Signal Library/HTTP Crawling History/Web Behavior & Structure

Redirects to Known Safe Domain

The domain redirects to a destination classified as safe or technology-related.

See verdicts firing this signal Open in API reference

Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Redirects to Safe Domain' mean?

The domain redirects to a destination classified as safe or technology-related.

Why it matters02

Why is the severity low?

Malicious domains can also redirect to safe destinations as part of cloaking or traffic distribution.

Evidence shape

What Redirects to Known Safe Domain looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json

{
  "slug": "redirect_to_safe_domain",
  "name": "Redirects to Known Safe Domain",
  "group": "http_crawling_history",
  "subgroup": "web_behavior_structure",
  "direction": "safe",
  "evidence": {
    "url_shortener_chain": false,
    "auto_refresh_seconds": null,
    "direct_ip_link": false,
    "browser_interaction_required": true
  }
}

See in API reference

Siblings

Peers in Web Behavior & Structure

9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Malicious Redirect Behavior

It refers to the automatic forwarding of a user or system request from one domain to another destination. Redirects can …

MaliciousCore

JavaScript-based Redirect

It refers to a redirect mechanism implemented within a webpage using JavaScript code instead of standard HTTP response h…

Malicious

Injected Iframe

An injected iframe refers to an HTML frame embedded within a web page that loads content from an external or malicious d…

MaliciousCore

Direct Connection to an IP Address

It refers to the action of accessing a resource using a direct IP address instead of a domain name. Threat actors often …

Malicious

Show 5 more in Web Behavior & Structure

In the wild

See Redirects to Known Safe Domain fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery

Pre-filtered to Redirects to Known Safe Domain. See real IOCs this signal caught and the verdicts the engine returned.

Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API key Back to Web Behavior & Structure