All Verified Nexus Onion Addresses

Understanding Nexus mirror architecture

Nexus runs four separate .onion addresses simultaneously. They share the same backend database, the same user accounts, and the same order history. The only difference between them is the entry point. Understanding how this works helps you troubleshoot connection issues and avoid falling for "mirror down" social engineering used by phishing operators.

Why multiple mirrors exist

DDoS attacks are a constant reality for darknet platforms. A single address is a single point of failure — one coordinated flood of traffic and the entire platform becomes unreachable for hours. Nexus addresses this with four mirrors that distribute incoming connections across separate Tor hidden service relays. When one mirror is hit hard enough to slow down, the others absorb the traffic. In practice, a sustained DDoS event degrades one entry point while the remaining three continue handling requests normally.

There's a secondary reason. Tor's hidden service infrastructure occasionally loses sync on specific circuits — a node failure in the rendezvous chain, not a platform issue. A mirror switch gives your Tor client a fresh circuit attempt, which resolves connection issues that have nothing to do with the platform itself. Don't debug for twenty minutes when switching the address solves it in thirty seconds.

How traffic is balanced

The four mirrors are not load-balanced in the traditional sense. There's no central router deciding which mirror receives your request. Each mirror is an independent Tor hidden service with its own descriptor. Your Tor client independently establishes a circuit to whichever address you paste in. Different users naturally connect to different mirrors based on which circuit their Tor node builds first — passive distribution that protects against volumetric attacks targeting a single descriptor.

When you copy a mirror link and paste it into Tor Browser, you get a fresh six-hop circuit to that specific hidden service. Circuit quality varies based on which Tor relays are in your path that session. A slow connection on mirror three might resolve instantly on mirror two — same platform, different circuit geometry. This is normal. Try the next address before concluding the platform is having issues.

When a mirror goes down

Don't wait. Close the connection, copy the next address from this page, and reconnect. Your account state is stored server-side — balances, active orders, and messages are identical across all four mirrors. Nothing resets when you switch. You're not losing a session.

If two or three mirrors simultaneously fail to load, check the Nexus announcement thread on Dread for admin updates. Large-scale outages are logged there within hours. Combined uptime since launch has held at 98.1% across all four nodes — simultaneous total failure is rare, and when it happens it's typically brief scheduled maintenance rather than a platform emergency.

How to verify a Nexus link is authentic

# Import admin public key (do this once)
gpg --import nexus_admin_pubkey.asc

# Verify the signed announcement file
gpg --verify signed-announcement.txt

# Valid output reads:
# Good signature from "Nexus Admin <admin@nexus>"

Anti-phishing field guide for Nexus users

The Nexus interface is the most commonly phished darknet marketplace design currently active. The hot pink and deep purple color scheme, the exact button placement, the cyberpunk font styling — all cloned with precision by scam operators and served on addresses that differ from the real ones by a single character. This guide tells you what to look for and what to do.

What phishing Nexus looks like

A well-made Nexus phishing page mirrors everything visible on first load. The color palette, CSS gradients, navigation structure, and element spacing are all copied. Vendors on Dread have reported clones so precise that experienced users were momentarily uncertain about which version they were looking at. Don't trust visual similarity.

Behavioral differences do exist. The real Nexus loads all styling before showing page content — no flash of unstyled elements. The Tor descriptor responds to a circuit handshake within 300ms on a normal connection. The font stack loads correctly from the specific sources the platform uses. Phishing pages often show brief layout shifts on load, slightly wrong font rendering, and occasionally fail to load the logo or specific decorative CSS components.

None of those behavioral signs are fully reliable. A well-resourced phishing operation replicates them too. The URL bar is the only check that actually matters.

Red flags to check before you log in

What to do if you suspect a phishing site

Close it immediately. Don't log in "just to check". Don't submit a test username and password to see what happens. If a phishing server captures your credentials, it doesn't need to tell you anything — it logs them silently and returns an error. You learn nothing; they get everything.

If you did submit credentials on a site you now suspect was phishing, assume those credentials are compromised. Use a verified mirror from this page to log in immediately and change your password. Change your PGP authentication key if you have one configured. Review recent order activity and flag anything you didn't initiate. Consider using a password manager like KeePassXC going forward — it stores credentials offline and auto-fills only on exact domain matches, which mechanically prevents submission on wrong-address pages.

For secure communications after a suspected compromise, use Signal or Proton Mail rather than channels that could be monitored. Report the phishing address on Dread so the community can flag it. The EFF and Privacy Guides publish operational security material that goes deeper into post-compromise steps.