubilee tree-planting project, which now redirects to an Indonesian slot page. In August 2025, WTOC found a link on Long County, Georgia’s government website leading to a gambling page. What the US census adds is scale: the same market, working through thousands of small-town domains at once.
Why does Wikipedia keep sending readers there?
Because the old URL is written into the articles. 882 English Wikipedia articles still link a lapsed official address somewhere, and 449 give it in the infobox “Website” field, the line readers and search engines treat as the official site. 43 of those infobox links lead to someone else’s site, 19 of them straight to gambling or spam. In 864 of the 882 linking articles the URL is typed into the article itself, and only 18 inherit it from Wikidata, so fixing the Wikidata item alone changes nothing on Wikipedia.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
This is the inventory a drop-catcher bids on, and it renews itself. The move to .gov is real: 2,175 old non-.gov addresses, 24% of those readable, now forward to a .gov site. Each forwarder protects every link ever made to the old name, right up until someone forgets to renew it. Then the old URL, still sitting in Wikipedia, in state directories and in a decade of inbound links, goes to whoever bids first.
Are county election websites heading the same way?
Many of them run on exactly the kind of domain that does. Of the 2,081 counties where the researchers could identify a county-run page with election information, 869 (42%) publish it on a domain that is not .gov: 303 on .org, 285 on .us, 222 on .com, 51 on .net and 8 elsewhere. Only verified US government organisations can register a .gov, and CISA’s get.gov registrar issues them free to eligible bodies. Anyone can register the rest. A manual census in 2024 put the non-.gov share at 57%. Weighted by population it is now 28%, because large counties moved first.
Oklahoma (89% of identified county election sites off .gov), Alaska (83%) and Texas (73%) are the worst states. In Texas, 134 of the 169 non-.gov sites use the co.[county].tx.us pattern that predates .gov’s opening to local government. Arizona and Nebraska are at zero.
The overlap between the two studies is direct. For 1,028 county and state election domain names, the researchers checked the same name under nine endings, from .com to .vote, and found 121 registered copies outside government control: 38 serve an unrelated live site, 8 are explicitly for sale, 73 show a bare server page and 2 serve gambling or spam. Both are old official addresses of counties that have since moved to .gov (granitecountymt.us in Montana and warrencountypa.net in Pennsylvania), which is the first study’s failure mode turning up in the second. Another 73 counties have a .gov that already resolves but still run their election page on the old domain, the point in a migration when the old name is most likely to be dropped.
Can someone spoof a county election office’s email?
For about half of them, yes. Of 942 election contact domains published on county election pages, 216 (23%) have no DMARC record at all and 263 (28%) publish DMARC with p=none, a monitoring setting that reports forged mail and still delivers it. One more record is malformed. Only 462 (49%) tell receiving servers to quarantine or reject mail that fails authentication. On the other 51%, a forged “from” address would reach a voter’s inbox.
Some counties make impersonation easier still. 23 list a consumer address as the election contact on their own page, 18 of them Gmail, which leaves a voter no way to tell the office from an impostor with a similar account. 28 election pages cannot be reached over valid HTTPS, 178 still serve the page over plain HTTP if that is what the voter types, and only 34% send an HSTS header. In October 2020 the FBI and CISA warned that spoofed domains, including .com versions of legitimate .gov sites, and spoofed email accounts would be used to spread false election information and harvest personal data. Generative AI has since made convincing lures cheap to write, as we covered in how large language models are reshaping phishing, and an unenforced DMARC policy removes the last technical check.
What should local governments do?
The fixes are cheap, and most of them are paperwork.
- Never let an old official domain expire. A forwarding domain costs around fifteen dollars a year. Renew it for the maximum term, turn on auto-renew and registrar lock, and send renewal notices to a shared mailbox rather than one clerk.
- Keep the old name forwarding after a move to .gov, indefinitely, and write that into the migration plan.
- Move election email to DMARC p=reject once SPF and DKIM are aligned. p=none is a first step, not a destination.
- Serve every election page over HTTPS only, with an HSTS header.
- Register the obvious copies of the election domain (.com, .org, .us, .vote) and point them at the official site.
- Correct the Wikipedia article and the Wikidata item for the town or county. Anyone can edit both, and the study’s dataset lists which ones need it.
- Search your own domain for casino keywords a few times a year. Eight live government sites in the census, one of them a .gov, carry injected casino links, a sign of a compromised site rather than a lapsed domain.
A spoofed email from a county domain does the most damage when it reaches staff whose logins are already in criminal hands, and our October analysis found staff logins from three in four government bodies in stealer logs.
What should voters check before 3 November?
Start from your state election office, which USA.gov lists, and follow its link to your county instead of a search result or a link in an email. A .gov address is a strong signal, but 42% of genuine county election sites are not on .gov, so a non-.gov site is not proof of a fake; the state directory is the reliable check. Treat an election email from a .com or Gmail address as something to confirm by phone. And if a town or county site is suddenly in Indonesian or selling slots, the domain has changed hands. The clerk’s office often does not know, so tell them.
Frequently asked questions
Why do gambling sites buy expired government domains?
Old government domains keep their links from Wikipedia, state directories and news archives, and search engines still count those links as a sign of trust. Google classifies buying an expired domain mainly to manipulate rankings as expired domain abuse, a violation of its spam policies.
How many US local government domains have been taken over?
Of 12,791 listed local government addresses that could be read on 17 October 2026, 499 (3.9%) served someone else, and 276 towns and counties had an address serving gambling or spam. Another 1,721 (13%) were dead or broken.
What is drop-catching?
Drop-catching is the automated re-registration of a domain the moment the registry deletes it after expiry. The new registration carries a fresh creation date, which is why 34% of the taken-over government domains show a registration date in 2023 or later.
Can anyone register a .gov domain?
No. Only verified US government organisations can register .gov domains, through CISA’s get.gov, and the domains are free for eligible bodies. A .gov can still be misconfigured: 6 county and city .gov domains in the census answered with another organisation’s page.
How can I tell if a county election website is real?
Reach it through your state election office’s website rather than a search result or an email link. A .gov address is a strong signal, but 42% of real county election sites are not on .gov, so the state directory is the reliable check.
What does DMARC p=none mean?
A DMARC policy of p=none asks receiving mail servers to report messages that fail authentication but still deliver them. Together with domains that have no DMARC record, it leaves 51% of county election contact domains open to forged email.
Sources and further reading
- Mysterium VPN: Where America’s old government websites went (research, 28 October 2026)
- Mysterium VPN: 2026 county election website security census (research, 27 October 2026)
- Google Search Central: spam policies for Google web search, expired domain abuse
- FBI and CISA: spoofed internet domains and email accounts pose cyber and disinformation risks to voters (2 October 2020)
- Casino.org: offshore gambling sites spent millions snatching up expired government domains (12 October 2026)
- WTOC: Long County government page previously linked to gambling site (26 August 2025)
- get.gov: frequently asked questions about .gov domains
- USA.gov: state and local election offices
- Related reading on Ransomnews: Rhysida lists Anne Arundel County and Kairos took $1M from a US government body.
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.