Someone with the ability to register .gov domains is trying to make a sneaky buck.
https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-...
I haven’t seen any follow-up reporting, but it looks like the process now requires some semblance of identity verification: