You say .gov-ish, does this mean compromised gov email accounts, spoofed email addresses or domains that look like government domains?

.gov is a US thing, and not even all US agencies use .gov ending emails.