Flap.sh's DNS was hijacked by StepDrainer, a wallet-drainer toolkit linked to phishing attacks on Kintsu and Stonkbrokers.