False-positive "dApp may be malicious" block — gotcha.fun (legit Solana P2E game)

[Jul1usCrypto]

Hi Phantom / Blowfish team,

gotcha.fun is being blocked with "This dApp could be malicious." We believe this is a false positive and would appreciate a review for delisting.

What it is: GOTCHA — a browser Pokémon catch-to-earn game on Solana. Players play a real Pokémon game in the browser, catch Pokémon to earn our SPL token $GOTCHA (paid out via a server after a signed-nonce claim), and can mint their catches as Metaplex NFTs. Currently on devnet; mainnet launch upcoming.

On-chain behavior (all standard, nothing obfuscated):

Connect + signMessage for one-time nonce auth (no funds moved).
SPL token transfers — the treasury pays out $GOTCHA rewards; the player pays a mint fee in $GOTCHA via signAndSendTransaction (the model Blowfish recommends).
Metaplex createNft for the collectible.
No drainers, no setAuthority, no hidden/unlimited approvals, no sweeping assets out of the user's wallet. The only outflow a user ever signs is the explicit mint payment they choose to make.
Likely cause: brand-new domain with no reputation/history — not behavior. Happy to share source, the token mint + program addresses, and verify domain ownership however you need.

Domain: gotcha.fun
X: @gotchadotfun
Contact: jul1us4crypto@gmail.com or connect@gotcha.fun
Could you review and remove the warning? We're glad to make any change Blowfish recommends. Thank you!

[Jul1usCrypto]

kindly review gotcha.fun thanks!

[Jul1usCrypto]

@moimikey @rawfalafel @JGuo gents?

[Th3Ya0vi]

Hi @Jul1usCrypto,
Thanks for reaching out. Since your domain is brand new, it automatically triggers our automated security filters to protect users from potential exploits.

To get this reviewed and cleared by our Trust & Safety team, please follow the steps outlined in our Domain and Transaction Warnings Guide https://docs.phantom.com/developer-powertools/domain-and-transaction-warnings

The team will review your submission and update the domain status as soon as possible. Thank you for your patience!