Flap said on X that its official website is currently affected by a DNS hijack and is redirecting users to an unauthorized site. The team told users not to visit the website, connect wallets, or sign any transactions for now, adding that it is handling the issue and will share an update once the site is confirmed safe.
Before the team statement, crypto user Liquidated (Dev Arc) wrote on X that flap.sh may have been compromised. The post said a suspicious address was stealing users’ BNB through a fake wallet connection page. KOL blue later said the incident may be real and shared several technical details that it said were suspicious.
According to blue, flap.sh was using a newly issued TLS certificate, while DNS resolution results differed from those returned by Google and Cloudflare resolvers. blue also said the DNS records pointed to what appeared to be an attacker-run spoofed site. After users connected their wallets, the page would show fake prompts such as 「Please retry」. blue added that the certificate was issued at 23:53:03 UTC, the server IP was 31.56.52.52, and the page was loading a static spoofed directory under flap.sh.
Flap said in a post on X that its official website is currently under a DNS hijack and is redirecting users to an unauthorized website. The team warned users not to access the site, connect wallets, or sign any transactions for now. It said it is working on the issue and will publish an update after confirming the website is safe.
Earlier, crypto user Liquidated (Dev Arc) said on X that flap.sh may have been compromised. The post said a suspicious address was stealing users’ BNB through a fake wallet connection page. KOL blue later said the incident may be real.
blue said flap.sh appeared to be using a newly issued TLS certificate. The DNS resolution results also differed from those returned by Google and Cloudflare resolvers, and the related DNS records pointed to what blue described as a spoofed site likely set up by an attacker. After a wallet was connected, the site would display fake prompts such as 「Please retry」.
blue also said the certificate was issued at 23:53:03 UTC, the server IP was 31.56.52.52, and the page was loading a static spoofed directory under flap.sh.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
