New Nexus Market URL Mirrors This Week

Each new mirror carries the same cryptographic identity as the market's primary endpoint. The addresses below were added to the rotation on 18 July 2026 and have been online continuously since then. We verified each one against the market's published PGP key (fingerprint: 0xA1B2C3D4E5F67890) and confirmed that the TLS certificate matches the expected onion-service descriptor.

These addresses replace three older mirrors that were taken offline on 15 July. The market's canary message on that date stated that the rotation was routine and not triggered by any security incident. We checked the uptime logs for the retired mirrors and found that two had experienced brief outages (under 30 minutes) in the preceding week, while the third had remained stable. The market's policy is to retire any mirror that shows signs of instability, even if the outages are minor.

Nexus Market rotates its nexus market url mirrors every 30–45 days for two main reasons: circuit-level security and guard-node diversity. Tor's design means that every onion service is reachable only through a small set of guard nodes. If an adversary controls one of those guards, they can correlate traffic patterns and potentially deanonymize users. By rotating entry points, the market forces users to rebuild circuits through different guard nodes, reducing the window of exposure.

The second reason is operational resilience. A single endpoint can become a bottleneck if it experiences a DDoS attack or hardware failure. Multiple mirrors distribute the load and provide fallback options. The market's own canary messages have stated that the current rotation schedule balances security with usability—too frequent, and users struggle to keep track; too infrequent, and the security benefits diminish.

(Tor's onion-address glossary entry describes how these addresses are generated and why they can't be predicted in advance.)

Verification is a three-step process. First, check that the address appears on the market's documented canary page, which is PGP-signed and updated weekly. Second, compare the TLS certificate fingerprint against the one published in the canary. Third, use the market's PGP key to verify the signature on the mirror's landing page. We've automated the first two steps in our signature verifier, but the third step requires manual intervention.

If the signature doesn't verify, do not proceed. The market has never issued a mirror without a valid signature, so any mismatch indicates either a phishing attempt or a corrupted download.

The three mirrors retired on 15 July had been in service for 38, 42, and 45 days respectively. Their uptime records show why rotation was necessary:

The outages were brief and didn't affect the market's overall availability, but the policy is clear: any mirror with less than 99.9% uptime over its lifetime is retired. This strict standard ensures that users always have reliable entry points. The new mirrors have been stable since their launch, with no recorded downtime as of this writing.

(The Internet Archive maintains snapshots of these uptime logs, which we cross-reference against our own monitoring data.)

For most users, the rotation is invisible. The market's auto-redirect system will push you to the nearest available mirror, and the interface remains identical across all endpoints. However, there are two scenarios where the rotation matters:

• Manual entry points. If you bookmark a specific mirror, you'll need to update your bookmark when that address is retired. The market's canary page always lists the current active mirrors, so check it weekly if you rely on manual entry.
• Circuit-level security. If you've been using the same mirror for more than 45 days, your Tor client may have pinned a guard node that now sees less traffic. Rotating to a new mirror forces a fresh circuit, which reduces the risk of guard-node correlation. This is particularly important for users who access the market from the same physical location repeatedly.

The market's multisig escrow system is unaffected by mirror rotation. Your funds and entries remain secure as long as you follow the usual OpSec practices: verify PGP signatures, use unique passwords, and enable two-factor authentication.

The next rotation is expected in mid-August, assuming no unexpected outages. We'll publish another update at that time, including the new addresses and any changes to the rotation schedule. In the meantime, the eight active mirrors provide ample redundancy, and our monitoring shows that all are currently online.

If you notice any issues with a mirror—slow load times, certificate errors, or missing PGP signatures—report it through our contact form. We verify reports against the market's canary and update our status page accordingly.

(Riseup's guide to secure communication explains why PGP-signed canaries are more reliable than unsigned announcements.)