rallymonsters[.]com

Rallymonsters.com has been identified actively impersonating the Base blockchain ecosystem to distribute a fraudulent online crypto casino. This domain leverages Base’s brand recognition to deceive users into believing they are accessing a legitimate blockchain-based gaming platform. The threat actors behind this campaign are attempting to harvest cryptocurrency deposits or harvest credentials under the guise of a ‘popular online casino based on blockchain technology.’ Users tricked by the Base branding may unknowingly expose themselves to financial fraud or credential theft, as the site’s interface closely mimics legitimate Base-associated services. The malicious infrastructure is designed to exploit trust in established blockchain brands to maximize victim engagement and illicit gains. Evidence collected by PhishDestroy confirms multiple red flags associated with this domain. VirusTotal analysis reveals that 3 out of 95 security vendors have flagged rallymonsters.com as malicious, indicating limited but present detection across the security community. The domain was registered on September 4, 2025, through Web Commerce Communications Limited dba WebNic.cc, a registrar known for both legitimate and high-risk domain registrations. The site resolves to IP address 188.114.97.3, hosted on infrastructure historically associated with suspicious activities. Additionally, the domain operates with an SSL certificate issued by Google Trust Services, which may lend it a false sense of legitimacy to unsuspecting users. Notably, this domain has not yet been widely included in major threat intelligence feeds, increasing the risk of delayed detection by end users and organizations. Users who have visited rallymonsters.com should immediately cease any interaction with the site and avoid entering personal information, wallet credentials, or cryptocurrency deposits. If credentials were entered, they should be rotated immediately and monitored for unauthorized access. Organizations should block this domain at the network level and inspect DNS logs for any internal resolution attempts. Given the active status and elevated risk classification, this domain poses a credible threat to individuals and entities associated with the Base blockchain ecosystem. Proactive blocking and user awareness campaigns are strongly recommended to prevent further compromise.