// GLOSSARY

Registrable Domain (eTLD+1)

The name one level above a Public Suffix List suffix (the effective top-level domain, eTLD), the name an organization can actually buy and register; in the example 'example.co.uk' is an eTLD+1 while 'co.uk' is only a suffix. This unit looks like a technical detail but is the load-bearing column of the browser security model: many boundaries such as the SameSite cookie policy, Site Isolation and cookie scoping operate at the 'site' scale rather than the 'origin', and the browser's definition of 'site' is precisely the registrable domain. The critical consequence in attack analysis is this: two subdomains sharing the same eTLD+1 are, in the browser's eyes, usually within the same site, and some trust boundaries between them weaken. This is the basic unit of measure for the related-domain attacker threat; the risk created when a subdomain is seized is assessed by which registrable domain it shares. Techniques such as cookie tossing and shadowing also operate over this shared boundary.