NexusDomains — frequently asked questions

We pull the current Nexus Market domain set from the operator’s most recent detached-PGP-signed Dread announcement, verify the signature against the operator’s pinned public key, and publish the verified domains here. The tracker is refreshed whenever a new signed announcement appears.

Rotations are not on a fixed schedule — they are pressure-driven. When a domain comes under sustained DDoS the operator may retire it and bring up a replacement. When the pool drops below three concurrent domains, the operator tops it up. The cadence is roughly every few weeks.

There is no difference. "Domain," "mirror," "link" and "URL" are interchangeable terms for the same v3 hidden-service endpoint. Nexus publishes three concurrent endpoints at a time; we track all of them as the current domain set.

Import the operator’s PGP public key (linked from the operator’s Dread account). Open the operator’s signed mirror announcement, paste it into a PGP client, verify the signature. The domains in a successfully-validated post are the authentic ones. Any domain surfaced outside Dread is not authoritative.

The first eight characters of a Nexus v3 domain are an operator-chosen vanity prefix. A phisher can run vanity generation cheaply to produce a domain with the matching prefix and a randomised suffix, hoping you stop verifying at the prefix. Always read all 56 characters.

They share a back-end. All three Nexus v3 domains route to the same marketplace instance — account, balance, order history and credentials are identical across all three. Domain diversity exists at the network layer only, for DDoS resilience.

Yes — if you visit the tracker between the operator’s signed announcement and our next refresh, the displayed set could be one update behind. To eliminate that lag, check the operator’s Dread account for the most recent signed post; that is always the source of truth.

Three places: this tracker, the operator’s PGP-signed Dread account, and the captcha image on a loaded Nexus page (which embeds the canonical fingerprint). Anything outside those three — Telegram channels, Reddit threads, email forwards, chat groups — is not authoritative and is statistically more likely to be a phisher than the operator.