Anti-Phishing Safety Guide

Phishing is the single most successful attack vector against darknet market users. Attackers create near-perfect replicas of real markets at similar-looking .onion addresses. When a user logs in, their credentials are stolen. When they deposit cryptocurrency, it is stolen. The covenant is broken not by Tor being compromised, but by the user entering the wrong door.

How Phishing Sites Operate

Phishing .onion sites are built to visually replicate a legitimate market down to pixel-level detail. They are distributed through:

• Reddit posts and clearnet forums claiming to list official links
• Telegram channels advertising "updated mirrors"
• Compromised link aggregator pages
• SEO-optimised clearnet pages appearing in search results
• Spam messages on darknet forums with "verified" links

The attackers may invest in making the fake look perfect — correct logos, working search, fake listings. The trap is triggered at login or deposit. Once credentials are captured, attackers may also relay your session to the real market to avoid immediate detection.

How to Verify a Nexus Onion Address

Method 1 — Character-by-Character Comparison

v3 .onion addresses are 56 characters long. Each character matters. Phishing domains substitute visually similar characters — lowercase L versus number 1, letter O versus number 0, or use entirely different hashes that look similar at a glance.

Compare the address you have against the verified links on the Enter page before logging in. Do this comparison every single session.

Method 2 — PGP Signature Verification

Legitimate market administrators publish signed announcements. A phishing site operator does not have the market's private key. Any announcement that cannot be verified against the known public key is either fake or from a compromised administrator.

1. Obtain the market PGP public key from the Enter page
2. Import it into GnuPG: gpg --import nexus_key.asc
3. Download the signed market announcement
4. Verify: gpg --verify announcement.asc
5. Only proceed if you see "Good signature" with the correct key fingerprint

Method 3 — Bookmarks Only

Navigate to Nexus exclusively through a bookmark saved in Tor Browser from a previously verified session. Never follow links from forums, Telegram, or search results. Every click-through is a potential redirect to a phishing site.

Red Flags That Indicate a Phishing Site

• Clearnet accessible: Real darknet markets cannot be accessed through standard browsers. A site claiming to be Nexus accessible on .com or .net is always a phishing site.
• Forced JavaScript: Real Nexus serves a functional no-JS interface. A site that demands JavaScript enabled to proceed is suspicious — JS exploits are a common attack vector.
• Unusual login flow: If the login page asks for information it should not need, or presents a CAPTCHA format different from the real market, treat as a fake.
• Mismatched PGP key: Any site presenting a different PGP key than the one you verified independently is either a fake or has been compromised.
• Urgent deposit prompts: "Your account will be suspended unless you deposit immediately" is a classic social engineering pressure tactic used by phishing operators.
• Different deposit address format: Deposit addresses for each coin follow known format conventions. A malformed address or request to send to an address not generated by the platform is theft.
• Source from forum or Telegram: If the link came from any channel other than your own verified bookmark, its provenance is unverified.

Account Security Practices

Password Hygiene

• Use a unique 20+ character password generated by KeePassXC (offline, open source)
• Never reuse passwords between platforms
• Store passwords only in an encrypted offline password manager
• Do not save passwords in browser — Tor Browser's auto-fill increases risk

2FA via PGP Challenge-Response

The Nexus Marketplace supports two-factor authentication through PGP challenge-response. At login, the platform encrypts a random challenge string to your registered PGP public key. You decrypt it and submit the result. Only someone with the private key can complete this — an attacker with only your password cannot log in.