mars-market[.]wiki

This domain, mars-market.wiki, has been assessed at an elevated risk level due to its clear impersonation of the Mars Market brand. The site masquerades as the official Mars Market link for 2026, likely aiming to harvest credentials or cryptocurrency from unsuspecting users. PhishDestroy identified this threat as a classic brand impersonation phishing campaign, leveraging the trust associated with the Mars Market name to deceive victims.

Technical indicators paint a concerning picture. The domain was created on May 18, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar not commonly associated with legitimate market sites. It resolves to IP address 176.116.0.24 and uses an SSL certificate from Let's Encrypt (R12), which provides encryption but does not verify legitimacy. VirusTotal shows 1 out of 95 security vendors flagging the domain, and it appears on one security blocklist. AlienVault OTX includes it in a single threat intelligence pulse, confirming its malicious nature. The site is currently offline, but the threat remains active as similar domains may still be operational.

To mitigate this threat, organizations should block the domain mars-market.wiki and its associated IP at the network perimeter. Users should be warned against interacting with any links or emails referencing Mars Market, and credentials used on similar sites should be changed immediately. PhishDestroy recommends deploying email security filters to catch phishing attempts and conducting user awareness training focused on brand impersonation tactics. Continuous monitoring for related domains is advised, as threat actors often register multiple variations after a takedown.