Rewards Connector[.]com – Read or Fraud?

One of our readers sent us this $50 CVS reward email she received from the domain arletterfgerf.onmicrosoft.com.  But oddly, the links in this email point to a shortening service at buff.ly.  We unshortened that link to see that it will redirect you to a file on a website called RewardsConnector-DOT-com. Rewards Connector? Meaning you will be connected to your rewards?  How lovely!

Two days earlier this TDS reader also sent us a delightful email that came to her from another onmicrosoft.com address (with the subdomain “smut”) and the subject “Walmart Reward_Open Immediately”. “Will you be the next winner? Crack the egg !!” It also had links leading back to a URL shortening service, but this service was t.co.

When we unshortened this link we discovered that it sent us to a domain called mosquitonap.com.  Though this domain was registered in May, 2016, Google can’t find any information about it at all. A WHOIS lookup for mosquitonap.com shows  that it is being hosted in Munich, Germany on its own dedicated server.  Even more curious is that the Zulu URL Risk Analyzer shows another redirect waiting for you at the mosquitonap website. You’ll be redirected yet again to…. RewardsConnector-DOT-com!

So what exactly is RewardsConnector-DOT-com, and is it a legitimate marketing service for various promotions?  A WHOIS lookup  shows that the domain was registered in February, 2017 through a private, proxy service. We used five different online tools to evaluate this link, and rewardsconnector-DOT-com in general.  To its credit, all services reported the site as clean of malware and not on any known/checked blacklists of suspicious sites.  And so we visited the site…

Clicking OK redirected us to a website called researchcodes-DOT-com. This domain was registered on December 5, 2017 using a private, proxy service from the Cayman Islands.  At reseachcodes-DOT-com we were congratulated and told we have just a few minutes to take a survey about Walmart.  Questions were very broad about our shopping experiences at Walmart and even began with “are you male, female, or other.”

After taking the Walmart 8-question survey we were informed we were eligible to receive fantastic offers of valuable products for free if we only paid the small shipping cost.  Here are screenshots of these “valuable products” offered to us… (Notice the many hundreds of consumers who presumably gave these products perfect, or nearly perfect, 5-star ratings.)

We noticed, and thought it odd, that none of these products were connected to Walmart at all.  When we clicked to confirm three of these “Walmart” rewards we were redirected to the following domains:

Instantly-ageless-DOT-us
    Valubody-dot-com
    Findbeautyandtruth-DOT-com

Check out the “ATTENTION” notice at the top of each screenshot.

We could have filled in the form and clicked “Rush My Trial” but we had already seen enough. We ask our readers to apply the “smell test” to this maze of emails, redirects and websites connected to rewardsconnector-DOT-com.  Why would a legitimate marketing service keep redirecting you through other websites to get to rewardsconnector-DOT-com?  Why would they send these emails from such strange from addresses using subdomains-domains such as smut.onmicrosoft.com and arletterfgerf.onmicrosoft.com?

We have since found similar “rewards” for Amazon as well as Walmart and CVS, all pointing to rewardsconnector-DOT-com.   This Amazon reward contains a shortened URL that will send you to mosquitonap-DOT-com. And we know where mosquitonap-DOT-com will send you!

Finally, at the very bottom of the researchcodes webpage, in small print, we found the following paragraph.  READ IT CAREFULLY…

“We are not affiliated nor partnered with Walmart. Walmart has not authored, participated in, or in any way reviewed this advertisement or authorized it. The trial products offered on the last page pay this website for orders placed. * S&H charges do apply. Some of the products described on this site have terms regarding continued billing after the free trial period ends. This is referred to as negative option, or continuity billing. Therefore, it is important to ensure that you are fully aware of the terms associated with each product before you order. See manufacturer’s website for full terms and conditions before ordering your free trial as these vary by product. Please keep in mind that these are separate companies and we are not the best source for information about orders or specific policies. Because these companies control their own policies, shipping and other fees may change periodically.”

And so, dear TDS reader, what does your “smell test” tell you about rewardsconnector-DOT-com? Caveat emptor!