They can detect that a redirect has happened, but not the logic that determined which destination to display. If a redirect happens no matter what (this is very, very common for advertisement landing pages to track campaign visibility) then the presence of one is not necessarily malicious.