This is similar to the problem here
Lightning Components in Visualforce
but is slightly different in that the page is being loaded in the context of a community.
We are in the process of developing some extensions to an existing VF-based community using lightning and LC4VF. Everything works in a dev org, the VF page is served from the xxx.force.com community domain and the LO app is picked up from the same domain:
In a sandbox or in production this fails 404 though:
https://dfuat-dfuat.cs17.force.com/c/DfcLoader.app?aura.format=JSON&aura.formatAdapter=LIGHTNING_OUT
404 (Not Found)
There is no obvious difference between the two, though the dev org does have a My Domain and the production org doesn't (though adding one to the sandbox seems to make no difference).
Best Answer
My Domain is required to use Lightning Components in any container currently even if that container is not my domain savvy. Can you first validate that you can access a simple .app that uses you component completely outside of LC4VF? Did you activate your My Domain in sandbox after creating a domain for it?