Just for the fun of it and since the task was screaming “Regular Expression”: an implementation in JavaScript.
function performsmartrule(records) {
/* Filter out all records without URL and with mailto URL */
records.filter(r => r.url() !== '' && !/^mailto:/.test(r.url())).forEach(r => {
/* Get the URL's host part, i.e. everything following '://' and ending before '/' */
const host = r.url().match(/^(?:.*:\/\/)?([\w.]+)/)[1];
/* Get the domain: at least one word character followed by a dot
followed by at least one word character anchored at the end of the host name */
const domain = host.match(/.*?(\w+\.\w+)$/)[1];
app.addCustomMetadata(domain, {for: "OriginURL", to: r});
})
}
}
I find that a tad more concise 
Here’s what the regular expressions do:
url.match(/^(?:.*:\/\/)?([\w.]+)\/?/): Match any number of characters (.*) at the beginning of the string (^), followed by a colon and two slashes:\/\/. That part is the protocol (http:// etc.). Since it is optional, pack it into a non-capturing group (?:...) than can occur not more than once (?). Stuff all word characters and dots after that ([\w.]+) into a capturing group. The [1] following the match call grabs this capturing group. It is the host name not including a possible port number.
host.match(/.*?(\w+\.\w+)$/): Then match looks for at least one word character \w+ followed by a dot \. and at least one word character \w+ anchored at the end of the string $. \w+\.\w+ are stuffed into a capturing group. It contains the domain name and is accessed with [1] after the match call.
IMO, the AppleScript code has some shortcomings (one of them being its length ;-). Running it on
{"https://sub.domain.org/",
"www.example.com",
"http://example.com?query-string",
"https://example.org:81/",
"mailto:booking@information.lufthansa.com?subject=Re:%20Vielen%20Dank%20f"}
in Script Editor gives me
(*sub.domain.org*)
(**)
(*example.com?query-string*)
(*example.org:81*)
(*mailto:booking@information.lufthansa.com?subject=Re:%20Vielen%20Dank%20f*)
ie: A sub domain is not removed, an URL without protocol but with www is completely ignored, a query string is not removed, nor is a port. And a mailto URL is not dealt with at all. The JS code above gives me that output on these URLs:
domain.org
example.com
example.com
example.org
As it should, because the script skip mailto links completely. Perhaps the OP could advise what to do with them?
Also, both scripts fail with domains like sub.example.co.uk – AS returning that, JXA returning co.uk.
I also asked Qwen to write the JS code. Even in the third iteration, it failed miserably because it tried to use the URL class which is only available in some environments (notably browsers and Node.js). Here’s what it said: " So the earlier suggestion is indeed invalid in practice ."
I just love it.