Three addresses, one market. Same account, same orders, same balance behind each one. No accounts, no forms, nothing collected

HomeSignals › The address on the page is not the address in your bar

The address on the page is not the address in your bar

The one signal that ends a session rather than starting a diagnosis. How the check works on a Nexus mirror and why it cannot be faked.

Group
Integrity
First move
Stop immediately
How long to give it
Do not proceed
Nexus Market onion addresses3 live · same market behind each
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onion
nexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onion

Run the check before you sign in. Open these in Tor Browser only. When the login screen loads, compare the onion printed on the page against your address bar, reading from the end. If they differ, close the tab.

Everything else on this site is about diagnosing a slow or absent page. This one is different. If the two addresses disagree, the diagnosis is finished and the answer is to close the tab.

What you see. A login page that looks exactly right, where the onion printed on the page does not match what your browser shows in the address bar.

Why this check works when nothing else does

A cloned page can copy the design perfectly, because the design is served to anybody who asks for it. Fonts, layout, wording, the lot. What a clone cannot do is live at the real address, since that address is derived from a private key it does not have. So it has to sit somewhere else, and your address bar shows where you actually are. Print the real address on the page and the contradiction becomes visible.

How to run it

  1. Load the mirror and stop at the login screen. Do not type anything yet.
  2. Find the onion printed on the page itself.
  3. Compare it against the browser address bar, starting from the end. The last eight characters are the hardest to fake convincingly.
  4. If they match, sign in. If they differ by a single character, close the tab.

Where the bad addresses come from

Almost always from searching during an outage. A familiar address goes quiet, somebody wants in, they look for a replacement and take the first plausible result. Having the three addresses saved means that moment never arrives, which is the actual defence.

If you already signed in somewhere wrong

  • Assume the username and password are gone. Change them anywhere else you reused them, which is the real cost of reusing.
  • Do not send anything further to any address that page gave you.
  • Come back through an address you copied from a source you trust and check the account from there.

How to read the result

Exact match

Proceed. This is the check passing, and it is worth doing every single time.

Cannot find it printed

Do not assume the worst, but do not sign in either. Load a different mirror and compare what that one shows.

They differ

Close the tab. No further diagnosis, no second look, nothing typed.

Other integrity signals

Procedures that apply here