Queue, captcha, and a careful registration.
The Nexus login is a short sequence, and one step in it is the check that protects you.
An anti-DDoS wait page may hold you briefly before the login. When it clears, the captcha renders with the market's address printed into it. Compare that to your bar, then solve the captcha.
Pick a username you have never used anywhere else, generate a unique password in a local manager, and store the recovery phrase the market issues on paper. Anyone who holds that phrase owns the account, and no genuine login ever asks for it, so a page that does is a clone.
Hidden services are cheap to flood and there is no upstream provider to absorb it. A holding page that makes every arrival wait briefly is what keeps the service reachable under pressure. It is an inconvenience that exists so the alternative, nothing loading at all, does not happen.
Four causes account for nearly all of it. Storage blocked for the address, so the token the gate issues never sticks and every visit is a first visit. A circuit that changed between passing the gate and using the token. A reload during the check, which throws away a nearly finished pass. Or the gate saturated and shedding arrivals. Letting one attempt finish untouched clears most loops on its own.
Use one that exists nowhere else. A handle carried over from a forum, a game or an email address links this account to everything that handle has ever done, and making that link is trivial for anybody who cares to. Inventing a new one costs nothing and cannot be undone later.
Most markets issue a phrase at registration and show it exactly once. It is the only route back into the account if the password goes, because there is no email on file and nobody who can vouch for you. Write it on paper before continuing. Not a screenshot, since screenshots land in a gallery that usually syncs, and not a note in an application that backs up to an account with your name on it.
Turn it on at registration rather than later. It usually works by encrypting a challenge to your public key, so a leaked password stops being enough on its own. The failure mode is enabling it with a key whose private half you cannot actually use, and there is no override, because an override that worked for you would work for anybody claiming to be you. Test the decryption before switching enforcement on.
Nexus Market