A lure domain is a web domain used as the initial contact point in a malicious delivery chain. It is designed to look harmless enough to receive a click, load a page, or trigger a redirect, then send the victim toward payload hosting, credential theft, or command-and-control infrastructure. In practice, the lure domain is the front door, not the final destination.
This matters because defenders often block what they can see first. Attackers use lure domains to rotate visible infrastructure while keeping the rest of the campaign intact. A single campaign may swap lure domains frequently, but reuse the same hosting, certificates, redirect logic, or network ranges underneath. For defense, that means hunting for shared patterns, not just bad URLs: DNS history, ASN ownership, nameserver behavior, TLS fingerprints, and redirect chains can reveal linked domains and help stop the next lure before it reaches the payload stage.