aimmarket[.]org

PhishDestroy identifies aimmarket.org as a confirmed cryptocurrency credential theft domain actively distributing a phishing kit designed to steal wallet logins and private keys. This malicious site impersonates legitimate cryptocurrency platforms to deceive users into entering sensitive authentication credentials, which are then harvested by attackers for fund drainage and account takeover. The threat operates under the guise of a market service, exploiting user trust in recognizable crypto infrastructure.

This domain was flagged on December 20, 2025, with VirusTotal reporting a detection rate of 1 vendor out of 95 scanning engines. The domain was registered on December 18, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 172.67.221.5. An SSL certificate issued by Google Trust Services lends false legitimacy, while the recent creation date suggests opportunistic registration in the holiday season to target distracted users. The low detection rate highlights how rapidly emerging threats can evade initial screening.

If you visited aimmarket.org, immediately disconnect from the internet and isolate any connected cryptocurrency wallets. Do not enter credentials or download files from this domain. Scan your device with updated antivirus software and revoke any permissions granted to crypto wallet extensions or browser profiles linked to this site. Report the incident to your wallet provider, change all passwords stored in browser profiles, and consider transferring remaining assets to a newly generated wallet with enhanced security settings. Monitor blockchain transactions for unauthorized transfers and report suspicious activity to relevant authorities.