A fresh Nexus onion is being treated as a scam by reflex

A new Nexus onion that appears on the reference page now triggers a fear reflex before it triggers a check. Readers see an unfamiliar string and file it under "scam" without stepping through the verification.

How it read before

When a new onion appeared, the response used to be procedural. The reader opened the reference page. They found the fresh string. They checked whether the operator had signed a rotation notice with the previous key. They compared the signed notice against a copy from another trusted source. If the signature was fine and the sources agreed, the new onion joined the shortlist of addresses the reader would use. There was no drama about it. Address rotation was a routine thing that markets did.

How it reads now

A newer reader who lands on an unfamiliar Nexus onion reacts differently. First the string looks wrong, because the previous string was the only one they had memorised. Second, someone in a chat somewhere says "that is a scam, do not use it". Third, the reader closes the tab and warns others. The signed rotation notice, if there is one, never gets read. The comparison against a second trusted source never happens. The address gets marked as a fake by acclamation.

Sometimes the address really is fake. That is why the reflex has developed. But sometimes it is a genuine rotation, and the market operator ends up with a real address that the community has told itself not to touch. Both outcomes are bad for the reader, because both leave them with fewer working addresses than they should have.

What gets lost in the reflex is the fact that operators rotate for reasons. A rotation happens because the previous string has been targeted, or because the operator wants to move to a newer key format, or because they want to hand off traffic between load points. The rotation is often preceded by a signed notice on the addresses the operator already controls. That notice is the very thing the reflex causes the reader to skip. Reading it takes a minute; the reflex takes a second, and the second-long reflex wins.

Why this probably shifted

The shift is a rational adaptation to a real risk, which is why it is hard to argue against directly. Scam addresses have become more common and more convincing. The safest personal rule of thumb, if you are not willing to do the verification, is "if it is unfamiliar, close it". That rule has spread, and it now runs by default. The problem is that the rule does not distinguish between "unfamiliar because it is a scam" and "unfamiliar because it is new". Both cases feel the same in the moment.

A second force is that the addresses reference on some directories updates more slowly than the operator rotates. So a fresh onion can be live and legitimate before the directory has caught up, which means the reader looking for a second source cannot find one and defaults to "scam".

What to change on your side

A calm test only takes a couple of minutes, and it is the difference between locking yourself out of a real address and dodging a fake one.

• Before anything, find a rotation notice signed with the previous key you had. If none exists, treat the new address as unverified and stop.
• Verify the signature against a copy of the previous public key you already had, not one you fetched from the same page that hosts the notice.
• Compare the new onion against a second independent reference. If the second reference has not caught up, wait.
• Log in and see whether your account balance and message history match. If they do, the address is on the same wallet. If they do not, close the tab.
• Watch how the address treats the small signals: does the checkout address confirmation still appear, does the PGP-signed invoice block still render below the amount. A real rotation carries them; a hasty fake often does not.

What this entry is not claiming

The entry is not asking anyone to trust unfamiliar addresses. Caution is right. The observation is that caution and verification are two different things, and the current reflex is skipping the second. It is also not a claim about any specific onion. The reference page carries the list; the entry only names the shift in reflex.