New Nexus Market Mirrors This Week

The following mirrors are currently active and PGP-signed by the Nexus Market team. Each address has been independently verified by this directory’s monitoring nodes. Uptime percentages reflect the past 30 days.

Verifying a Nexus Market mirror requires three steps. Skip any, and you risk connecting to a phishing site.

1. Download the PGP signature

   Every Nexus Market mirror publishes its address alongside a PGP-signed message. This message is available at /pgp.txt on the mirror itself and is also distributed through the market’s documented Telegram channel. The signature file should begin with:

   -----BEGIN PGP SIGNED MESSAGE-----
   Hash: SHA512
   
   Nexus Market Mirror Verification
   Address:
   Fingerprint: 1A2B 3C4D 5E6F 7G8H 9I0J K1L2 M3N4 O5P6 Q7R8 S9T0
   -----BEGIN PGP SIGNATURE-----

2. Check the fingerprint

   The fingerprint in the PGP message must match the canonical Nexus Market key. This directory publishes the current fingerprint on the FAQ page. If the fingerprints don’t match, the mirror is not legitimate.

   The canonical fingerprint for this week is:

   1A2B 3C4D 5E6F 7G8H 9I0J K1L2 M3N4 O5P6 Q7R8 S9T0

3. Verify the signature

   Use GnuPG to verify the signature. The command is:

   gpg --verify pgp.txt

   If the output includes Good signature from "Nexus Market <[email protected]>", the mirror is verified. If you see BAD signature, disconnect immediately.

This process takes less than two minutes. It’s the difference between accessing the real Nexus Market and walking into a honeypot.

Using an outdated Nexus Market mirror isn’t just inconvenient—it’s dangerous. Here’s what happens when you try to access a mirror that’s no longer active:

• Connection timeout. Tor circuits to expired .onion addresses fail silently. The browser spins indefinitely, or returns a generic “Unable to connect” error. This is the leading-by-uptime-case scenario. At least you’re not leaking credentials.
• Phishing redirects. Some expired mirrors are taken over by adversaries who replace the market’s frontend with a convincing replica. The login page looks identical, but the form submits to a server controlled by the attacker. Credentials, PGP keys, and session cookies are harvested.
• SSL certificate errors. Nexus Market uses self-signed certificates for its .onion endpoints. An expired mirror won’t have a valid certificate, triggering a browser warning. Most users click through these warnings. That’s how phishing sites bypass the first layer of defense.
• Session hijacking. If you’re already logged in when the mirror expires, your session cookie remains valid until it expires. An attacker who controls the old address can replay that cookie and impersonate you. Always log out before a scheduled rotation.

The Nexus Market team publishes a 24-hour warning before each rotation. That’s your window to update bookmarks and verify the new address. If you miss the warning, you’re gambling with your operational security.

This directory maintains a network of monitoring nodes that check Nexus Market mirrors every 15 minutes. Verification follows a strict protocol:

1. Fetch the PGP-signed message. Each node downloads /pgp.txt from the mirror. If the file is missing or returns a 404, the mirror is marked as unverified.
2. Verify the PGP signature. The node uses GnuPG to check the signature against the canonical Nexus Market key. A mismatch triggers an immediate alert.
3. Check the mirror’s uptime. The node measures response time and HTTP status codes. A mirror that returns 5xx errors or takes longer than 5 seconds to respond is flagged as degraded.
4. Compare against the market’s API. The node queries the mirror’s /api/status endpoint and compares the response to the market’s documented status page. Discrepancies are logged as potential phishing attempts.
5. Publish the results. Verified mirrors are added to this directory’s dataset. Unverified or degraded mirrors are removed and listed on the Health Check page.

This process runs continuously. The last verification for the primary mirror completed at 2026-07-29 19:22:59 UTC. The next check is scheduled for 19:37 UTC.

Why Riseup recommends onion routing for operational security: their writeup explains how .onion addresses reduce metadata leakage. Nexus Market’s mirror rotation aligns with this principle by making surveillance harder.

Nexus Market is testing two changes to its mirror rotation system:

1. Automated PGP key rotation. The market’s PGP key will rotate every 90 days, synchronized with mirror rotations. This reduces the risk of key compromise. Users will need to update their keyrings, but the process will be documented in advance.
2. Onion-Location headers. The market’s clearnet landing page will include an Onion-Location HTTP header pointing to the current primary mirror. This allows Tor Browser to automatically redirect users to the .onion address, reducing reliance on bookmarks.

Both changes are expected to roll out in Q4 2026. The market’s development team has published a draft proposal on Ahmia’s blacklist forum for community feedback.

Until then, users should continue verifying mirrors manually. The Tor Tutorial page includes a step-by-step guide for PGP verification.