Security Scan Report: r20.rs6.net

Redirected to:
https://r20.rs6.net/error.jsp?e=xmlhmqgbb
Site favicon
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 1 country across 2 domains to perform 5 HTTP transactions. The main domain is rs6.net and was registered 24 years ago.

Submitted URL: https://r20.rs6.net/tn.jsp?f=001DyiWYWxw55me5hKOpLoWPi2zPLufLvAVkUsxNuI1kxlGri6oJhvtLT2sS7xHZfY3Cr1DqIPaXnc6nE5f8fbx01TJVPTQdG5PvJ-bzaFb-WS_TfDKUrZRLdK0M17V4KAXbREOpl8kJu0=&c=&ch==&__=/asdf/

Effective URL:
https://r20.rs6.net/error.jsp?e=xmlhmqgbb
Redirected

The Cisco Umbrella rank of the primary domain is #9,051 of the top 1 million websitesTop 10K Site

AI Security Verdict

Low Risk

Confidence: 68%

3
Risk Score

Constant Contact's own 404 page on its r20.rs6.net tracking host; no forms or malicious code. Only a single-source, unverified wallet-drainer tag on this shared redirect domain keeps it above LEGITIMATE.

Risk Factors (2)
Single-source, unverified threat-intel report of a wallet drainer associated with the r20.rs6.net tracking domain (third-party URL abuse of a shared redirector cannot be fully excluded)
Broken/expired campaign link with a malformed trailing path ('/asdf/'), so the intended destination of the original tracking URL could not be observed
Safety Factors (5)
Page is Constant Contact's own error/404 page on its own registered tracking domain, not a third-party look-alike
Domain ranks ~#9,051 in Cisco Umbrella (top 10K), indicating long-established legitimate infrastructure
No credential, login or payment forms; no disguised fields; no credential exfiltration or cross-origin form submission
No hunting rule malware patterns, no known-kit roster match, no high-precision hunting-rule hits, no network IDS alerts
Page content is purely a 'page not found' notice with links to Privacy Policy and Customer Support — no lure, urgency, or data collection
Domain age information unavailable

Details

Page Title

Constant Contact

Scan Type

public

Domain Name Analysis

You're looking at domain 'r20.rs6.net' on the network infrastructure generic top-level domain (.net) with subdomain 'r20'. The core label 'rs6' covers 3 characters containing 0 vowels alongside 2 consonants, along with one digit. It segments into two words: rs, 6. Median word length comes out to 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Oops! The requested page was not found. This could be because: + You followed a broken or out-of-date link. + Your email client cut off part of the URL of the link and we no longer recognize it. +...

Page Load Overview

3.25s
Total Load Time
255 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:331 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network26% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

social media network
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3208.75.122.11United States
AS40444Constant Contact, Inc
165.8.131.56Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
165.8.131.44Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
53--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T163212E3A10E4511356D0C1C86A4A3316CEC2D527DDA3DEC1B4AC824CAFD9EC78C5318D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:kxeCsuPQF0FEoAtO9Ecb8ANRaiR6WnA7k/R+70b2AoHEemGo3j:dphxaEu56t4bTEe

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1360:gAAAASAAAgAAAAIAAUABQCAgAAggAAAACIAAABABQBAAAACAACAAACASAAAAAAAAAAQgAAAAAAAAAAIIAQAAAAAEAAKAIABA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:003c3c24243c0000
Perceptual Hash:b322cc993366cc9b
Difference Hash:0028284c48280000
Wavelet Hash:dcfcfce42c3c0000
Color Hash:N/A

Other Hashes

Crop Resistant:0028284c48280000

Scan History

Scan history not available

Unable to load historical scan data