What Gridinsoft observed on Rewardcenteroffers.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825213254-4d8e0949
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review did not reproduce phishing or another harmful flow in the reviewed AT&T Rewards site. The official AT&T switcher-payoff URL delegates directly to this host, the current sensitive-data requests match that disclosed reward-redemption purpose and stay on the same protected HTTPS origin, and the public history is consistent with the same program. The active broad Phishing classification is not supported by a concrete current first-party observation; external blacklist labels remain separate contradictory context.
Analyst findings
Review 5 documented observations View evidence
The official AT&T switcher-payoff URL currently redirects to the exact reviewed host at its ETF offer. The destination links back to AT&T's official reward center, privacy, legal, wireless, and service-agreement pages, providing a reproducible delegation from the represented brand rather than an unsupported brand claim.
- Public artifact URL https://www.att.com/switcherpayoff
-
Redirect destination
https://rewardcenteroffers.com/ETF - Public artifact URL https://rewardcenter.att.com/
- Public artifact URL https://www.att.com/gen/privacy-policy
- Analyst observation The reviewed destination identifies the offer as an AT&T switcher reward and provides reciprocal navigation to official att.com and rewardcenter.att.com resources.
The root redirected only to the same-site AT&T Rewards home page. The home, ETF offer, business payoff, customer login, and AAdvantage offer pages returned HTTP 200 with consistent AT&T reward-program content. Reviewed public navigation did not produce an unrelated destination, automatic download, or an impersonated third-party login.
-
HTTP status
200 -
Redirect destination
https://rewardcenteroffers.com/Home/Entry - Page element Title: AT&T Rewards - Home Page
- Public artifact URL https://rewardcenteroffers.com/ETF
- Public artifact URL https://rewardcenteroffers.com/BusinessPayoff
- Public artifact URL https://rewardcenteroffers.com/Customer/Login
- Public artifact URL https://rewardcenteroffers.com/AAdvantageoffer
- Analyst observation No unrelated forced redirect, automatic file delivery, or third-party credential receiver was observed in the reviewed public navigation.
The ETF redemption form posts to the same HTTPS host, includes an anti-forgery token and reCAPTCHA, and requests the phone, AT&T account, contact, address, payoff, prior-provider, and prior-bill information described by the official switcher offer. The separate customer login posts only a phone number to the same host. No password, payment-card, one-time-code, seed-phrase, or private-key input was present.
- Public artifact URL https://rewardcenteroffers.com/ETF/Form
- Page element POST action: https://rewardcenteroffers.com/ETF/Form
- Page element Anti-forgery token and Google reCAPTCHA are present.
- Page element The offer requests an AT&T phone and account number, customer contact details, expected payoff amount, previous provider, and supporting previous-provider bill.
- Public artifact URL https://rewardcenteroffers.com/Customer/Login
- Page element Customer login POST input: PhoneNumber
- Analyst observation No password, payment-card, one-time-code, seed-phrase, or private-key input was found in the reviewed forms.
The apex resolved to Microsoft Azure infrastructure and presented a valid certificate for both the apex and www names. The reviewed HTTPS responses enabled HSTS, content-type protection, and same-origin framing on the forms. The domain also publishes a signed DNSSEC delegation.
- DNS fact rewardcenteroffers.com A 40.89.249.127
- Certificate fact Certificate SANs: rewardcenteroffers.com and www.rewardcenteroffers.com
- Certificate fact Valid from 2026-05-04 through 2026-11-18; issuer Go Daddy Secure Certificate Authority - G2
- Page element Strict-Transport-Security: max-age=31536000; includeSubDomains
- Page element The reviewed forms returned X-Frame-Options: SAMEORIGIN and X-Content-Type-Options: nosniff.
- DNS fact The .com registry RDAP record reports a signed DNSSEC delegation.
The public archive preserves the same AT&T Rewards ETF content from February 2025 and indexes current reward pages through August 2026. A public URL-scanner index records the host from June 2022 through August 2026, including arrivals from official AT&T email-tracking hosts and a Group O host; no malicious URLScan verdict was published for the 86 indexed observations. Public threat-intelligence entries were broad domain-list records and did not identify a malware family or concrete harmful object.
- Public artifact URL https://web.archive.org/web/20250217122159/https://rewardcenteroffers.com/ETF
- Analyst observation The archive index returned 41 distinct successful HTML capture digests for reward pages between 2025-02-17 and 2026-08-09.
- Public artifact URL https://urlscan.io/domain/rewardcenteroffers.com
- Analyst observation The public URL-scanner index returned 86 observations from 2022-06-06 through 2026-08-20, 62 with HTTP 200, and no published malicious URLScan verdict.
- Analyst observation Indexed navigation sources included app.responses.att-mail.com, message.att-mail.com, and cepublic.groupo.com.
- Analyst observation Public threat-intelligence context contained a generic phishing-list pulse and a new-domain pulse but no identified malware family, payload, file hash, or demonstrated credential receiver.
Scope and limitations
- The result applies to the publicly reachable apex and the reviewed AT&T Rewards home, ETF, business payoff, customer login, AAdvantage offer, forms, navigation, and redirect behavior at the recorded time.
- The review did not submit customer information or a previous-provider bill and did not access a private authenticated reward record.
- The review does not certify future changes or an undisclosed unlinked URL or object that was not available in the reviewed public scope.
Help protect others by sharing this page on social media! The more people who know about rewardcenteroffers.com, the fewer chances they have to deceive someone else. Help others evaluate rewardcenteroffers.com by sharing this page on social media!