How Did a California Freeway Sign Get Hacked With an Iranian Regime Death List?

A digital sign on a Los Angeles freeway was hijacked and used to point drivers to an Iranian regime-linked website that publishes personal details of dissidents living in the city.

The Caltrans (California Department of Transportation) sign displayed the address for goorkan.info, a site that bills itself as a campaign to “identify and punish traitors to the homeland.”

That site, according to the California Post, has been linked to Iran’s Islamic Revolutionary Guard Corps, which the United States designated a foreign terrorist organization in 2019. 

A new revamp of the home page features a section called “The Burn List," which shows ominous imagery of individuals' faces being scanned for recognition and a threat that their "everyday chats" and other sensitive information "is locked on our servers."

Iran penetrates California as freeway sign terrifies drivers with photos and menacing threats https://t.co/Y0gYpmKypp pic.twitter.com/yhSdUlItrv

— New York Post (@nypost) September 20, 2026

Iranian-born real estate broker Payam Shiravi spotted the message on Sept. 8 and said he was shocked to see people he knows from anti-regime protests were on the page.

“I couldn’t believe what I was seeing on the sign. I drove by a couple of times to make sure it was real,” he told The California Post. “It’s disturbing. People that I know, who I protest with, are on the website. It’s putting a target on these innocent people.”

Emel Karsaz, an Iranian-born critic of the regime, later found her name, photo, and personal details on the site and filed a report with the FBI’s Los Angeles field office on Sept. 9. She told the Post she panicked and no longer felt safe in America, especially after social-media threats aimed at her appearance.

Caltrans said it was not alerted to the unauthorized message until Sept. 15. Shiravi had already seen the board on Sept. 8. The agency told the contractor to restore the sign and said it is reviewing the message and access history. 

Goorkan, Persian for grave-digger, calls itself “a collective and patriotic effort to identify, introduce, and punish traitors” and anyone backing “hostile actions against the soil and people of Iran.” Crowdsourced dossiers. A punishment list.
This website which is linked to the… https://t.co/f3UpPoVWzn pic.twitter.com/DRq4uSuCwH

— Sana Ebrahimi Ledene (@SanaELedene) September 20, 2026

Embedded tweet continues: 

... Islamic Revolutionary Guards is clearly built with @claudeai. Another example of terrorists using @AnthropicAI for terrorizing citizens. A terror corps using an American-made product to mark citizens for punishment.

The FBI has warned that Iranian state cyber actors are targeting dissidents, activists, and journalists worldwide, but it would not confirm to the Post whether it is investigating this freeway hack.

The 405 incident is not isolated. In March, a separate breach hit LA Metro, knocking out rider-information and payment systems and exposing at least 700 GB of files. Israeli researchers later tied that intrusion to hackers linked to the Iranian state.

In June, an Iranian hacking crew separately claimed it had broken into water utilities that serve multiple California cities.

Who is actually behind the Caltrans sign hacking is still in question. Anyone could have promoted a website to create chaos. That doesn't necessarily mean the IRGC-backed site itself was responsible. Still, a California highway sign being used to advertise a regime burn list in the largest Iranian community outside Iran warrants serious investigation.

Editor's Note: Do you enjoy RedState's conservative reporting exposing the radical left and woke media? Support our work so we can keep bringing you the truth.

Join RedState VIP and use promo code FIGHT to receive 60% off your membership.