Security Scan Report: r20.rs6.net

Redirected to:
https://r20.rs6.net/error.jsp?e=xmlhmqgbb
Site favicon
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 1 country across 2 domains to perform 5 HTTP transactions. The main domain is rs6.net and was registered 24 years ago.

Submitted URL: https://r20.rs6.net/tn.jsp?f=001DyiWYWxw55me5hKOpLoWPi2zPLufLvAVkUsxNuI1kxlGri6oJhvtLT2sS7xHZfY3Cr1DqIPaXnc6nE5f8fbx01TJVPTQdG5PvJ-bzaFb-WS_TfDKUrZRLdK0M17V4KAXbREOpl8kJu0=&c=&ch==&__=/asdf/

Effective URL:
https://r20.rs6.net/error.jsp?e=xmlhmqgbb
Redirected

The Cisco Umbrella rank of the primary domain is #9,051 of the top 1 million websitesTop 10K Site

AI Security Verdict

Moderate Risk

Confidence: 55%

4
Risk Score

Constant Contact redirect (r20.rs6.net) that landed on a generic 404 error page: no forms, scripts, or impersonation. One unverified single-source wallet-drainer report against this well-established redirector domain warrants caution but no higher rating.

Risk Factors (2)
Single-source, unverified threat-intel report (wallet drainer/phishing) naming the redirector domain r20.rs6.net — the exact domain of the scanned page
Scanned link is a redirect/tracking URL whose destination page could not be loaded (404), so the ultimate landing content behind the redirect was never observed
Safety Factors (4)
24-year-old domain (2001) with top-10K Cisco Umbrella ranking — well-established infrastructure
Page is a standard error/404 page: no forms, no credential or payment fields, no cross-origin submissions
No JavaScript malware (hunting rule), no obfuscated JS, no credential exfiltration, no IDS/Safe-Browsing alerts
Title/meta self-brand as 'Constant Contact', matching the host's own service (no impersonation of another entity)
Domain age information unavailable

Details

Page Title

Constant Contact

Scan Type

public

Domain Name Analysis

The domain name 'r20.rs6.net' uses the network infrastructure generic top-level domain (.net) with subdomain 'r20'. The second-level label 'rs6' is 3 characters long split between zero vowels and two consonants; bonus characters include 1 digit. Splitting it apart reveals two words: rs, 6. The median word length lands at 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

The requested page was not found. This could be because: + You followed a broken or out-of-date link. + Your email client cut off part of the URL of the link and we no longer recognize it. + Afile...

Page Load Overview

1.56s
Total Load Time
255 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:331 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3208.75.122.11United States
AS40444Constant Contact, Inc
165.8.131.44Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
165.8.131.53Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
53--

Detected Technologies1

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A7312D3E10E4611356D1C1C46A8933569E82D56BDDA3CEC4B4AC824CAFDAEDB8C5318E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:hMixeCsuPQF0FEoAtO9Ecb8ANRaiR6WnA7k/R+70b2AoHEemGo3j:sphxaEu56t4bTEe

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1462:AAAAEAAAAAEgAAAAAAAAAABCABAAAgABAAAAAQYQAAAAAAACABCAAQAEAQAEAAAAAAgAAAgBIACAAAAAAAACQAAgAAAAAAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:003c3c24243c0000
Perceptual Hash:b322cc993366cc9b
Difference Hash:0028284c48280000
Wavelet Hash:dcfcfce42c3c0000
Color Hash:N/A

Other Hashes

Crop Resistant:0028284c48280000

Scan History

Scan history not available

Unable to load historical scan data