Anthony Julien

Is this alert nothing, or the start of something.

A working notebook of security writeups, findings, and the occasional public-interest note.

About

I got into this field the practical way: fixing infrastructure first, watching it get attacked second. That order still shapes how I work. Before I trust a dashboard, I want to know what's actually generating the data behind it.

Day to day, that means log analysis, tuning detection rules so they catch real threats instead of drowning in noise, and the slower, less exciting work of closing the gaps that let something in before it becomes a headline. None of it is dramatic. Most good security work isn't.

I'm based in Lebanon. This site exists mostly so the writeups have somewhere to live, not to make a case for anything.

Writeups

September 2026, Public notice

isf.govlb.cam is not the Internal Security Forces

Over the past few days, a fake website impersonating Lebanon's Internal Security Forces (ISF) has been circulating via email and SMS. It tells recipients they have an outstanding traffic violation and directs them to pay a fine through a link. The site is not affiliated with the ISF in any way, and no payment information should ever be entered there.

The real domain vs. the fake one

The genuine ISF website is isf.gov.lb. The fraudulent site uses isf.govlb.cam. Two differences are built to be easy to miss at a glance.

Official
isf.gov.lb
Fraudulent
isf.govlb.cam

The official .gov.lb structure is collapsed into a single fake-looking word, govlb, and the domain ends in .cam rather than .com or .lb. Visiting the bare domain loads nothing. The scam only works through the specific link sent in the phishing message (isf.govlb.cam/traffic-tickets), which is typical of phishing infrastructure: built to be reached only through the message, not browsed to directly.

What the fake page actually shows

The page mimics an official traffic-violation lookup: a plate number field, a fabricated "speed limit infringement" notice citing a real-sounding Lebanese traffic law, a detailed fine breakdown, and a time-pressured "50% discount if paid within 7 days." It's a classic urgency tactic meant to push a quick payment before anyone stops to check whether the site is real.

The page's input handling is also a giveaway of how thin the site actually is: entering an obviously invalid plate number still returns a "verified" result and a generated fine. A real government lookup system checks input against actual records; this one appears to accept anything.

What to do if you received this

  • Don't click the link. If you already did, don't enter any information on the page.
  • If you entered payment or personal information, contact your bank immediately and monitor your accounts.
  • Verify any traffic-violation claim only through isf.gov.lb directly, never through a link in an email or SMS.
  • Report the message through the ISF's Balligh platform.

Contact

Get in touch if something here is useful, wrong, or worth discussing further.