Odaily Planet Daily reports that Flap posted on X that its official website is currently experiencing a DNS hijacking and being redirected to an unauthorized site. The team advises users not to visit the official website, connect their wallets, or sign any transactions, and states that they are actively addressing the issue and will release an update once website security is confirmed.
Previously, crypto user Liquidated (Dev Arc) posted on X stating that flap.sh may have been compromised and disclosed the address 0x24497068cA4166ca32a04ae530ce00Cf79755bD5, claiming it stole users' BNB via a forged wallet connection page. Subsequently, KOL blue further indicated that the incident may be legitimate, noting that flap.sh was using a newly issued TLS certificate, with DNS resolution results inconsistent with those from Google and Cloudflare resolvers, and that the associated DNS pointed to a counterfeit website allegedly set up by the attacker. This site displayed misleading prompts such as “Please try again” after users connected their wallets. Blue also noted that the certificate was issued at 23:53:03 UTC, the server IP is 31.56.52.52, and the page loads a static counterfeit directory under flap.sh.