support-metamasks-learm[.]pages[.]dev

Analysis of support-metamasks-learm.pages.dev shows a newly registered infrastructure designed to impersonate MetaMask for wallet/seed phishing. The domain was created on 15 Oct 2025 and is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution returns the IPv6 address 2606:4700:310c::ac42:2f74 and the authoritative nameservers are desiree.ns.cloudflare.com and tim.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services (WE1), indicating a valid HTTPS configuration, and Cloudflare’s security features such as HSTS and HTTP/3 are enabled. An HTTP request receives a 403 response and the page title returned by Cloudflare reads “Suspected phishing site | Cloudflare”, confirming that the service has already been flagged by the provider.

Security‑vendor scanning on VirusTotal records 14 positive detections out of 95 scanners, and the domain appears on a single external blocklist. Gridinsoft assigns a trust score of 0/100, and PhishDestroy has listed the domain as blocked. The listed scam category is “Wallet/Seed Phishing”, and the brand target is explicitly MetaMask, indicating that the content likely attempts to harvest private keys or recovery phrases. No additional evidence such as page screenshots or content analysis is available in the current intelligence set.

Defenders should immediately block the domain at perimeter firewalls, DNS resolvers, and proxy devices. Because the domain resolves to a Cloudflare address, any future re‑hosting on the same IP range could inherit the same reputation; therefore, monitoring for new subdomains under the same registrar or similar naming patterns is advised. Adding the IPv6 address 2606:4700:310c::ac42:2f74 to threat‑intel feeds and ensuring endpoint protection solutions ingest the VirusTotal detection count will help catch residual traffic.