I accidentally visited a typo domain while trying to reach indianasheriffs.org. It automatically redirected to yfdabv11[.]com with parameters referencing the misspelled domain and an HTTP 504-style message. I did not enter any information, click anything knowingly, download a file, install software, or grant permissions such as camera, microphone, location, notifications, clipboard, or automatic downloads. My browser history shows the redirect followed shortly by the legitimate site, and the browser download history is empty.
Security-analysis services gave mixed results: Hybrid Analysis showed a threat score around 69 and a related or dropped-file section, while BForeAI labeled it malicious. Criminal IP reported it clean, URLScan had no classification, and several other services had no result or were unsure. How should these conflicting results be interpreted? Does a "dropped file" in a sandbox report mean the site tried to place malware on visitors' computers, or could it be a temporary browser or sandbox artifact? What report details would indicate a successful browser exploit, drive-by download, infostealer, RAT, or executable payload rather than suspicious advertising or redirect infrastructure? Given that nothing was downloaded or executed locally, how concerned should I be? Would it be safe and useful to reconstruct the redirect chain in an isolated virtual machine or browser sandbox with screenshots, without revisiting it on my normal computer?
3 Answers
Based on the described visit, the practical risk appears limited: no download, execution, installation, permission grant, or form submission was observed. Keep the browser and operating system fully updated, review extensions and startup items, run a reputable local security scan, and change passwords only if you later find evidence of credential exposure. For reconstruction, use a disposable VM or dedicated analysis sandbox rather than a personal machine, avoid clicking through prompts, and record the redirect chain. Treat the domain as unsafe even if the investigation only shows aggressive advertising or low-reputation infrastructure.
The 504-style parameter and the random-looking domain are consistent with a redirect or advertising network handling a failed or timed-out destination. A high automated score can reflect poor reputation, suspicious redirects, or infrastructure associated with abuse; it does not by itself prove that your browser was infected. Different services also use different data sources and scoring models, so a clean result from one scanner does not completely clear a site, but mixed results are common with short-lived redirect domains.
A sandbox’s “dropped file” entry generally means an analyzed process or page caused a file to be created inside the sandbox. It does not automatically mean the file was successfully delivered to your computer. It could be a cache object, temporary browser file, script, document, or an artifact generated while the service followed redirects. Check the file type, hash, parent process, command line, network requests, antivirus verdicts, and whether it executed. Evidence such as a browser exploit alert, a suspicious child process, persistence changes, credential-access behavior, or an executable payload would be much more significant than the label alone.
Would examining the redirect in an isolated, disposable VM with networking controls and taking screenshots be a reasonable way to see what it serves? I won’t open it again on my everyday computer.
That makes sense. I mainly want to distinguish a bad redirect chain from an actual payload, since I don’t remember interacting with the page and found no download in the browser history.