Mars Market Link: How to Confirm the Real Address

Mars Market onion address and how to check it

Mars publishes a signed list of its mirrors, and directories repost it. Two of the addresses on it are below. Use them as the starting point for the check, not as proof that they are real.

marszlnmgxdissemdlbs7wlogkjhutvgxlkqjtjxiz2iqybk24mseoyd.onion
marsqgosmtr4oj7wbyuc2b7jxsk32fq4vha3ft3e7v2jvq3eccm7lcqd.onion

1. Get Mars's PGP public key from somewhere other than the page that gave you the address: the market's own Dread presence, or a second directory you already trust. If one site hands you both the address and the key to check it with, you have verified nothing.
2. Compare the full fingerprint with a second copy. Matching the first eight characters proves nothing about the rest. PGP on the dark web shows the comparison and the gpg --verify command for the signed list.
3. Open only an address that appears on that list, in a verified copy of Tor Browser. An address from a DM, a comment or a "support" account is not on the list, however official it looks.

A valid signature means the list came from whoever holds the key. It doesn't prove the key belongs to Mars's operators and not to a phishing crew, which is why the key has to come from an independent source. One wrong character gives you a different site, because an onion address is a public key, not a name (how onion services work).

Reviews also say Mars runs on I2P next to Tor. The same rule applies there: an I2P address counts only if the signed list names it.

Why the anti-phishing screen doesn't protect you

After the captcha, Mars shows an Anti-Phishing page. It prints the market's address with six characters replaced by asterisks and asks you to type the missing six. In the screenshot, the full address is printed again in the instruction line right underneath, with nothing hidden. You can copy the answer straight from the page.

A clone can do the same thing. It prints its own address, hides any six characters, and accepts the answer, so the prompt can't tell a fake from the real site. It only stops someone who never looks at the address bar. Treat it as a reminder, and rely on the signed list for the actual check.

What Mars Market is and how big it really is

Mars launched in mid-2024, when several bigger markets had gone down and their users needed somewhere to move. It calls itself a drug-focused market that is easy to use, and the welcome text addresses users as "the Martians Community". It works on a phone through Tor Browser, which the market advertises.

Directory write-ups from October 2026 put it at about 5,000 users, 500 vendors, 5,000 listings and a commission near 5%. Those are the market's own kind of numbers. Nobody outside a market can check its counters, and the directories repeating them usually don't say where they got them. Even if they are right, Mars is small next to TorZon, which Chainalysis and Europol both describe as the dominant Western market after the 2025 collapses. A smaller catalogue means a lower chance of finding a specific product or a vendor that ships to your country.

Login, 2FA and PGP on Mars

Several reviews say Mars has a PGP-secured login. The login page shows a plain form instead: username, password, a "Forgot your password?" link, and a captcha that asks you to click the least repeated icon in a row of small drawings. The captcha image also prints the first and last characters of the mirror you are on.

PGP is still part of Mars. Messages to vendors are expected to be encrypted, and the market supports TOTP two-factor through an app like Google Authenticator or Authy. Turn 2FA on, but know its limit: a fake site can ask for your six-digit code and pass it to the real market in real time. The code only helps if you were on the right address in the first place, which is why the signature check comes before you type anything.

If you have never encrypted a message, the PGP guide covers generating a key and encrypting a shipping address, which most orders need.

Paying in Bitcoin: what the automatic XMR conversion changes

This is Mars's main selling point. If you pay in Bitcoin, the market generates a deposit address through an outside exchange service, the service converts the incoming Bitcoin to Monero, and the vendor is paid in XMR. If you hold Bitcoin and have never used Monero, you skip a step.

Your Bitcoin payment is still public, though. The deposit is an ordinary transfer on a permanent ledger, from your wallet to an address an analytics firm can tie to an exchange service. Monero's privacy starts after the swap and does nothing for the payment before it.^{getmonero.org} You also take on three costs: the rate can move between your payment and the conversion, an outside service now sits inside your order and can delay or hold it, and you don't control what it logs.

The better route is to hold Monero before you deposit. If you only have Bitcoin, convert it yourself well ahead of time so the two steps aren't close together. The Monero guide covers where to buy it now that regulated exchanges have delisted it, and cryptocurrency privacy shows what anyone can read from a Bitcoin address.

Escrow: 2-of-3 multisig and the deposit balance

Orders use 2-of-3 multisig. The buyer, the vendor and the market each hold a key, and funds move only when two of them agree. The operators can't empty an order by themselves, which is better than the single-custody escrow most markets run.

Mars also keeps a normal deposit wallet: you fund a balance first and spend from it, the opposite of the per-order addresses on DrugHub. Multisig protects money locked in an order. It doesn't protect a balance sitting on the market between orders, and that balance is what the operators can freeze or take. DarkMatter offered optional multisig too, and its users' resting balances still went down with it in September 2026. Nexus followed the next month. Exit scams covers how both played out. Fund an order when you place it and leave nothing else on the market.

What Mars sells and what vendor checks cover

The catalogue is narrow on purpose: cannabis, stimulants, psychedelics, dissociatives, opioids and prescription medication. It is aimed mostly at buyers in Europe and the CIS, and English and Russian are among the supported languages. The market has built-in guides for PGP, Monero and Tor, plus some harm-reduction material.

Vendors are described as verified before they can sell, with ratings, reviews and test purchases behind them. That keeps out throwaway accounts that list a few cheap items and vanish within a day. It doesn't stop a verified vendor from going quiet months later, and it does nothing about the operators. A market this small also has fewer orders behind each rating, so a high score tells you less than the same score on a bigger market.

Where Mars is weak, and what to do about it

It's young. Mars has run since mid-2024, much less time than the markets whose exits have already shown buyers the pattern, and it hasn't been through a seizure, a long DDoS campaign or a wave of vendor scams. The Bitcoin conversion adds an outside service that can fail on its own. The deposit wallet is custodial. And the multisig covers exactly the money a careful buyer wouldn't leave sitting there anyway.

All of that is normal for this niche. In practice: keep your balance small, place a small test order before a big one, and never finalize early with a vendor you have no history on. Europol's 2026 assessment describes the post-2025 shift toward smaller, more specialised markets with shorter lifespans, which is the group Mars belongs to.^{Europol IOCTA 2026}