Phishing clones are the #1 loss vector — not market flaws. This is the single verification ritual. Updated .
Primary slot ~72h rotation
Active Nexus onion for the current rotation window. Address is PGP-signed; verify the signature on Dread before clicking anything.
Rule: verify signature, not the URL.
Secondary slot failover
Standby onion sharing backend state with Primary. Use only after Primary fails twice across fresh Tor circuits.
Rule: fail over in order, never in parallel.
Tertiary slot reserve
Last-resort reserve. If all three slots fail, assume network conditions or stale announcement — never hunt replacements on forums.
Rule: no announcement = no trust.
Why no clickable onion links here: Nexus onions rotate roughly every 72 hours. Any static link list rots within days and becomes a phishing feed. We document the verification ritual instead of publishing addresses that expire — bookmark the signed announcement source, not a URL.
The 5-step verification ritual
Fetch the current signed announcement and verify the PGP signature against the long-term market key.
Open Tor Browser (latest stable, Safest mode) and allow 15–30 seconds for circuit handshake.
Match all 56 characters of the v3 address — typosquatters change 2–3 characters mid-string.
Confirm your personal canary phrase renders in the header. No phrase means clone — close immediately.
Require a PGP challenge at login. No challenge means fake — never enter credentials.
Anti-spoof checklist
Reject URL shorteners, screenshots of addresses, and addresses shared via unsolicited messages. Genuine mirrors never prompt software installs, extension updates, or deposits before showing marketplace chrome. Treat any address outside a signed announcement as hostile.
