What Gridinsoft observed on Temptmeet.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260826194434-0e3c6c46
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Inconclusive
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current operator-controlled root, login, legal, affiliate, redirect, download, DNS, TLS, and public-index scope does not reproduce the active broad Scam Website classification or identify a current phishing receiver, malicious redirect, malware file, payload, hash, or sandbox behavior trace. That unsupported broad detection should be removed. TemptMeet also contains an authenticated member, messaging, promotional-profile, payment, and fulfillment layer that was not available for complete review, so the platform-wide independent result is Inconclusive rather than a certification that every profile or transaction is safe.
Analyst findings
Review 7 documented observations View evidence
The apex and www hosts returned the TemptMeet adult-dating registration and same-origin login surface with HTTP 200, while a mobile user agent moved to the matching m.temptmeet.com host. Plain HTTP upgraded to HTTPS. Desktop, Googlebot, and Gridinsoft user agents received the same service identity. The reviewed public navigation did not produce an unrelated credential receiver, automatic file download, or hidden external destination.
-
HTTP status
200 -
Final URL
https://temptmeet.com/ -
Final URL
https://www.temptmeet.com/ -
Final URL
https://m.temptmeet.com/ - Page element Title: TemptMeet
- Analyst observation The registration and login forms submitted to TemptMeet same-origin paths; no automatic executable, archive, or unrelated credential destination was observed.
The current Terms identify Media Synergy SAS, its Paris address, and support contacts; describe free and paid membership; disclose automatic renewal, trial conversion, cancellation, and EU withdrawal conditions; and state that partner or promotional profiles must be labeled and may not generate automated engagement. The company name, address, capital, and online-dating activity correspond to an active French business record. These disclosures identify an operating paid dating service, but they do not by themselves prove the authenticity or behavior of every member profile.
-
HTTP status
200 - Page element Media Synergy SAS, 25 place de la Madeleine 75008 Paris, France
- Page element All subscription plans renew automatically in accordance with the terms of your selected plan.
- Page element Cancel Subscription
- Page element Partner Profiles are always explicitly marked with a Partner or Promotional badge.
- Analyst observation The reviewed legal identity and stated online-dating activity matched the active French company record for SIREN 852 023 647.
The current affiliate endpoint returned HTTP 200 and served the TemptMeet registration surface. A bounded test supplied an encoded HTTPS destination on example.com through the public btUrl parameter; the response remained on www.temptmeet.com and did not redirect to that destination. The two historical Telegram-looking paths found in public URL-scan records now return HTTP 404. No current open redirect, payload delivery, or malicious destination was reproduced on these reviewed objects.
-
HTTP status
200 -
Final URL
https://www.temptmeet.com/aff.php - Analyst observation A safe example.com btUrl value did not cause external navigation and remained on the TemptMeet affiliate page.
-
HTTP status
404 - Analyst observation The reviewed historical /telegram/datingmethod123 and /telegram/datingE paths both returned not found.
The apex, www, and mobile hosts resolved through Cloudflare and presented the same valid wildcard certificate for temptmeet.com. Reviewed HTTPS responses included HSTS, same-origin framing, and content-type protections. The domain's mail policy redirects to the operator's mediasynergysas.com SPF policy. These transport and identity facts do not establish the behavior of private member content.
- DNS fact temptmeet.com resolved through Cloudflare addresses; www.temptmeet.com and m.temptmeet.com resolved through the same provider.
- Certificate fact Certificate subject temptmeet.com; SANs *.temptmeet.com and temptmeet.com; valid 2026-08-16 through 2026-11-14.
- Page element Strict-Transport-Security: max-age=63072000
- DNS fact SPF redirects to _spf.mediasynergysas.com.
The public URL-scan index returned 65 observations from March through August 2026 across the apex, www, and mobile hosts, including 45 affiliate-path observations and 13 direct root submissions. None carried a published malicious URLScan verdict. Some scans began on unrelated or suspicious traffic-source domains and ended on TemptMeet affiliate pages; this documents affiliate acquisition traffic, not a malware sample hosted by TemptMeet. The public OTX domain record had zero pulses and eleven URL observations without a Google Safe Browsing match. Public sandbox searches produced no exact-host sample result, while archive coverage contained 191 unique successful artifacts, mainly landing, affiliate, script, and image resources.
- Public artifact URL https://urlscan.io/domain/temptmeet.com
- Analyst observation 65 URL-scan observations dated 2026-03-09 through 2026-08-26: 48 www, 14 apex, 3 mobile; zero published malicious URLScan verdicts.
- Analyst observation 45 observations ended on /aff.php, and several originated on unrelated traffic-source domains; no hosted malware file, payload, or execution chain was identified.
- Analyst observation The public OTX domain record contained zero pulses and eleven URL observations with no Google Safe Browsing match.
- Analyst observation Public searches of Hybrid Analysis, ANY.RUN, Triage, and Joe Sandbox returned no exact temptmeet.com sample result.
- Analyst observation The archive index returned 191 unique successful apex/www artifacts from 2026-05-12 through 2026-08-01, dominated by affiliate landing assets and scripts rather than executable samples.
A fresh external-provider refresh changed the domain matrix from nine adverse blacklist entries to one SafeToOpen phishing label, with 56 harmless, one malicious, zero suspicious, and 33 undetected results. The remaining result is a broad domain blacklist category and did not identify a current URL, captured credential receiver, redirect target, downloaded file, payload, hash, or sandbox behavior trace. It was recorded as external context and was not used as the Gridinsoft decision basis.
- Analyst observation Fresh provider matrix: 56 harmless, 1 malicious, 0 suspicious, 33 undetected.
- Analyst observation SafeToOpen reported phishing by blacklist method without a linked current harmful object in the available report.
TemptMeet includes authenticated member profiles, private communications, paid features, billing flows, and partner or promotional profiles. No account was created, no payment was submitted, and no private profile or message exchange was available in the public ticket. The material member-content and transaction layer therefore could not be enumerated or certified from a clean landing page and public legal documents.
- Page element Free Membership and Paid Membership
- Page element Member profiles, whether belonging to active or inactive users, may remain visible on the site.
- Analyst observation The public scope did not expose a specific disputed member profile, private message, payment result, or post-purchase fulfillment object.
Scope and limitations
- No account was created, and no private member profile, message, partner-profile interaction, or moderation result was tested.
- No payment was submitted, so subscription checkout, cancellation execution, billing settlement, refund handling, and paid-feature fulfillment were not tested.
- The ticket identified only the root domain and did not supply an exact harmful profile, private message, transaction, downloaded object, or payload.
- Public search, URL-scan, sandbox, threat-intelligence, company-registry, and archive indexes are incomplete; unavailable material was not treated as clean.
- The result distinguishes removal of an unsupported broad domain detection from certification of all current or future user-controlled content.
Help protect others by sharing this page on social media! The more people who know about temptmeet.com, the fewer chances they have to deceive someone else. Help others evaluate temptmeet.com by sharing this page on social media!