# avagray-offers.pages.dev — SUSPICIOUS

> avagray-offers.pages.dev is a crypto drainer impersonating AvaGray. Avoid this domain—verify links on PhishDestroy immediately to confirm safety.

## Summary
PhishDestroy identifies avagray-offers.pages.dev as an active crypto drainer campaign hosted on Cloudflare Pages. The domain mimics AvaGray, a legitimate financial services brand, and is designed to trick users into connecting cryptocurrency wallets under the guise of promotional offers. No specific drainer kit signature is publicly available, but behavioral analysis suggests automated fund extraction post-wallet connection.  

This domain was flagged with a 0/95 detection ratio on VirusTotal and resolves to IP 188.114.97.3. It is registered through Cloudflare, Inc., and secured with a Google Trust Services SSL certificate. The domain is newly created and not yet blocklisted on major threat databases, including Google Safe Browsing (GSB). As of now, no prior abuse reports link to this infrastructure, indicating a fresh deployment targeting unsuspecting users.  

The campaign is active and spreading via unverified social media promotions and phishing emails. PhishDestroy has flagged this domain for immediate user caution, though it remains unblocked by major security vendors. Users are advised to verify any links referencing AvaGray or promotional offers through PhishDestroy’s real-time scanner. Remaining risk is moderate due to low detection coverage and active hosting on reputable CDN infrastructure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1d8d7b4a-1240-4daf-b724-72b2dafb9867
- PhishDestroy: https://phishdestroy.io/domain/avagray-offers.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/avagray-offers.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/avagray-offers.pages.dev/
Last updated: 2026-03-22