Nexus market mirrors, as published on this site
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionnexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onionnexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onionPublished as supplied. This site does not probe an onion, so nothing here is a claim that a given address opens for you right now.
This is the dossier for the nexus market mirrors trap where a short clearnet domain calls itself a mirror of an onion, and the reader who follows it lands on a page it does not own.
What it is
A nexus market mirror is an onion address. It is not a clearnet domain. A clearnet domain that offers to mirror an onion address is offering a proxy, an aggregator, a copy or a phish, and the reader has no way of telling which one it is from the domain name alone. The trap is that a short clearnet domain reads as convenient, and convenience is what the reader wanted when they searched for a mirror.
The domain often looks familiar. A short run of letters that spell part of the market name, a top level suffix that sounds credible, a landing page that lists three or four onions with copy buttons. The layout of the landing page can be lifted from any handbook style site. The address in the browser bar is the only place where the reader can see that the page they are reading is not on the tor network at all.
Where these domains come from
A search for the phrase nexus market mirrors picks them up. So does a search for a mirror list, a status page or a link directory. The domains are cheap to register and easy to move. The page they serve can look like any of the sites in this fleet, with the same three onion strings copied off a source, or with three that are close but wrong.
Reader habit is the second origin. A reader who has used a short clearnet domain to reach an onion before, for one reason or another, learns the habit. The habit stops noticing the difference between an onion on the tor network and a clearnet page that says it hosts an onion.
Lifeline
- A search for a nexus market mirror
- A clearnet page in the browser bar
- A copy from the onion itself
How to catch it
The catch is the address bar of the browser. A nexus market mirror is an address that ends with .onion. A page in a normal browser tab with a clearnet suffix is not a mirror. A reader who checks the address bar before entering credentials, before pasting a deposit address, before making any action on the page, is a reader who has stopped this trap.
- On the address bar
- A .onion suffix in the tor browser bar. Any other suffix is not the market.
- On the copy button
- A copy button that yields a clearnet URL rather than an onion string is not a copy button for a mirror.
- On the page source
- A page hosted on a clearnet domain is a page whose source lives on that domain. It cannot be the mirror even when its content is copied from one.
What this card does not claim
- It does not list any clearnet domain that has claimed this role. Naming one would make this card an advertisement for it.
- It does not say every clearnet page that publishes onions is a trap. This site is a clearnet page that publishes onions, and it does not claim to be a mirror.
- It does not say a short domain is worse than a long one. Length is not the tell.
A page that publishes rather than mirrors
The difference between a page that publishes an onion string and a page that claims to be the onion is worth stating out loud. This site is the first, and every dossier here says so. The three nexus market mirrors on the panel above are the ones to open on the tor network.
What an honest bridge would need to do
A clearnet bridge to an onion is not impossible in principle. What it would need to prove is that the bridge is passing the request to the onion the reader named, without keeping the credentials or the session. There is no way for a reader to check this from outside the bridge. That is why the bridge model is a trust jump the reader has to make about a party they cannot audit.
A page that says out loud that it is not a bridge and does not proxy is a page that is not asking the reader to make that trust jump. This site is that kind of page. The onion strings on the panel above open on the tor browser, not through this domain. The reader who copies the string and opens it on tor has not passed through this page for the load itself.
A reader in a hurry on a clearnet page
A reader in a hurry is the reader this trap is written for. The hurry is the reason the reader took a search result rather than a bookmark. The reader in a hurry does not have time to run a comparison. What the reader in a hurry does have time for is a single look at the browser address bar to confirm the suffix. That look is the whole defence.
A reader who has slowed down enough to reach the addresses panel on this site can also take one more step. Copy the string from the panel, close the current page, open the tor browser and paste. The load happens on the tor network, not on the clearnet page the reader was on when they copied. That extra step is what turns a hurried reader into a safe reader on this trap.