Threat Research Report: Malicious Domain Activity During the Los Angeles Wildfires

Description

During the 2025 Los Angeles wildfires, cybercriminals exploited the disaster through various phishing campaigns. Analysis of 119 domains registered between January 8-13, 2025, revealed themes targeting emergency assistance, legal services, and reconstruction efforts. GoDaddy was the most used registrar, and .com the prevalent TLD. Fraudulent GoFundMe campaigns, fake merchandise stores, and wildfire-themed cryptocurrencies were identified. The scams aimed to cause financial losses, harvest personal information, and spread misinformation. Compared to Hurricane Helene, the wildfire scams were more reactive and locally focused. Mitigation strategies include stringent rules for fundraising platforms, continuous monitoring of fake websites, and caution against unverified cryptocurrencies.