domain-name

Security Concepts

Definition

A domain name is the human-friendly address of a website, like `example.com`. It’s easier to remember than the actual IP address, which is just a string of numbers. Behind the scenes, the **Domain Name System (DNS)** translates the domain into its IP address so your browser knows where to connect.

A domain name is made of parts. The **Top-Level Domain (TLD)** is the “dot-something” at the end, like `.com`, `.org`, or `.uk`. The **Second-Level Domain (SLD)** is the unique name you register, like `google` in `google.com`. You can also have **subdomains** before that, like `mail.google.com` or `store.example.com`.

```
sub.example.com
│    │       └── Top-Level Domain (TLD) → ".com"
│    └───────── Second-Level Domain (SLD) → "example"
└────────────── Subdomain → "sub"
```

In cybersecurity investigations, domain names can be critical evidence. Phishing campaigns often use lookalike domains (`paypa1-support.com`) to trick victims. Malware may “phone home” to a specific domain controlled by an attacker, known as a **Command & Control** (C2) server. Investigators can look up registration records (WHOIS), analyze historical DNS data (Passive DNS), and pivot from one suspicious domain to others owned by the same actor. This can uncover entire networks of malicious infrastructure.

```
[ Suspicious Link: secure-updates-login.com ]
       ↓
Check WHOIS, creation date, registrar
       ↓
Find other domains with same registrant
       ↓
Map attacker’s domain network
```

For more reading:

* ICANN: [https://www.icann.org/resources/pages/domain-name-2012-02-25-en](https://www.icann.org/resources/pages/domain-name-2012-02-25-en)
* Cloudflare DNS Guide: [https://www.cloudflare.com/learning/dns/what-is-dns/](https://www.cloudflare.com/learning/dns/what-is-dns/)
* RiskIQ Passive DNS Overview: [https://www.riskiq.com/what-is-passive-dns/](https://www.riskiq.com/what-is-passive-dns/)
* Google Security Blog on phishing trends: [https://security.googleblog.com/](https://security.googleblog.com/)

domain-name

Definition

Explore More Terms