Confirming you are on a real Nexus mirror

A copy of the market can look perfect. It cannot live at the right address. That single fact is the whole of this procedure.

The check

1. Copy an address from a place you already trust rather than typing or searching.
2. Load it and stop at the login screen.
3. Compare the onion printed on the page against your address bar, reading from the end backwards.
4. Only then sign in.

Why reading backwards

The interesting characters are at the end. Anybody generating a lookalike spends their effort on a matching prefix, because that is what people glance at. The tail is expensive to match and is where a fake usually gives itself away.

What proves nothing

• The page looking right. Stylesheets are public to anybody who loads the site.
• A working login form. It works because it is collecting what you type.
• A padlock or the absence of one. Onion addresses carry their own authentication and browser warnings about certificates say nothing useful here.
• A search result ranking. Nothing about ranking is a statement of authenticity.

If it fails

Close the tab. Do not sign in to see what happens, do not send a test amount, do not report it from that page. Then change any password you reused elsewhere, because that reuse is where the real damage is.

The habit that prevents all of this

Keep the three addresses saved somewhere you can reach without a search engine. Every phishing story starts with a familiar address going quiet and somebody going looking.