Where America’s Old Government Websites Went: A Research

One visit per address, 17 October 2026. Sites that refused automated visitors are excluded from every rate.

What the Listed Address Serves Today

Of the 12,791 places whose address we could actually read, 499 are in someone else's hands, and 1,721 are dark. Counties do better than towns: 14% lapsed against 18%, and the smaller the place, the worse it gets. Roughly 2.7 million Americans live somewhere whose listed address now belongs to a stranger. Twenty-six million live somewhere whose listed address is simply dead.

Places are counted once. An old address that forwards correctly to a new .gov counts as the government's.

Finding 1: 276 Towns and Counties Are Hosting a Casino

The pages aren’t subtle. Bradley County, Tennessee's old address, serves an Indonesian property-news portal that’s a thin wrapper over a gambling site. Burleigh County, North Dakota's, is a Thai slot site. Stark County, North Dakota's, is Vietnamese. West Seneca, New York, population forty-five thousand, has an English-language affiliate page rating casino welcome bonuses. Bristol Township, Pennsylvania, with fifty-four thousand people, now reads Jwtogel: Link Slot Online Gacor.

Trempealeau County, Wisconsin, is the interesting exception. Its old domain has been registered continuously since 1999, never dropped, and today it offers bad-credit loans. That one was sold or transferred rather than caught, which is a different market and the same outcome.

88% of these pages sit behind Cloudflare, so the real hosting is hidden. Of the handful that are not, the servers sit with OVH in France, in a Namecheap data center, and in one case with a hosting company in Indonesia. More than half do not serve the gambling page themselves. They forward visitors to it, which is what tells you this is an industry rather than a series of accidents.

What the pages sell, classified from the page itself. Language comes from the page, not from the hosting.

Finding 2: The Clicks Are Resold, Several Times Over

Warren County, Pennsylvania's old address, warrencountypa.net, takes five hops before it stops. A design blog, a high-school football site, a distillery, a church in Detroit, and then TOKYO88. Jackson County, Ohio, takes six and ends on JERUKBET.

The intermediate hops are not random. They are other expired domains, bought for the same reason: a youth soccer club in California, a tomato festival in New York, a lighting shop. Someone is accumulating names with history and running traffic through them.

Our favorite detail in the whole study is that nine of these chains end on a Spotify track. A traffic-distribution system sorts the visitor, finds no buyer for a request coming from a data center in the middle of the night, and dumps them somewhere harmless. A person on a home connection, on a phone, in daylight, gets sorted somewhere else. We saw the floor of this system, not the ceiling.

A redirect network is any fetch that crossed two or more unrelated domains before the final page.

Finding 3: The Names Were Caught, Not Inherited

A domain that expires, gets deleted, and is registered again by someone new receives a fresh creation date. One that is bought at an expiry auction before deletion, or transferred, keeps the old one. So the registration date is a conservative signal: it catches the drop-catchers and misses the buyers.

We pulled the registry record for every lapsed address and, as a control, for 593 randomly chosen domains that still serve their government.

34% of the taken-over names were registered in 2023 or later. 92 of them were registered during the first nine and a half months of 2026. In the control group, two. Not two percent. Two domains.

The registrars behind the taken names are the ones you would expect from the drop-catching business: GoDaddy, Namecheap, Dynadot, Spaceship, and the Singapore registrar Gname.

Registration data from the registries' own RDAP services. A floor, not a ceiling.

Finding 4: Wikipedia Still Sends People There

This is the part that turns a lapsed domain into a working distribution channel. An expired name is worth something because of what still points at it: state directories, old press releases, bookmarks, a decade of inbound links, and an encyclopedia entry that search engines treat as authoritative.

We queried the English Wikipedia API for every affected place and read both the rendered links and the article source.

882 articles link a lapsed address somewhere. 449 name it in the infobox, the line a reader and a search engine both treat as the official site. Forty-three of those send readers to somebody else's website, nineteen straight to a gambling page.

There is a detail here for anyone who wants to fix it. In 864 of the 882 cases, the URL is written into the article text itself. Only 18 inherit it from Wikidata. Correcting the Wikidata item is necessary but nowhere near sufficient, which is probably why this hasn't been cleaned up already.

2,950 articles checked. 449 still name the lapsed address in the infobox Website field.

Finding 5: This Is a Small-Town Problem

The pattern is consistent and not very surprising once you have seen a few of these sites. A town of eight hundred people has no IT department. A volunteer or vendor built the website and has since moved on; the domain sits in a personal account, and the renewal notice goes to a clerk who retired two elections ago.

Kentucky, Arkansas and Colorado have the highest lapsed shares among states with at least forty places read. New Jersey, Michigan and Maryland have the lowest. None of that is about competence in any particular courthouse. It tracks the number of very small incorporated places a state has.

Population from Wikidata and the Census Bureau's 2024 estimates.

The .gov Side Has Its Own Version of the Problem

A stranger can’t buy a .gov. That is the entire point of the program, and it works. What a .gov can be is pointed at nothing.

Of 2,426 .gov domains registered to counties and cities, 422 serve no website at all, 234 show an error or placeholder, 58 never answer, and six answer with somebody else's page: a webmail login box, a personal blog, Google's homepage. Most of the dark ones are new, 338 registered since 2023, so this is mostly a migration in progress rather than decay. It also means the old address is still doing the work in the meantime, and the old address is the one that lapses.

What’s Going Right

2,175 old addresses now forward to a .gov. That is 24% of the readable non-.gov addresses, and it’s the correct way to move: keep the old name, point it at the new one, let every old link keep working.

It also comes with a sting. Every lapsed address in this study was once exactly this: an old domain forwarding politely to the real site, until renewal didn't happen.

Eight Government Websites Are Carrying Casino Links Right Now

A different failure turned up while we were counting. Eight sites that are still unmistakably the government's — agendas, department listings, phone numbers, the usual — also carry links to online casinos injected into the page, mostly invisible to a reader and perfectly visible to a search engine. One of the eight is a live .gov.

That is not a lapsed domain. It is a compromised website, and it needs a different fix: clean the site, update whatever is running it, rotate the credentials. We are notifying all eight before publication, and we don't name them here or in the published dataset.

What Should Change

• Never let an old official domain expire: Fifteen dollars a year protects every link anyone has ever made to you. Renew for the maximum term, turn on auto-renew and registrar lock, and put the renewal contact on a shared mailbox rather than on a person.
• When you move to .gov, keep the old name forwarding indefinitely and write that into the migration plan, with a named owner and a budget line, so it survives the person who ran the project.
• Fix your Wikipedia article and your Wikidata item: Both are editable by anyone, including you. Our dataset lists which places need it.
• Search your own domain for casino keywords twice a year: That is how most councils find out they have been injected, usually from a resident.
• For registries and registrars: a domain with a decade of government inbound links is not the same asset as an expired hobby blog, and the drop-catch market knows it even if the policy does not.

Methodology

One visit per address. DNS over HTTPS first, then a single GET with a normal desktop browser identity, redirects followed, the final page's title, text, links, and headers recorded along with every hop of the chain. Classification happened afterward, offline, against the stored evidence, so we could tighten the rules and re-run them without touching anybody's server a second time. The rules themselves are published in full.

2,960 sites refused the automated visit. We didn't retry them from a different address, route, or tool, and we didn't touch a single bot protection. Gambling landers don't refuse visitors, so most of those are almost certainly government websites, and counting them that way would have flattered our numbers. They are reported as their own category and excluded from every rate instead.

We read only public pages, public DNS and public registration records, once each, at a low rate. No login, no form, no restricted resource. Every headline figure was recomputed from the raw records by a separate script that does not import the analysis code; sixteen of sixteen checks matched. A random sample of gambling classifications was re-fetched by hand, and we reviewed every compromised-site case individually, which is how one turned out to be a content farm on a re-registered domain rather than a hacked council.

Limitations

One fetch, from one datacentre address, on one day. Pages that cloak, serving spam to search engines and something innocent to us, are undercounted. So are redirect networks that route datacentre traffic to a harmless destination, which we know happens because we watched nine of them do it.

Wikidata entries are sometimes wrong from the start, pointing at a chamber of commerce or a library rather than the government. Those show up under "related" or "unrelated" rather than as takeovers, and the stricter headline figure we publish, 413 places, counts only the unambiguous cases.

Keyword classification will miss gambling pages in languages we did not list. And the picture changes weekly: several of the addresses in this study were registered within a month of us finding them.

Summary

Worth County, Missouri has about two thousand residents and one Wikipedia article. The article says the county's website is worthcounty.us. Registry records show that name was registered on 16 September 2026. When we visited it a month later, it served ZEUS711, an Indonesian lottery-betting page, from behind Cloudflare.

Nobody attacked Worth County. The county moved, or the person paying for the domain left, and the renewal notice went to an inbox with no one behind it. The name dropped. Someone caught it. Everything that pointed at that address, including the encyclopedia, now points at a casino.

A domain is only yours while somebody keeps paying for it. That sentence is obvious, and almost nobody acts on it, so we decided to count how often it has already happened.

We took every official website listed for the 3,144 US counties and 12,749 municipalities on Wikidata, the database behind Wikipedia's infoboxes and a good deal of Google's knowledge panel, added every county and city domain in the federal .gov registry, and visited all 17,907 of them once on a single day in October.