Spotting a fake Nexus Market
Most of the damage around Nexus Market does not come from the market. It comes from pages that look like the Nexus Market site and are not. A good clone takes an hour to build and costs almost nothing.
nexusb2l7jnnbmofyik5fqdemwg6inbg4e3i2pi75uewuw34zwvx2ryd.onionnexusma2iekjhhyenua3u4zlyfsj2ubwxr2nt6gdte5rvwukzze63fyd.onionnexusabcdrstn74osnr67fsbzbo44kjpxqbbz5ymcwhlxjg6dloyhoyd.onion
The three standard plays
The lookalike address
One character swapped, or a matching prefix with a random tail. Vanity prefixes are cheap to generate, so a matching beginning is not proof of anything. The check is the full 56 characters, not the first ten.
The maintenance page
A clone that announces the real site is under maintenance and asks you to confirm your 2FA code or password to keep your balance. The market does not run maintenance by way of a stranger’s page.
The forwarded link
Someone in a chat, a forum thread or a comment section sends you “the current nexus market link.” If you did not copy it from a source you already trust, open the market from your own saved address and treat the forwarded link as a test subject.
What a fake usually gets wrong
- The address does not start with
nexus, or it ends in something that is not.onion. - You reached it through a clearnet proxy domain instead of Tor Browser.
- It asks for your 2FA code before the password, or asks for the password twice.
- There are ads, a newsletter box, or a “verify your account” form. The market has none of these.
- The address printed in the page does not match the address bar.
You already typed something
Change the password from a verified address, one you compared character for character. Reissue the 2FA key. If a deposit went out while you were on the clone, the money moved to an address the clone controlled, and the market’s dispute process only covers orders placed on the market.