The signed list and the captcha check.
Nexus builds its access flow around phishing defence, and two checks confirm you are on a genuine address.
The Nexus login renders the market's own onion address into the captcha image. Compare that printed address against the one in your browser bar. A clone can copy the Nexus theme in minutes, but it cannot easily serve the correct address in the captcha while sending you to the wrong one, so a mismatch gives it away. Run this every session.
Nexus signs its mirror list with a PGP key you can verify. Verifying the signature proves an address came from the market and nobody edited it. The addresses on this page are checked against that signed list.
Nexus Market