I accidentally visited a typo domain while trying to reach indianasheriffs.org. The typo domain automatically redirected to yfdabv11[.]com with parameters referencing the misspelled domain and an HTTP 504-style message. I did not enter any information, click anything intentionally, download a file, grant browser permissions, or install or run software. Opera GX shows no downloads around that time, and the browser history shows the redirect followed shortly afterward by the legitimate site.
Security services gave mixed results: Hybrid Analysis showed a threat score around 69, BForeAI labeled it 100% malicious, while Criminal IP reported it as clean and URLScan, CleanDNS, VIPRE, and ScamAdviser provided no clear malicious classification. Hybrid Analysis also listed a related or dropped file, although the file itself appeared to have no specific threat.
How should these results be interpreted? Does a "dropped file" in a sandbox mean the site attempted to place malware on visitors' computers, or could it be a browser, cache, or temporary sandbox artifact? What parts of a report would indicate a successful browser exploit, drive-by download, infostealer, RAT, or executable payload rather than suspicious advertising or redirect infrastructure? Given that nothing was downloaded or executed on my computer, how concerned should I be? Would it be safe to investigate the redirect chain later in an isolated, disposable virtual machine or browser sandbox while recording the URLs and screenshots? I'm mainly trying to distinguish a low-reputation redirect network from a site that actually delivered malware.
3 Answers
A high score from one analysis service does not necessarily mean your computer was infected. Automated systems often score domains based on reputation, redirect patterns, suspicious URL parameters, advertising behavior, hosting history, or files observed in their own sandbox. A URL can be malicious or abusive infrastructure without successfully exploiting every visitor. The 504-looking parameter also appears consistent with a failed or timed-out redirect through an advertising or traffic-distribution network, although it is not proof that the site was harmless.
Based on the details provided—no download shown in the browser, no execution or installation, no permissions granted, and only a brief automatic redirect—the practical risk appears limited, especially if the browser and operating system were up to date. Conflicting scanner results are common because each service uses different data, sandboxes, and scoring rules. Keep the browser and operating system patched, review extensions and startup items if you want reassurance, and run a reputable local security scan. If the analysis report shows no exploit behavior, persistence, or suspicious processes, there is little evidence that the visit caused an infection.
A “dropped file” entry in a sandbox report usually means the analysis environment observed a file being created, downloaded, extracted, or otherwise associated with the process. It does not automatically mean the file was written to your computer during the original visit. Browsers and sandboxes create caches, temporary files, scripts, and metadata, and the report may also be linking a file from a redirect chain or a previous analysis. You would need to inspect the file name, hash, origin URL, process that created it, file type, and behavioral detections before treating it as an executable payload.
The strongest evidence of an actual browser compromise would be a successful exploit chain, suspicious child processes, persistence changes, credential or browser-database access, an executable being saved and launched, or network traffic to command-and-control infrastructure. A reputation score alone cannot establish those things.
If you investigate it, use a disposable, fully patched virtual machine with networking isolated as much as practical. Do not revisit it from your normal browser, and avoid clicking through unknown landing pages.