A mirror domain is a secondary domain that serves the same or similar content as another source. In legitimate use, mirrors help with load balancing, regional access, backups, or content distribution. In security work, the term matters because a mirror can also become a separate exposure point: if it serves files directly to a browser, it can present pages, assets, or downloads without the controls defenders expect on the primary site.
Attackers may abuse mirror domains to host phishing pages, cloned login screens, or verification lures that look routine and trustworthy. Because the content is mirrored from a known source, users may be less suspicious, and automated defenses may treat the domain as ordinary infrastructure. Defenders should monitor mirrored content for unexpected HTML, unusual redirects, and browser-facing pages on domains that should only distribute files. A mirror domain is not inherently malicious, but it can turn trusted infrastructure into an effective delivery surface.