What Gridinsoft observed on flirttendre[.]com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260831222508-e4ae2861
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website — Exact-URL Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent review does not support the existing broad Scam/Phishing characterization as a reproduced technical fact: no current exact malware payload, harmful redirect, or phishing impersonation was found on the reviewed first-party surface or in accessible public scan and archive evidence. It also does not support a domain-wide Safe verdict. flirttendre[.]com operates a persistent, highly parameterized affiliate/TDS landing surface that cannot be exhaustively assessed from the available public material, while the site routes users into a disclosed auto-renewing dating subscription. The appropriate narrower treatment is Suspicious Website with exact-URL review required. A future decision should be based on the precise campaign URL and observed behavior, not a domain blacklist category alone.
Analyst findings
Review 6 documented observations View evidence
The apex, www, and m hosts returned the branded FlirtTendre dating service over HTTPS. Desktop, mobile, and crawler request profiles remained on the same service; no unrelated final redirect, automatic download, executable link, or credential form for an unrelated brand was reproduced.
-
HTTP status
200 -
Final URL
hxxps://flirttendre[.]com/ -
Final URL
hxxps://www[.]flirttendre[.]com/ -
Final URL
hxxps://m[.]flirttendre[.]com/ - Analyst observation The reviewed request profiles showed the same FlirtTendre registration service without an unrelated redirect or automatic file delivery.
The public page openly presented adult-dating registration, login, and password-recovery flows. The reviewed registration and login actions were same-site service endpoints. The terms identify Media Synergy SAS and disclose paid subscriptions, automatic renewal, trial conversion, cancellation timing, and limited refund conditions.
- Page element Registration action: /user/register
- Page element Login action: /site/login
- Page element Password recovery action: /account/remindPassword
- Analyst observation The terms name Media Synergy SAS, 25 place de la Madeleine, Paris, and describe automatically renewing paid subscription plans and cancellation requirements.
The operator-controlled aff.php endpoint is persistently used for parameterized affiliate acquisition. Public scan records contain hundreds of exact URLs with campaign and traffic-distribution parameters, including encoded upstream destination values. The reviewed current records finished on FlirtTendre pages or an access-denied page; they did not supply a captured malware file or a reproduced phishing impersonation.
- Public artifact URL hxxps://urlscan[.]io/domain/flirttendre[.]com
- Page element Exact aff.php URLs contain tds_host, tds_path, tds_campaign, tds_cid, and encoded btUrl parameters.
- Analyst observation The public urlscan index reported 732 domain results at review time; the latest returned records predominantly targeted /aff.php and ended on the FlirtTendre service.
The public web archive recorded the domain from February through July 2026. Of 201 unique successful HTML capture rows reviewed, 174 were parameterized aff.php URLs. The earliest retrievable exact affiliate snapshot rendered a FlirtTendre registration landing page and did not expose an automatic external redirect, download, or malware sample.
- Public artifact URL hxxps://web[.]archive[.]org/web/*/flirttendre[.]com/*
- Analyst observation 201 unique successful HTML capture rows were enumerated; 174 were aff.php variants.
- Analyst observation The earliest retrievable affiliate snapshot from 2026-02-28 rendered the branded registration page without an automatic download or unrelated final redirect.
Public threat-intelligence and reputation sources contained broad domain-level warnings and historical URL observations, but the accessible records did not identify a specific current malicious payload, payload hash, credential-collection endpoint impersonating another service, or exact URL with reproduced harmful behavior. URLhaus and ThreatFox required authenticated API access for the requested lookups.
- Public artifact URL hxxps://otx[.]alienvault[.]com/indicator/domain/flirttendre[.]com
- Analyst observation The public OTX domain record showed zero pulses; its collected URL records had no Google Safe Browsing match in the returned data.
- Analyst observation A broad blacklist category is not equivalent to an object-specific malware sample or a reproduced harmful redirect.
The apex, www, and m hosts resolved through the same Cloudflare-backed service. The reviewed TLS certificate was valid for the apex and wildcard host names, and certificate-transparency records also showed track.flirttendre[.]com.
- DNS fact flirttendre[.]com, www.flirttendre[.]com, and m.flirttendre[.]com resolved to 104.21.84.49 and 172.67.186.144 during review.
- Certificate fact Let's Encrypt certificate valid from 2026-08-17 through 2026-11-15 for flirttendre[.]com and *.flirttendre[.]com.
- Analyst observation Network identity and TLS validity establish the reviewed service boundary but do not by themselves establish safety or maliciousness.
Scope and limitations
- The review covered the public apex, www, and m surfaces and accessible public records; it did not access authenticated user or billing areas.
- The large dynamic aff.php parameter space and private or expired campaign combinations could not be exhaustively reproduced.
- Public urlscan search results were accessible, but full per-scan request chains required authentication for some records.
- URLhaus and ThreatFox API responses required authentication, so no negative inference is drawn from those unavailable lookups.
- No submitted exact URL, file, payload, or screenshot accompanied the ticket.
Help protect others by sharing this page on social media! The more people who know about flirttendre.com, the fewer chances they have to deceive someone else. Help others evaluate flirttendre.com by sharing this page on social media!