# schoolproject-997.pages.dev — SUSPICIOUS

> schoolproject-997.pages.dev hosts a credential phishing page. VirusTotal flags 1/95 vendors. Review the full report now.

## Summary
PhishDestroy identifies schoolproject-997.pages.dev as an active credential-phishing domain that is luring users into submitting login credentials under the guise of a school project portal. The site masquerades as a legitimate educational resource while harvesting usernames and passwords that are later weaponized in follow-on identity theft and account takeover campaigns. Because student and faculty accounts often grant access to sensitive systems and data, compromise of these credentials can ripple across entire school networks, enabling lateral movement by attackers seeking grades, research data, or financial aid information. Users who arrive at the page are immediately prompted for email addresses and passwords, with no multi-factor authentication or institutional verification in place.

This domain was flagged by 1 out of 95 VirusTotal security vendors within hours of its first appearance. It was registered through Cloudflare, Inc. and resolves to IP 188.114.96.3 under a Google Trust Services SSL certificate. The site’s youthful infrastructure (days-old pages.dev namespace) and the high-risk combination of free hosting plus third-party TLS certificates are classic indicators used by fast-turn credential phishing operators to bypass traditional security controls while maintaining a veneer of legitimacy.

If you visited schoolproject-997.pages.dev and entered any credentials, change those passwords immediately and enable multi-factor authentication wherever possible. Report the incident to your institution’s IT security team so they can revoke any exposed sessions and scan for lateral movement. Avoid clicking links in unexpected emails or messages referencing school projects; always navigate directly to official institutional portals via verified bookmarks or hand-typed URLs. Institutions should block the domain at DNS and proxy layers, flag the IP range 188.114.96.0/24, and investigate any subsequent account takeovers to contain potential breaches.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/322dcdc8-ab4f-4b9d-8197-e66877cd681c
- PhishDestroy: https://phishdestroy.io/domain/schoolproject-997.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/schoolproject-997.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/schoolproject-997.pages.dev/
Last updated: 2026-03-22