Security issue

[SophiaL37]

Clearly, from the number of complaints about the IDENTICAL ISSUE, this is an error on the part of Constant Contact. The next message indicates the level of frustration with this. It needs to be addressed by Constant Contact or more of us will leave. I spent an hour on the phone with a very nice staff member, to no avail. A malware/ad program has not solved this issue. It is not a "whitelisting" fix. Please fix this. We are paying for a working product and currently, this is NOT A Working Product.

Thank you in advance for your prompt attention to this matter.

[SophiaL37]

Hello,

I am Sophia's tech man. I have researched her issue that she is having with your product:

When I ping the .com listed in the error page it shows nothing. It doesn't exist. I'm afraid you guys have a virus that redirects. If no other customers are complaining then it must be that Sophia has been targeted. It is clear that it may have come from you servers, maybe not, but you should check.

The work around is for the client to create new templates and emails. It is clearly part of the local email.

Thanks you

[TribbetB]

It doesn’t sound like a virus is what’s happening here. Isn’t the redirecting going from Constant Contact click tracking domains (rs6.com and possibly others) to whatever address the email author intends?

[Caitlin_M]

Hi @TribbetB. You are correct. The tracking link redirects the recipient to the link they clicked on in the email. Our upper level of support is following up with the original poster to do further troubleshooting. 

[Kyle_R]

Hello all,

We apologize for not following up on this thread correctly to provide updates on some of the various issues people have been running into. I'd like to clarify a few things and try to help anyone still needing it as there are several different issues rolling up in this topic:

This isn't an issue that's been persisting since 2017 that we've been ignoring. For some background, we have a Compliance team that are proactively monitoring activity around the clock in order to catch problematic accounts/emails before they cause any issues. This is something we take very seriously, as it helps ensure our emails land in the inbox which is of crucial importance. Despite those efforts, from time to time we may end up on a block list for a specific security software program or ISP for a variety of reasons. It definitely comes with the territory. When this happens, we have an ISP Relations team that works with these companies to mediate a solution. Norton being one example that was original mentioned and mentioned again recently. To be clear, these were two separate incidents. The issue is now resolved, and in the most recent incident it was resolved within a day or two. We're not currently on any major block lists that we're aware of for any anti-virus software programs. If you're seeing something now, then we definitely need to look into it. In the interest of getting information on the latest occurrence, we may ask some questions that have been repeated throughout that thread such as what the error is saying, what security programs are being used, screenshots of the error, and we may recommend whitelisting in order to get you on our way while we look into it, or as a troubleshooting step to ensure that is the software that is blocking access. 

That being said, there is a second issue that has been brought up in this thread recently which is the browser plugin uBlock Origin blocking clicked links. This is different than normal anti-virus security software in that the point of the plugin is to block ads or any server meant to track user behavior. Links in a Constant Contact email go through the r20.rs6.net URL in order to be recorded as a "click" in your campaign reporting. In that sense, the domain is used to track behavior and is blocked accordingly through uBlock origin. They aren't likely to change their policy globally to allow our domain to continue to track clicks, so it's left up to each individual using the plugin to choose whether or not they want to remove the block to individual sites. This speaks to a growing shift in the market where users want more transparency into their data and how they are being tracked.

@SophiaL37  - Based on information from your recent support interaction, your issue seems separate from both the Norton and uBlock experiences I mentioned above. Because of this I'd like to address you more specifically. The message you're receiving is a general connectivity error so it's not completely clear yet if it's stemming from any particular security software (in many cases these errors come from the software program itself and not just the Chrome error message). In order to get to the bottom of this for you we've submitted a case to our advanced level of support on your behalf. We're curious to get some more information on the workaround regarding creating new templates. As for your point about redirecting, the r20.rs6.net domain is meant to redirect to the link address. This is done in order to track as a click, this isn't a virus. Though a member of our advanced level support team will follow-up with you directly on this, I will be keeping an eye on your case as well.

[LindseyS02257]

I'm having, what I guess, is a similar issue to what's being addressed in this string.

This morning, I received the following email from a company CEO after he tried to click on a link in our most recent mailer:

"I wanted to click the link for two reasons; (1) I was interested and (2) I assume this helps the magazine stats.  Unfortunately, our IT group blocks the link.  Just yesterday, our IT expert was telling me that the way certain url links are termed shorterners and we block those because they obfuscate the full address and are a tactic in malware.  I’m only passing this along because I thought you might like to know.  I copied the IT expert on this note if you want him to talk to your expert about why we block these and I suspect others block them as well."

Is my only solution to ask the company to not block our links?

[TribbetB]

The issue in this thread isn’t exactly link shortening, although technically I suppose it’s the same thing. Link shortening services are usually talked about in the sense of being used so a link can be shorter (big surprise) to make it easier to remember, or fit in a tweet for example. The constant contact links that are causing problems are used primarily for tracking user activity.

Either way, after clicking a link to visit a URL (call it “web-address-1”), the user is forwarded to a different URL (“web-address-2”) than is coded into the link. That forwarding could be suspect itself, but I’m not clear on how or how often that behavior is blocked by IT security implementations. The more likely scenario—and what’s happening in this thread—is that the domain/website Constant Contact uses for web-address-1 has gotten on widely used lists of spam and malware.

You can ask your IT department to unblock traffic to that Constant Contact domain and it would probably work for anyone on your corporate network. But that’s not the real problem — getting it unblocked on your customers’ systems is the goal...but of course that’s not realistic. I’d be checking with a sample of your customers to see if they have trouble visiting these links, and have them a number of common scenarios like using their phone, using their computer, and at work, at home, etc. If these links are blocked in a significant number of those scenarios, you’ll want to switch to a different linking service (if Constant Contact allows this; I’m not sure).

EDIT: I misread your post the first time; I see this isn’t YOUR CEO having an issue, but one of your customers or readers. That’s good evidence that this is a significant issue for you. You have a number of options, but one you might look into is using Google campaign specific URLs if you use Google Analytics, or the alternative for whatever other analytics you use (this is assuming you’re in the US and GDPR doesn’t apply).

[Frankie_P]

Hi @TribbetB 

Thank you for sharing these workarounds here in the Community! We hope other users find this information helpful as well.

[Frankie_P]

Hi @LindseyS02257  

I apologize you too are seeing this happen with the links in your email. Having your company whitelist Constant Contact in your security settings is a step we suggest when troubleshooting. There have been times where making this update has helped. However if whitelisting does not change your experience we then ask for the details mentioned in this thread. These details being:

- Are they on a home or work network?
- When did this issue begin occurring?
- Are live sends affected or only test sends?
- What is the name and version of the security product being used?

In these cases we ask that you please email us this information along with a copy of the affected email to social_support(at)constantcontact(dot)com.