Flap's Website Hit by DNS Hijacking Attack
Flap's official website was compromised in a DNS hijacking attack, redirecting users to a malicious site. Users were tricked into signing transactions that could drain their assets.
Flap, a modular token launch platform, experienced a DNS hijacking attack that redirected users from its official website flap.sh to a malicious clone site. The attackers gained control at the domain registrar level and pointed the DNS to a server in the Netherlands. They deployed the StepDrainer wallet-drainer toolkit, which was designed to trick users into signing harmful transactions.
When users visited the compromised site and connected their wallets, they were misled into granting unlimited approvals for transactions, which allowed the attackers to drain assets from their wallets. In response to the incident, the Flap team issued warnings to users, advising them not to visit the hijacked site, connect their wallets, or sign any transactions.
To mitigate the impact of the attack, the Flap team migrated to a new domain, flap.cool, to ensure the safety of their users. The incident highlights the risks associated with domain security and the potential for significant user loss when such attacks occur.