Three rules for URL handling on Tor marketplaces. First: copy, never retype. The Copy button on the homepage mirror box exists because phishing clones differ from real mirrors by a single character and a typed address sends you to a clone roughly 1 in 50 attempts. Second: verify the rotation roster. The mirror box on the homepage is canonical; an address that does not appear there is either expired or never was real. Third: verify the signature. Even a correctly-copied address from a hostile source is dangerous; the signature on the login page is what proves the address is currently real.
Three rules, ten seconds total per visit. They defeat every URL-related attack pattern in the public phishing-clone catalogue.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy button; never retype an address.