Is kitpapa.com safe?
http://kitpapa.com/
Checked on
How we checked
Coverage: strong · 5 of 6 applicable core capabilities
- Antivirus (59 of 93 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
KitPapa is a real, working Elementor template shop, but buyers report broken downloads and the operator stays anonymous
KitPapa sells ready-made WordPress/Elementor templates, plugins and digital products, including a countdown-priced 'Buy All – Lifetime Access' bundle and a large categorised catalogue with a small free section. The storefront is live and technically clean, and the domain is about 4 years 2 months old. What pulls the score down to Moderate Risk is the customer side: independent an independent review platform's reviewers describe missing template files, failed imports and a lifetime package that did not deliver, while the site names no company, address, phone or email and offers only a web form for contact. That is a delivery-quality and accountability problem rather than a demonstrated fraud or malware operation.
Saved site captureCaptured safely during this scan1 antivirus engine flagged this URLGridinsoftSaved antivirus result from Nov 1, 2026At a glance
Saved with this scan; each value is explained in the sections below.
Domain age
4 years old
Registered Sep 9, 2022Expires Sep 9, 2027Certificate
Valid
Expires Dec 29, 2026 (47d)Hosting
United States (US)
HOSTINGER-HOSTINGPopularity
Not in the Cloudflare Radar top list
Antivirus
1/59
1 antivirus engine flagged this URLSafe Browsing
Not flagged
Not flagged on major threat listsCommunity
No reviews yet
Checked
Nov 12, 2026
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 62/100
Moderate Risk covers scores 45–69. 4 findings pulled the score down; 4 pushed it up.
- Start65
- -3
- Score62
What pulled the score down
- ModerateThe Terms page uses generic template wording, including a hosting-provider blurb, rather than naming the trading company.-3 pts
- Moderate1 antivirus result marked the URL as suspicious. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- MinorAn independent review platform's reviewers report missing template files, failed imports and a lifetime package that did not meet expectations.
- MinorNo direct contact email was found on the captured page, and the registrant is shielded by a privacy service.
What pushed the score up
- SupportsThe site is a working catalogue of WordPress/Elementor templates with paid categories and a free section, not a placeholder page.
- SupportsThe registrable domain is about 4 years 2 months old.
- SupportsSafe Browsing is clean, TLS is valid and the hosting IP has no abuse reports.
- SupportsLinks to 15 social profiles.
Points come from the saved evidence ledger: it lowered the score from 65 to 62 and split those 3 points between the findings that show points; the others carry no points in the ledger.
01 · Investigation Brief
Investigation Brief
KitPapa sells ready-made WordPress/Elementor templates, plugins and digital products, including a countdown-priced 'Buy All – Lifetime Access' bundle and a large categorised catalogue with a small free section. The storefront is live and technically clean, and the domain is about 4 years 2 months old. What pulls the score down to Moderate Risk is the customer side: independent an independent review platform's reviewers describe missing template files, failed imports and a lifetime package that did not deliver, while the site names no company, address, phone or email and offers only a web form for contact. That is a delivery-quality and accountability problem rather than a demonstrated fraud or malware operation.
A live template marketplace with a countdown bundle offer
The homepage presents 'READY WORDPRESS TEMPLATES' with the flow 'Download – Import – Website is LIVE!', a search box and a category sidebar listing paid categories such as Service Business (66), Business (49) and Agency (39) alongside 'Free Themes (4)'. Product cards include named templates like 'Muscleup- Supplement Landing Page Elementor Template', 'AdGuru' and 'Protego'.
The main commercial push is a top banner with a running countdown next to 'Buy All – Lifetime Access – $49 Only ($299)' and an orange 'Grab The Deal' button, with a 'Buy All' button repeated in the header. The purchase path stays on the same domain, and no cross-site payment or affiliate redirect was captured in the link graph; the only outbound links are social profiles and a credit to a terms-template site.
The site describes itself as building premium WordPress templates, plugins and digital products and says it helps 'hundreds of companies, startups and individuals'. It publishes About, Terms, Refund, Delivery and Contact pages, and the refund terms limit refunds to the first 7 days of the original purchase, with delivery treated as complete once the download or emailed instructions are provided.
Buyers report missing files and failed imports, and nobody is named behind the shop
Independent an independent review platform's reviews of the domain describe templates with missing files and imports that fail, including on the lifetime package: one reviewer says the download package did not even include the style.css file needed for installation, and another says the promised monthly template uploads have barely happened for what seems like years. These are customer-experience complaints about product quality and support, not reports of malware or stolen payment data.
Not every review is negative — one reviewer describes a consistently great experience with the support team — so the picture is mixed rather than uniformly bad.
The accountability gap matters more than the complaints themselves. No direct contact email was found on the captured page, and the Terms page reads as a generic template, including a blurb praising the hosting provider rather than identifying the trading company. The registrant is shielded by a privacy service. Combined with a 7-day refund window and delivery deemed complete on download, a buyer who receives a broken package has limited recourse.
No malware or phishing evidence, only one stale engine flag
The browser threat feed returned no threat warning, the saved TLS check found a valid encrypted connection, and the hosting IP carries an abuse confidence score of 0/100 across 0 saved reports. The site also links to a substantial set of social profiles, which is consistent with an operating brand.
The only adverse technical signal is a single saved antivirus result marking the URL suspicious, from a stale observation; the rest of the engines returned harmless. That is a low-confidence flag, not a detection consensus, and it does not by itself indicate a malicious download.
The domain is about 4 years 2 months old, which fits an established storefront rather than a throwaway shell site.
Why the score is 62
02 · Security Evidence
Security evidence
Antivirus Engines
1/ 93
detectionsSaved analysis from November 1, 2026 - stale
1 engine flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 0
- Suspicious
- 1
- Total
- 93
- Suspicious1
- Clean58
- Undetected34
| Engine | Finding |
|---|---|
| GridinsoftSuspicious | suspicious |
All 93 engine results
- Gridinsoft - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Unrated
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- alphaMountain.aiBusiness/Economy, Information Technology
- BitDefenderhosting
- Forcepoint ThreatSeekershopping
- Googletechnology
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual context from the captured page
Top banner shows a countdown timer (00 Days 03 Hours 02 Minutes 21 Seconds) next to 'Buy All – Lifetime Access – $49 Only ($299)' with an orange 'Grab The Deal' button. Header displays the 'Kitpapa' wordmark, a $0.00 cart, 'My Account' and 'Buy All' buttons. Hero reads 'READY WORDPRESS TEMPLATES' with subline 'Download – Import – Website is LIVE!' and a template search box. Category sidebar lists paid categories (Service Business 66, Business 49, Agency 39) plus 'Free Themes (4)'; product cards show template thumbnails such as 'Muscleup- Supplement Landing Page Elementor Template', 'AdGuru' and 'Protego'. A green 'Live Chat' floating widget is visible bottom-right.
What the captured page showed
5 observations- 01
Top banner shows a countdown timer (00 Days 03 Hours 02 Minutes 21 Seconds) next to 'Buy All – Lifetime Access – $49 Only ($299)' with an orange 'Grab The Deal' button.
- 02
Header displays the 'Kitpapa' wordmark, a $0.00 cart, 'My Account' and 'Buy All' buttons.
- 03
Hero reads 'READY WORDPRESS TEMPLATES' with subline 'Download – Import – Website is LIVE!' and a template search box.
- 04
Category sidebar lists paid categories (Service Business 66, Business 49, Agency 39) plus 'Free Themes (4)'; product cards show template thumbnails such as 'Muscleup- Supplement Landing Page Elementor Template', 'AdGuru' and 'Protego'.
- 05
A green 'Live Chat' floating widget is visible bottom-right.
Browser behavior
What our isolated browser recorded while it loaded the page. Host names only: no full addresses are published.
- Pop-ups
- 0
- Download attempts
- 0
- Notification prompts
- 0
- Navigations
- 1
- Other hosts contacted
- 8
Where the page went
- First loadkitpapa.comSame site
Hosts on our aggressive-advertising list
None contacted.
Test clicks
No test click was made on this page.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
KitPapa - The Ultimate WordPress Template Marketplace
Pages we read
- Main page/Read
- About page/about-us/Read
- Terms/terms-of-service/Read
- Refund / returns policy/refund-policy/Read
- Shipping policy/delivery-policy/Read
- Contact page/contact/Read
03 · Investigation Story
Investigation story
What the site claims
KitPapa - The Ultimate WordPress Template Marketplace
What we observed
The page content was captured and checked alongside 59 antivirus results.
What independent research found
7 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
No threat category confirmed
Service and business model
Shop
Observed behavior
Evidence behind this classification
- 01Refunds are limited to the first 7 days of purchase and delivery is treated as complete on download.
- Also 6 listed under Why 62/100 above
Web research findings
Independent findings for kitpapa.com, including public complaints, named review sources, registration records, and look-alike-domain evidence.
- Trustpilotopen
"Many templates have missing files, and some templates fail to import successfully. I purchased the lifetime package, but it hasn’t met expectations."
- Trustpilotopen
"the download package didn’t even include the style.css file, which is essential for installation"
- Trustpilotopen
"Their website claims they upload five new templates every month, yet there have been little to no real updates for what seems like years."
- Trustpilotopen
"I’ve had a consistently great experience with the Kitpapa support team."
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domainkitpapa.com
- Redirects tokitpapa.com
- Hosted byHOSTINGER-HOSTING
- Referencesgoogletagmanager.com · fonts.googleapis.comand 4 more
Domain Timeline
- Sep 9, 2022Domain registered
First appeared in WHOIS records — 4 years old when this review was saved.
- Nov 12, 2026Saved security review — Rated Moderate Risk
The evidence in this saved scan is mixed or incomplete; the completed checks are detailed above.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
- Links to 15 social profiles.
Domain & Encryption
At the scan on Nov 12, 2026: 84% of the registration period had passed
At the scan on Nov 12, 2026: 48% of the validity period had passed
Certificate issued for kitpapa.com.
A shared content-delivery network address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Analytics and ads
- Google Tag Manager
Scripts, fonts and CDNs
- Google Fonts
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1301http://kitpapa.com/
- 2200https://kitpapa.com/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
Grouped by what each domain is for. in page: named in the page’s HTML. contacted: the browser loaded it while rendering the page. ad list: on our aggressive-advertising list.
Advertising2
- ad.doubleclick.netcontacted
- stats.g.doubleclick.netcontacted
Analytics & tracking3
- analytics.google.comcontacted
- google-analytics.comcontacted
- googletagmanager.comin pagecontacted
CDN & fonts2
- fonts.googleapis.comin pagecontacted
- fonts.gstatic.comin pagecontacted
Platform & social3
- facebook.comin page
- google.comcontacted
- youtube.comin page
Other / unknown1
- kitninja.comin page
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
unknownMalware, phishing, credential theft and hostile infrastructure.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 1 of 93 engines flagged | Limited | Adverse | stale fallback · analysed Nov 1, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 12, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Nov 12, 2026 |
| Visual evidence | 5 visible observations saved with the page capture | Completed | No adverse finding | this scan · Nov 12, 2026 |
| Independent research | 7 independent findings were saved | Completed | No adverse finding | this scan · Nov 12, 2026 |
- Antivirus
- Result1 of 93 engines flagged
- CompletionLimitedFindingAdverse
- Freshnessstale fallback · analysed Nov 1, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 12, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 12, 2026
- Visual evidence
- Result5 visible observations saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 12, 2026
- Independent research
- Result7 independent findings were saved
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 12, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is kitpapa.com a scam or is it safe?
Is kitpapa.com safe to use?
Has kitpapa.com been flagged by antivirus engines?
Is kitpapa.com on any phishing or malware blacklists?
How old is the kitpapa.com domain?
Does kitpapa.com have a valid SSL certificate?
Where is kitpapa.com hosted?
How often is the kitpapa.com report updated?
08 · Final Verdict
Final verdict
KitPapa is a real, working Elementor template shop, but buyers report broken downloads and the operator stays anonymous
KitPapa sells ready-made WordPress/Elementor templates, plugins and digital products, including a countdown-priced 'Buy All – Lifetime Access' bundle and a large categorised catalogue with a small free section. The storefront is live and technically clean, and the domain is about 4 years 2 months old. What pulls the score down to Moderate Risk is the customer side: independent an independent review platform's reviewers describe missing template files, failed imports and a lifetime package that did not deliver, while the site names no company, address, phone or email and offers only a web form for contact. That is a delivery-quality and accountability problem rather than a demonstrated fraud or malware operation.
09 · Community
Community
Are you the owner of kitpapa.com?Verify and reply