Naughtycharm.com Reputation Check

The refreshed Gridinsoft report retained the broad Scam Website category but did not identify a concrete malicious URL, file, payload, hash, credential receiver, or current harmful action. Its current behavior evidence therefore did not provide a reproducible object-level basis for the broad scam description.

• Public artifact URL https://gridinsoft.com/online-virus-scanner/url/naughtycharm-com
• Page element Scam Website
• Analyst observation The refreshed report did not name an exact malicious URL, file, payload, hash, credential receiver, or reproduced harmful behavior.

Desktop requests to the apex and www roots returned the NaughtyCharm landing page with HTTP 200. Mobile requests redirected to https://m.naughtycharm.com/ and returned the same service. Direct desktop and mobile requests to the exact m host also returned HTTP 200. Registration, login, and password-recovery forms used same-origin paths.

• HTTP status 200
• Final URL https://naughtycharm.com/
• Redirect destination https://m.naughtycharm.com/
• Page element Title: NaughtyCharm
• Page element The public forms used /user/register, /site/login, and /account/remindPassword on the current site.
• Analyst observation No third-party brand impersonation, unrelated credential receiver, or request-profile-dependent off-site destination was reproduced.

The public /aff.php path identified in URL-scanner records was requested directly on the apex, www, and exact m hosts with desktop and mobile profiles. It returned the same NaughtyCharm landing and same-origin forms. Host changes were limited to naughtycharm.com, m.naughtycharm.com, and www.naughtycharm.com; no off-site redirect or executable delivery occurred in these direct requests.

• HTTP status 200
• Final URL https://naughtycharm.com/aff.php
• Redirect destination https://m.naughtycharm.com/aff.php
• Redirect destination https://www.naughtycharm.com/aff.php
• Analyst observation The directly reviewed /aff.php responses did not redirect off-site, imitate another brand, or deliver an executable or archive.

The rendered current public terms identify Media Synergy SAS at 25 place de la Madeleine, 75008 Paris as the operator. They describe user profiles and messages, automated activity notifications, optional Promotion Tools controlled by users, paid subscriptions, and automatic renewal. The terms also state that the service does not perform criminal, background, or identity checks on users and cannot guarantee every user.

• Page element Media Synergy SAS, 25 place de la Madeleine, 75008 Paris, France
• Page element SYSTEM AND ACTIVITY NOTIFICATIONS
• Page element Promotion Tools
• Page element WE DO NOT PERFORM CRIMINAL, BACKGROUND, OR IDENTITY CHECKS ON USERS.
• Page element All subscription plans renew automatically in accordance with the terms of your selected plan.
• Analyst observation These public disclosures describe intended service behavior; they do not by themselves verify how every profile, notification, message, promotion, or paid interaction operates after registration.

The reviewed apex, www and exact m hosts, affiliate landing, public forms, linked scripts, and rendered terms exposed no automatic executable download or executable/archive link. No specific malicious URL, file, payload, hash, exploit, or unrelated credential receiver was identified in the reviewed current public scope.

• Analyst observation No .exe, .msi, .dmg, .apk, or .zip link and no automatic executable download was found on the reviewed public pages.
• Analyst observation No specific malicious URL, file, payload, hash, exploit, or unrelated credential receiver was identified.
• Analyst observation A domain-level blacklist or reputation category is not equivalent to observing a concrete URL deliver malware or perform credential theft.

The apex, m, and www hosts resolved through the same Cloudflare addresses. The current certificate matched naughtycharm.com and *.naughtycharm.com and was valid from August 16 through November 14, 2026.

• DNS fact naughtycharm.com, m.naughtycharm.com, and www.naughtycharm.com resolved to 104.21.11.43 and 172.67.165.35.
• Certificate fact The certificate SAN list covered naughtycharm.com and *.naughtycharm.com.
• Certificate fact The certificate was valid from 2026-08-16T18:43:21Z through 2026-11-14T18:43:20Z.

The material service includes user profiles, private messaging, automated activity notifications, Promotion Tools, subscriptions, and paid features. No account, personal data, payment method, or message was submitted, so authenticated profiles, communications, moderation, promotions, billing, cancellation, and refund behavior could not be verified directly.

• Page element The public terms describe profiles, private communications, Activity Notifications, Promotion Tools, and paid subscriptions.
• Analyst observation No account was created and no credential, personal data, message, or payment method was submitted.
• Analyst observation The complete current user-profile and paid-interaction namespace was not publicly enumerable.
• Analyst observation A clean public landing page cannot certify every authenticated profile, notification, message, promotion, or payment interaction.