PGP timestamp verification, the single habit that defeats phishing
Phishing clones of Nexus Market are pixel-perfect by design. The only reliable tell between a real mirror and a clone is a signed timestamp block — and the verification step takes about ten seconds.
Of the credentials lost on darknet markets in the last quarter, PhishWatch.tor's catalogue points to a single dominant vector: users typing or pasting the wrong onion address into Tor Browser, landing on a clone, and submitting a password before noticing. The clones are visually identical, the address differs by one character, and the only durable defence is signature verification.
The Nexus Market team has been signing a timestamp block on every login page since launch, with the same PGP key, fingerprint 0x7F2A0A9D. The block sits in the page footer and looks like the snippet below:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 nexus-mirror: live timestamp: 2026-XX-XX HH:MM UTC fingerprint: 7F2A 9C41 66B8 E1D5 ... 0A9D -----BEGIN PGP SIGNATURE----- ...
Copy the entire block, drop it into a file, run gpg --verify against the published key. If the output reads Good signature and the fingerprint ends in 0A9D, you are on a real mirror. If it reads BAD signature, UNKNOWN, or anything else, close the tab. Do not retry, do not enter credentials, do not click anything else on that host.
Why this defeats every phishing clone we've seen
A phishing operator can clone the visual layout of the login page in an afternoon. They can register an onion that's one character off from a legitimate mirror in a few hours. What they cannot do is sign a timestamp block with the platform's PGP key, because they don't have the key. Every recorded phishing operation against Nexus has either omitted the timestamp block entirely, replaced it with garbage that fails GPG, or signed it with a different key that does not match the canonical fingerprint.
The verification step is the same one Tor users perform on installer downloads. It takes ten seconds with the key in your local keyring, costs nothing, and is the only step in the access flow that an attacker cannot fake.
Working Nexus Market mirrors
Below are the three v3 onion addresses currently serving the production market, signed with the platform's PGP key (fingerprint 0x7F2A0A9D). Use the Copy button — never retype an onion by hand.