Nexus market mirrors, as published on this site
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionnexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onionnexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onionPublished as supplied. This site does not probe an onion, so nothing here is a claim that a given address opens for you right now.
A failed nexus market login is a small event on the right onion and a bigger one on the wrong onion. The difference is on the error message and the address bar, not on the reader.
What it is
A login attempt fails when the form the reader submitted comes back with an error or with the same form empty. On the real nexus market that error text has a shape the signal card for language of error messages spells out. On a lookalike the error text has a different shape, and the second attempt is where the lookalike wins.
This card is about the pause between the first failure and the second attempt. What to check first, what not to reuse, and what to stop doing.
Lifeline
- Form filled and submitted
- Error message on screen
- Retry on the right onion, or stop
What the failure could mean
- The captcha timed out. Real captchas do not hurry, and a slow reader is a common reason for a bounce on the real login page.
- A character in the username or password was mistyped. This is the ordinary case.
- The circuit is slow and the submit did not reach the service. A rebuild fixes this.
- The onion in the address bar is not the market. A wrong login page that also returns a failure is the trap that has cost money.
What to do before the second attempt
- Read the address bar
- Compare the string block against a trusted line on the panel above. A retry on the wrong onion pastes the same credentials into the same wrong form.
- Read the error text
- The signal card for language of error messages describes the shape the real login uses. If the text on the page does not match, the page in front of the reader is not the market.
- Do not reuse the second factor token
- A token that was fed to a wrong page is spent. Wait for the next token and use it on the right onion.
- Do not paste the password again yet
- A password pasted twice on a wrong page is not twice as bad, but the second paste is not a fix.
A small next check
- Copy the onion string in the address bar and cross it against a trusted line on the panel above.
- If the strings match, wait a moment and retry the login carefully.
- If the strings do not match, close the tab. Do not enter the credentials again.
- Change the password from a session that opened on a trusted string.
How a real error text tends to read
The signal card for language of error messages carries the details, and this paragraph is only the shape. A real login error tends to be short, plain, without a marketing header, without a picture, and without any suggestion the reader is about to be locked out on a timer that is not really running. If the message on the page is loud, coloured, urgent or asks the reader to click through to a support form on a different domain, the language of that message is not the language the real page uses.
That is a signal to read alongside the address bar, not to trust on its own. A real page can be having a bad day too, and a lookalike can copy the language of a real page well enough on the first read. Two signals in agreement is better than one.
How to test one thing at a time
- Address bar first
- A retry is only worth attempting on a string that is on the panel above. Everything else is a follow up.
- Second factor second
- A token that has already been submitted is spent. Wait for the next one and use it on the retry, not immediately.
- Captcha third
- If the retry lands on a fresh captcha, take the time. Captchas on the real login do not hurry.
- Password last
- If the string in the bar is on the panel and the reader is confident it is not a mistyped credential, a change of password from a fresh session is a small ordinary hygiene step. It is not an admission the reader was phished.
What to do in the next few minutes
- Do not retry immediately. A retry against a wrong page is another attempt against a wrong page.
- Read the address bar block by block against the panel above.
- Read the error text and cross it against the signal card for language of error messages.
- Wait for the next second factor cycle before submitting anything else.
- If the address bar and the error text both look right, retry the login with care.
- If either the address bar or the error text does not look right, close the tab and open a fresh session from a trusted source.
Engagement
What this card does not say
- It does not say the login page is fake. That is on the trap and signal cards.
- It does not offer a script that automates retries.
- It does not name any account or any handle.
- It does not carry a template for what a real error text reads like word for word.