The address itself
Fake Nexus URLs match the first eight to twelve characters of a real address. Generating a matching prefix that long takes a few hours of GPU time. Matching all 56 characters takes centuries. So the check is: compare the entire URL, letter by letter, against a source you already trust. Every character matters.
The captcha image test
The Nexus login captcha carries the current onion URL along its bottom edge. That text is baked into the image on the operator's server, not by anything between you and the shop. Solve the captcha and, while you look at the image, compare the URL on the picture with the URL in your address bar. They must match. If they differ, that mirror is fake.
A handful of phishing setups now paint the fake address into their own captcha to pass this test. The counter is that the captcha URL must also match the address in the last PGP-signed rotation. Both should agree.
Missing anti-DDoS queue
Nexus puts a queue in front of every login. It shows a rolling counter and takes anywhere from ten seconds to a couple of minutes to clear. Phishing mirrors usually skip the queue because building one is complicated. If a mirror sends you straight to the login without a wait, that is a strong signal.
Some clones now show a fake queue that always clears in one second. Real queues behave like queues: variable, sometimes slow, sometimes quick.
Search results are dangerous
Someone types "nexus market" into a search engine. The top result is a page claiming to be a directory. That page redirects the click to a phishing onion. This is the single most common way buyers get robbed in 2026. Reliable directories publish the same primary URL the market itself signs, for months. Fresh listing sites ranking well for market queries are almost always affiliate phishing.
Bookmarks go stale
The other common way to get phished is by clicking an old bookmark. You bookmarked a working URL in March. It rotated in May. Someone bought the old mirror in July. You are still clicking your March bookmark in September. Every session, glance at the address bar and confirm against the current signed rotation. Two seconds. Habit that saves accounts.
Small tells
- Real markets refresh the captcha image on every load. Fake ones serve the same image every time.
- Real markets show fresh balance, prices and order counts after login. Fake ones show static numbers because they only ever expected to catch your password.
- If your open orders are missing after login, that alone is enough to log out and re-verify the URL.
When you are unsure
Close the tab. Open Tor Browser with New Identity. Go to a source you already trust for the current URL. Verify the PGP signature. Copy the URL from there. Paste into a fresh tab. If it looks like what you closed a minute ago, you were fine. If it looks slightly different, you just dodged a phishing page.
Nobody has ever regretted checking one extra time. Plenty of people have regretted skipping it once.