A payload source is the server, file host, or redirect location that delivers the malware itself or the next-stage code after an initial lure has been reached. In a typical infection chain, the victim may first contact a benign-looking page, then be redirected to a payload source that serves an executable, script, archive, or downloader.
This term matters because the payload source is often more important than the visible domain. Attackers rotate payload sources to evade blocks, takedowns, and reputation systems, while defenders use the source to trace infrastructure reuse across campaigns. Security teams look for repeated IPs, hosting providers, ASN patterns, TLS certificates, and redirect behavior to link changing domains back to the same delivery layer. In practice, a campaign may keep the lure domain moving but reuse the same payload source until it is burned, then swap it for another location.