Is penpalkit.com safe?
http://penpalkit.com/
Checked on
How we checked
Coverage: complete · 6 of 6 applicable core capabilities
- Antivirus (57 of 93 engines answered): completed
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
Two-day-old Shopify subscription store for injection supplies, with no phone number or postal address and an unverified operator
Pen Pal (penpalkit.com) is a Shopify-based store selling a monthly "Shot Day Supplies" box for $32 a month, aimed at people who inject weekly medication. The domain is only two days old, the site lists no phone number or postal address, and the only operator name shown is "Ooster Labs" in the footer. Technical checks are clean — no malware detections, no Safe Browsing warning, and a valid encrypted connection — but those checks say nothing about whether the operator is trustworthy. Because the store is brand new, the operator is unverified, and the site itself states it does not sell or prescribe medication, this is a moderate-risk purchase rather than a confirmed scam.
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 58/100
Moderate Risk covers scores 45–69. 1 finding pulled the score down; 1 pushed it up.
What pulled the score down
- MinorThe captured page lists no phone number and no operator postal address, leaving no verifiable way to contact the business.
What pushed the score up
- SupportsNo malware detections, no Safe Browsing warning, and a valid encrypted connection were found.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor). Community reviews never change the Safety Score.
01 · Investigation Brief
Investigation Brief
Pen Pal (penpalkit.com) is a Shopify-based store selling a monthly "Shot Day Supplies" box for $32 a month, aimed at people who inject weekly medication. The domain is only two days old, the site lists no phone number or postal address, and the only operator name shown is "Ooster Labs" in the footer. Technical checks are clean — no malware detections, no Safe Browsing warning, and a valid encrypted connection — but those checks say nothing about whether the operator is trustworthy. Because the store is brand new, the operator is unverified, and the site itself states it does not sell or prescribe medication, this is a moderate-risk purchase rather than a confirmed scam.
A brand-new subscription box with an unverified operator
The store sells a recurring "Shot Day Supplies" box for $32 a month, described on the page as a hard case, clear dots, alcohol prep pads, a shot-side tracker and a pouch of chews, delivered the same week each month. The primary call to action is a subscription, not a one-off purchase, so a visitor is signing up for an ongoing charge rather than a single order.
The registrable domain is only two days old, and the footer identifies the operator only as "Ooster Labs" with a 2026 copyright line. No phone number and no operator postal address appear on the captured page, so there is no way to verify who is behind the store or where they are located.
The site does state plainly that it makes accessories for people who inject weekly medication, that it does not make, sell or prescribe medication, and that nothing on the site is medical advice. That disclaimer is a point in its favour, but it does not establish that the operator is legitimate or that orders will be fulfilled.
Clean technical checks, but no established reputation
The saved technical checks are clean: zero malicious and zero suspicious detections across 93 engines, no browser threat feed threat warning, and a valid encrypted connection. These results mean no known malware or phishing was detected at the time of the scan; they do not vouch for the operator or the store's business practices.
The operator-side picture is weaker. The domain is two days old, the only named entity is "Ooster Labs" in the footer, and the site provides no phone number or postal address. A brand-new store with no verifiable contact details and no independent track record is a real risk for a recurring subscription, because a buyer has little recourse if the box does not arrive or the charge continues.
The store runs on Shopify, and the page links to Shopify's privacy policy, which is a normal platform arrangement rather than a sign of fraud. It does mean the checkout and payment handling are likely handled by Shopify's infrastructure, but it does not verify the merchant behind the store.
Why the score is 58
The captured page lists no phone number and no operator postal address, leaving no verifiable way to contact the business. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
0/ 93
No detectionsFresh result
No detections across 57 engines that rated this URL
No antivirus engine that answered raised an adverse result; 36 had no rating for this URL. This is one signal, not a guarantee.
- Malicious
- 0
- Suspicious
- 0
- Total
- 93
All 93 engine results
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Unrated
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- Forcepoint ThreatSeekernewly registered websites
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
Shot day, delivered. A hard case, a month of clear dots, a month of alcohol prep pads, the shot side tracker, and a pouch of chews you pick. One box, the same week each month. $32, and the case is on us.
What the captured page showed
1 observation- 01
Shot day, delivered. A hard case, a month of clear dots, a month of alcohol prep pads, the shot side tracker, and a pouch of chews you pick. One box, the same week each month. $32, and the case is on us.
What the page says about itself
What the site says about itself, quoted from the pages we read. The site wrote these words; they are not our findings.
- Page title
GLP-1 Shot Day Supplies, Delivered Monthly | Pen Pal
- Meta description
GLP-1 shot day supplies in one monthly box: prep pads, clear after covers, your pick of chew and a shot side tracker. Free case with your first box.
Pages we read
- Main page/Read
- Terms/policies/terms-of-serviceRead
- Refund / returns policy/policies/refund-policyRead
03 · Investigation Story
Investigation story
What the site claims
GLP-1 Shot Day Supplies, Delivered Monthly | Pen Pal
What we observed
The page content was captured and checked alongside 57 antivirus results.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
The checks completed, but ownership, business claims, and future site behavior can still change after this snapshot.
What kind of site and risk is this?
Threat category
No threat category confirmed
Service and business model
Shop
Observed behavior
Evidence behind this classification
- 01The registrable domain is only two days old, so the store has no operating history to assess.
- 02The captured page lists no phone number and no operator postal address, leaving no verifiable way to contact the business.
- 03The footer names "Ooster Labs" as the operator, but no registration or location details are provided.
If this is a scam — what it means for you
What a visitor actually does and what they are exposed to
A visitor who clicks the main call to action is signing up for a $32-a-month subscription for a monthly supplies box, not a single purchase. That means an ongoing charge and an ongoing expectation of delivery from an operator whose identity and location are not disclosed on the site.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
If the box does not arrive or the subscription is difficult to cancel, the visitor has no phone number and no postal address on the site to escalate to, and the only named entity is "Ooster Labs" in the footer. That combination makes resolving a problem harder than it would be with an established retailer.
Treat this as a moderate-risk purchase. The technical checks are clean and the site is upfront that it does not sell medication, but the domain is two days old, the operator is identified only as "Ooster Labs" with no phone number or postal address, and the main offer is a recurring $32-a-month subscription. If you want to try it, use a payment method with chargeback protection, confirm the cancellation terms before subscribing, and be aware that there is no independent track record for this store yet.
Web research findings
Independent findings for penpalkit.com, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for penpalkit.com. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainpenpalkit.com
- Redirects topenpalkit.com
- Hosted byShopify, Inc.
- Referencescdn.shopify.com · fonts.googleapis.com
Domain Timeline
- Oct 27, 2026Domain registered
First appeared in WHOIS records — 2 days old when this review was saved.
- Oct 29, 2026Saved security review — Rated Moderate Risk
The evidence in this saved scan is mixed or incomplete; the completed checks are detailed above.
penpalkit.com was registered very recently when this review was saved. Freshly-registered domains are disproportionately used for scams, so a young domain whose evidence is mixed or incomplete warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No phone number listed on the captured page.
- No operator postal address visible on the captured page.
- Contact email on the site's own domain (team@penpalkit.com).
Domain & Encryption
A certificate issued weeks or days before the scan on a domain registered recently is common on short-lived sites, though new legitimate sites look the same.
Certificate issued for penpalkit.com.
A shared content-delivery network address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Analytics and ads
- Microsoft Clarity
Chat, reviews and email
- Klaviyo
Scripts, fonts and CDNs
- Google Fonts
Payment providers the page loads
- Shop Pay
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1301http://penpalkit.com/
- 2200https://penpalkit.com/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruscomplete
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
unknownMalware, phishing, credential theft and hostile infrastructure.
No confirmed evidence in this dimension.
Operator / customer risk
unknownComplaints, withdrawals, business conduct and commercial traps.
The captured page lists no phone number and no operator postal address, leaving no verifiable way to contact the business.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 0 of 93 engines flagged | Completed | No adverse finding | fresh · analysed Oct 29, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 29, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 29, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Oct 29, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Oct 29, 2026 |
- Antivirus
- Result0 of 93 engines flagged
- CompletionCompletedFindingNo adverse finding
- Freshnessfresh · analysed Oct 29, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 29, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 29, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 29, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 29, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is penpalkit.com a scam or is it safe?
Is penpalkit.com safe to use?
Has penpalkit.com been flagged by antivirus engines?
Is penpalkit.com on any phishing or malware blacklists?
How old is the penpalkit.com domain?
Does penpalkit.com have a valid SSL certificate?
Where is penpalkit.com hosted?
How often is the penpalkit.com report updated?
08 · Final Verdict
Final verdict
Two-day-old Shopify subscription store for injection supplies, with no phone number or postal address and an unverified operator
Pen Pal (penpalkit.com) is a Shopify-based store selling a monthly "Shot Day Supplies" box for $32 a month, aimed at people who inject weekly medication. The domain is only two days old, the site lists no phone number or postal address, and the only operator name shown is "Ooster Labs" in the footer. Technical checks are clean — no malware detections, no Safe Browsing warning, and a valid encrypted connection — but those checks say nothing about whether the operator is trustworthy. Because the store is brand new, the operator is unverified, and the site itself states it does not sell or prescribe medication, this is a moderate-risk purchase rather than a confirmed scam.
09 · Community
Community
Are you the owner of penpalkit.com?Verify and reply