A legacy domain is an older web address that stays visible, reachable, or trusted after a service has changed name, moved platforms, or been retired. It may still appear in search results, links, cached pages, email signatures, or DNS records even when it is no longer the official entry point.
In cyber security, legacy domains matter because attackers can abuse old trust. They may register a similar address, use a forgotten domain for phishing, or exploit outdated redirects and contact forms to mislead users. Defenders should inventory old domains, keep control of ones that still matter, and clearly decommission or redirect the rest. Cleaning up legacy domains reduces confusion, shrinks the attack surface, and helps users tell current services from abandoned ones.