Is krausfitnessclub.shop safe?

A real gym name on a brand-new domain with no disclosed owner

The registrable domain is only two days old, while the page advertises a large, established club — 'SIN MASIFICACIONES 2.000 m2 PARA ENTRENAR' — and a free-registration offer tied to paying on the website. A gym with 2.000 m² of floor space and a long-standing local reputation would normally have an older domain or at least a verifiable link to its existing web presence.

Independent Spanish gym directories do list a Kraus Fitness Club in Cádiz, rated 4.9 from more than 168 Google reviews, with a published phone number. That supports the existence of the physical gym, but the site itself never cites that address or phone, so a visitor cannot confirm from the page that the same business runs this storefront.

No operator is named anywhere on the captured page: no company name, registration number, postal address or telephone. The privacy policy is unedited Shopify template text that still refers to 'My Store', and the only contact route is a free Gmail inbox rather than a mailbox on the site's own domain.

Money is taken online before the customer ever sets foot in the gym

Each membership tier ends in an 'Elegir cuota y pagar' button that leaves the site and opens a Stripe-hosted checkout on buy.stripe.com. Card details are therefore entered on Stripe's domain, not on the shop's own pages, which limits card-skimming risk but does not tell you who is on the receiving end of the payment.

The checkout is framed by a checkbox stating 'Entiendo que mi cuota empieza el primer día que acuda al gimnasio' — the fee starts on the first day the customer attends — combined with the 'MATRÍCULA GRATIS POR PAGO EN LA WEB' incentive to pay up front. In practice a visitor is asked to transfer money to an unidentified seller for a service they have not yet received, and no refund, cancellation or renewal terms were captured on the page.

Clean technical checks, unverified operator

The saved scans found nothing malicious: 0 detections across 93 engines, no browser threat feed warning, a valid encrypted connection, and a hosting IP with no abuse history. No popups, forced redirects, downloads or notification prompts were observed while the page rendered.

Those results only mean the page is not currently serving malware or phishing. They say nothing about who collects the membership money, and the combination of a two-day-old domain, an undisclosed operator and a Gmail-only contact is what keeps this out of the safe range.