Nexus Market mirrors, explained
A mirror on a darknet market is not a copy of the store. It is a second door into the same building. Same vendors, same wallet balances, same dispute queue. Nexus Market, which opened in 2023 and has since become one of the main English-language markets on Tor, runs three such doors. Two of them are there to stay standing when the front one gets kicked in.
This page is about how that set is put together and why it keeps changing. The onion links page on this site is just the list of addresses and how to check them. Here we talk about the machinery underneath, who decides which mirror carries the load, and what a "Down" flag actually means before you panic.
One primary, two backups, what each one does
Nexus keeps three live .onion addresses at any given time. The primary is the one everyone lands on first. It takes the heaviest traffic because bookmarks and search results all point at it, so it also gets the most DDoS attempts aimed at it. Backup A is the first fallback. If the primary is slow or unreachable, you go here. Backup B is the last resort, the one that stays quiet most of the week and only matters during a bad day.
Nothing on a backup mirror is different from the primary except the address. Log in with your usual username, PGP 2FA, and anti-phishing code. Your BTC, LTC, and XMR balances show up exactly as they do everywhere. The 2-of-3 multisig escrow that guards your orders is tied to the market, not to a specific URL. So "switching mirrors" is closer to walking into a shop through a side entrance than starting a new account.
Why three and not five
Three is a floor, not a ceiling. With one, a single DDoS or a seized node takes the whole market offline for anyone whose bookmark is stale. With two, you survive one failure but have no spare if the attacker hits both at once. Three lets Nexus take the primary down for maintenance or key rotation while the backups keep serving, then bring a fresh primary up without anyone losing access. More than three starts to cost real money in bandwidth and ops, and past a certain point the extra address buys you almost nothing.
Uptime and what a status flag really means
Every address in the set is probed on a fixed schedule, typically every 10 minutes from more than one clean Tor circuit. The probe does a full page fetch, not just a ping. It wants to see the login form render, the anti-DDoS queue clear, and the captcha image load. A mirror that passes three cycles in a row gets marked Live. Miss three in a row and it flips to Down.
Live does not mean fast. During a DDoS burst the queue can stretch to a couple of minutes even on a perfectly healthy mirror, because Tor is rate-limiting the flood. Down does not mean dead. It usually means the descriptor went stale, a relay along the path dropped, or the node is mid-rotation. The distinction matters because a Down mirror often recovers in under an hour with zero user action, while a Live-but-slow one is just congested and you should hop to a backup instead of waiting.
How the probe avoids false positives
The biggest problem with mirror monitoring is your own connection lying to you. A bad guard relay makes every onion look broken. So the probers rotate circuits between checks and compare results across independent entry nodes. Only when multiple vantage points agree that a mirror failed does the status change. That is also why the last-checked timestamp on the table updates in small increments rather than jumping around, and why a single blip rarely shows up at all.
Which mirror to open first
Start on the primary. It is where the freshest state tends to be and where the queue is tuned hardest. If it hangs past about two minutes, or the page stalls on the captcha, rebuild the circuit once. Still stuck, move to Backup A. Backup B is for when both of those are slow, which is the rare case that usually signals a coordinated attack on the whole set rather than a single-node problem.
There is no penalty for hopping between them mid-session. Sessions, wallets, and order state live server-side on the market, not in your browser tab. The only rule is to finish a login on whichever mirror you started it, then let the redirect settle before you open a second address. Opening the same account from two mirrors at once just doubles your load on the queue.
When to stick with a backup
If the primary is Live but you notice repeated disconnects, long queues, or a captcha that fails twice in a row, switch to Backup A and stay there. It is often less crowded precisely because nobody bothers to use it. The primary will usually recover on its own, and you can come back. But chasing a flapping primary is how people end up logged out mid-checkout, so the calm play is to sit on a quiet backup until the storm passes.
Why the addresses keep changing
Rotation is the single biggest source of confusion for new users, so here is the honest version. An .onion address is tied to a cryptographic key. If that key ever leaks, or if the node behind it gets probed too hard, the operator rotates to a fresh address. That is the routine case, a scheduled key swap that happens on a set cadence and is announced ahead of time on the market's PGP-signed channel.
The other reasons are reactive. A DDoS campaign that pins a specific address can push the team to retire it and bring up a clean one. Law-enforcement seizures of the hardware hosting a mirror force the same move. And sometimes a relay misbehaves for weeks and the fix is simply to republish the service under a new name. None of these mean the market died. The signed announcement lists the new address, and the old one stops resolving within the hour.
What to trust during a rotation
Only the PGP-signed statement from the operators. Forums, Telegram channels, and even well-meaning directories can be spoofed or lag behind. A rotation post is signed with the same key that has been on file since launch, so you can verify it locally before trusting a single character. The directory on this site updates its table after it confirms that signature, which is why the "last verified" stamp sometimes trails the official announcement by a day or two.
Keep your own mirror journal
Bookmarks rot. A bookmarked onion from six months ago is a liability the moment a rotation happens, because it now points at a dead key or, worse, a clone squatting the old string. The fix is boring and works. Keep a plain-text journal of every address you have used, dated, with a note on which one was primary at the time.
Store that journal encrypted, not in your browser profile. A file on an encrypted volume, or a line inside an existing encrypted note, is enough. The goal is a record you can pull up offline and cross-check against the current signed list, so you can tell in ten seconds whether an address you remember is still live or has been retired. Bookmark this directory for the live set, but keep the historical log somewhere only you can read.
The two-line rule
Whenever a new address shows up, write it down with today's date and the role it plays. When an old one disappears, mark it retired, not deleted. Over a year you end up with a short list of maybe eight to twelve strings, and that list is the fastest sanity check you can run against any "new official link" someone sends you.