A redirector is an intermediate server that forwards traffic to another destination. In cyber security, attackers use redirectors to separate the visible front end from the real command-and-control server, payload host, or phishing page. This extra hop can hide infrastructure, delay takedowns, and make traffic look like ordinary web browsing, especially when it is carried over HTTPS or placed behind familiar-looking URLs.
Redirectors matter because defenders often see only the last relay, not the operator’s true endpoint. They are commonly used in multi-hop proxy chains, disposable hosting, and domain rotation. Security teams look for signs such as unusual redirects, mismatched certificates, strange DNS patterns, and outbound connections that follow a file launch or process start. Monitoring the whole redirect chain, not just the first URL, helps expose hidden infrastructure and block malicious traffic more effectively.