How to Avoid Phishing Pages — Darknet Safety Guide

Phishing sites targeting darknet marketplace users are sophisticated, actively maintained, and specifically designed to harvest login credentials and cryptocurrency deposits. They replicate the visual appearance of legitimate markets — sometimes pixel-perfectly — and are distributed through fake link lists, compromised forums, and clearnet search results.

The consequences of accessing a phishing site include stolen account credentials, loss of cryptocurrency deposits, and in some cases exposure of shipping address information previously stored in an account. Understanding how to identify and avoid phishing pages is essential for anyone accessing the Nexus onion platform or any similar dark web service.

// IDENTIFY FAKE SITES

How to Identify Phishing Darknet Mirror Sites

Visual Indicators of Phishing

• Incorrect onion address length — Legitimate v3 .onion addresses are exactly 56 characters before the .onion suffix. Shorter or longer strings indicate a fake.
• Slightly modified characters — Phishing addresses substitute visually similar characters (0 for O, 1 for l, rn for m). Always verify character by character.
• HTTP instead of .onion protocol in address bar — Legitimate Tor hidden services show the full .onion address. If the bar shows a clearnet domain, you are not on the real site.
• Missing or broken PGP features — Phishing sites often cannot fully replicate PGP-signed challenge login, displaying broken or simplified authentication flows.
• Requests for seed phrases or private keys — Legitimate markets never ask for wallet private keys or seed phrases. This is an immediate red flag.
• Suspicious deposit addresses — If the XMR or BTC address shown for your order does not match the pattern you've seen before, or if the address appears identical across multiple orders, verify before sending any funds.

// VERIFY ADDRESS

How to Verify a Nexus Onion Address is Legitimate

1. Use only sources you control. Bookmark verified addresses the first time you access them from a trusted source. Never search for them again.
2. Compare the full address. Copy the address from the mirrors page and compare it character by character against what appears in your address bar before submitting any credentials.
3. Verify the PGP canary. Download the latest signed canary from the official Nexus admin PGP key. A valid signature confirms the address was published by a legitimate administrator.
4. Check the count. Count the characters before .onion — it must be exactly 56. Any other count means fraud.
5. Check HTTPS padlock in Tor Browser. Tor Browser shows a padlock for .onion connections with valid certificates. A broken padlock icon indicates something unusual about the connection.

// BEST PRACTICES

Anti-Phishing Best Practices

• Bookmark verified onion addresses immediately after first confirmed access
• Use the Tor Browser's bookmarks — never rely on memory or manual typing
• Never access darknet markets from links shared in chat applications
• Use a fresh Tails session for each market visit to prevent browser state persistence
• Enable the Tor Browser's built-in HTTPS-Only mode for clearnet browsing
• Never log into a market account without first verifying the onion address matches exactly
• Treat any site that asks for more information than username and password as suspicious
• Maintain a written (offline) copy of verified addresses in a physically secure location

• EFF: How to Avoid Phishing Attacks (ssd.eff.org)
• Tor Browser Download (torproject.org) — Always download from the official source

// IF PHISHED

What to Do If You Entered Credentials on a Phishing Site

1. Do not send any cryptocurrency to addresses shown on the phishing site
2. If you submitted a password, assume that account is permanently compromised
3. If you sent cryptocurrency, the funds are unrecoverable — blockchain transactions are irreversible
4. Change passwords on all accounts using the same or similar credentials
5. Revoke and regenerate your PGP keypair if you submitted your private key or passphrase
6. Create a new market account with a different username, different password, and fresh PGP keypair

[ACCESS VERIFIED NEXUS ONION LINKS →]