suspicious redirect

How should I interpret conflicting threat scores for a suspicious redirect?

I accidentally visited a typo domain while trying to reach indianasheriffs.org. The typo domain automatically redirected to yfdabv11[.]com with parameters referencing the misspelled domain and an HTTP 504-style…