app-new[.]flow[.]devx[.]minutodao[.]com

This domain is flagged for hosting a crypto drainer phishing operation targeting users of MinutoDAO, a decentralized finance platform. Analysis indicates the infrastructure is designed to siphon cryptocurrency assets by tricking victims into connecting wallets to malicious smart contracts. The threat level is elevated due to the direct financial impact and the sophistication of the attack vector. Infrastructure analysis reveals the domain was registered on March 30, 2026, through GoDaddy.com, LLC, and resolves to the IP address 159.65.15.245. The site is detected by 15 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, and the site employs technologies including Node.js, React, Next.js, Google Tag Manager, Google Analytics, Cloudflare Browser Insights, Cloudflare, and Webpack. The page title explicitly references MinutoDAO, reinforcing the impersonation theme. Mitigation steps for users and organizations include immediately revoking any wallet connections to the domain, verifying transaction histories for unauthorized transfers, and reporting the incident to relevant blockchain explorers for blacklisting. Network-level protections should block the domain and its resolving IP address. Users should enable transaction simulation tools to preview smart contract interactions before execution. Organizations managing decentralized platforms should monitor for similar impersonation domains and implement DNS-based protections to prevent access to known malicious infrastructure.