anvil[.]org[.]ph

The domain anvil.org.ph has been identified as an active brand‑impersonation site targeting Facebook. The site’s page title is "Anvil Business Club - Home," and it is classified under the social_media scam type. Threat intelligence indicates that the domain is deliberately registered through Cloudflare, Inc., and its hosting resolves to the IP address 104.21.49.209, which belongs to the Cloudflare network in the United States.

Infrastructure analysis shows the web server returns HTTP 200 and presents a valid SSL certificate issued by Google Trust Services under the WE1 designation. The DNS configuration uses the Cloudflare nameservers jeff.ns.cloudflare.com and khloe.ns.cloudflare.com. Mail exchange is routed through Google’s mail service (aspmx.l.google.com with priority 1 and alt1.as...). The site stack includes Joomla, PHP, MooTools, OWL Carousel, MailChimp, jQuery Migrate, and jQuery, all visible in the technology fingerprint.

Reputation signals are strongly negative. VirusTotal records nine detections out of ninety‑five scanning engines. The domain is blocked by PhishDestroy and CryptoFirewall, appears on two security blocklists, and receives a Gridinsoft trust score of zero out of one hundred. These indicators, combined with the confirmed Facebook impersonation tag, elevate the risk to high.

Defenders should block network traffic to 104.21.49.209 and add anvil.org.ph to domain‑level deny lists. Email gateways should monitor for outbound messages using the listed MX records and enforce strict DMARC verification for any mail claiming to originate from the domain. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is advised, and any internal users receiving communications referencing "Anvil Business Club" should be instructed to report them as potential social‑media credential harvesting attempts.