contributionless[.]github[.]io

Analysis shows that contributionless[.]github[.]io is an active crypto drainer targeting WalletConnect users. The domain was registered on June 25 2025 and resolves to IP 185.199.109.153, an address owned by Fastly (AS54113) located in the United States. Hosting is provided through GitHub Pages and the site serves content over HTTPS with a Let’s Encrypt R12 certificate issued by Sectigo. Detected web technologies include Webflow, Varnish, Fastly, jsDelivr, jQuery and enforced HSTS. The page title returned by the server is “Meme Coin Landing Page - Webflow HTML website template,” and the site is currently returning HTTP 200. Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. Security telemetry flags the domain on two blocklists (PhishDestroy and ScamSniffer) and VirusTotal reports 2 of 95 scanners flagging it as malicious. The malicious kit is identified as a Wallet Connect abuse module, and the campaign impersonates the legitimate WalletConnect brand to lure victims into authorising unauthorized cryptocurrency transactions. No additional content analysis is available beyond the page title, so the exact phishing flow remains unconfirmed. Defenders should immediately block the domain at the DNS and proxy layers, add the IP address to network‑level deny lists, and ensure that endpoint detection rules include the Wallet Connect abuse indicator. Users should be warned not to interact with any WalletConnect prompts originating from this domain, and any compromised credentials or wallet authorisations should be revoked. Continuous monitoring for similar GitHub‑Pages‑hosted domains employing Webflow templates is recommended to catch future iterations of this threat.