Verdict
posthog.com appears legitimate.
Our checks found nothing pointing to fraud. Ordinary care still applies when you pay or sign in.
| What this site appears to be | Marketing homepage for PostHog describing product capabilities (analytics, AI-driven diagnostics, session replay, feature flags), pricing model (usage-based with generous free tiers), and calls to action to get started or explore docs. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 41 reports; shared hosting inflates reports | Clear |
| Domain age | 6.5 years oldRegistered history | Clear |
| Web archive | Archived since 20111353 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YR2 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- Domain age: 3 to 10 years (registration continuity).
- Public web-archive history exists since 2011.
- VirusTotal and Google Safe Browsing had no flags for this domain; its hosting IP carries AbuseIPDB reports below the confidence level TrustSniffer treats as a flag.
Full analysis
Overview
PostHog is a SaaS product-analytics and product-development platform whose homepage presents analytics, AI-assisted diagnostics, session replay, feature flags, experiments, managed data capabilities, usage-based pricing, and free tiers, with calls to action for starting an account or consulting documentation.
Scam/Impersonation Risk
No blacklist, phishing, malware, brand-impersonation, or conflicting-identity indicators were observed. The homepage presents a coherent software-service model rather than a financial or investment solicitation, and its claims—such as “500,000+ teams,” AI-assisted bug diagnosis, automated pull requests, and “250+ data and analysis tools”—are framed as product marketing rather than evidence of regulated status. The available evidence therefore supports an apparently legitimate, low-risk site, while the real-world operator remains independently unverified. A shared delivery address associated with 41 abuse reports is discounted because the reports apply to shared CDN infrastructure; the address is whitelisted and carries zero abuse-confidence attribution.
- The homepage identifies PostHog as a product-analytics and AI tooling service and contains no phishing, crypto, wallet, or sensitive-data collection indicators.
- The homepage includes substantive product, pricing, documentation, company, careers, and handbook content rather than a parked or imitation-site presentation.
- Domain registration telemetry: Registered 2020-01-23 (~6.55 years old), expiring 2027-01-23.
- Web-archive telemetry: 1,353 snapshots spanning 2011–2026 (16 years tracked).
Regulatory Verification Notes
PostHog’s apparent business model is commercial SaaS, with usage-based pricing, hosted or managed options, and advertised free tiers. No financial-services license or registration number is presented in the supplied site evidence; this is a disclosure point to clarify only if a proposed engagement involves a regulated activity, rather than an indication of deception. The site’s content and technical presentation are consistent with an established software provider, but the available evidence does not independently verify the legal entity operating the domain. No broker-reputation match was identified.
- The homepage describes analytics, AI-driven product workflows, managed data capabilities, integrations, and usage-based SaaS pricing.
- Transport telemetry: TLS certificate issued by YR2 at DV validation level, valid to 2026-10-12.
- Hosting telemetry: Served from AS16509 (Amazon.com, Inc.; Amazon-02), United States.
- The site holds a high page-authority classification and is ranked 2458 globally in the supplied traffic data.
What to Verify Next
Before credential or payment interactions, an enterprise or prospective customer should independently confirm the contracting legal entity, review the applicable terms, privacy documentation, service commitments, cancellation and refund provisions, and confirm that payment protections match the intended transaction. If the service is being used in a regulated operational context, the relevant regulatory register should be checked for the specific activity and jurisdiction. Official contact channels should also be confirmed through an independent source before sensitive account or billing matters are handled.
- The homepage provides links to pricing, documentation, company materials, a handbook, and a “Talk to a human” contact path.
- The observed page contained no sensitive input form, external password form, hidden form, wallet connection, or suspicious script.
- Browser behavior recorded no external POST activity, no wallet-sensitive activity, no clipboard hijacking, and no cloaking.
Summary Verdict
The available evidence is consistent with an established, apparently legitimate website and supports a high-trust, low-risk posture for ordinary SaaS discovery and use. That conclusion concerns the website’s observed trust characteristics; it does not independently prove the real-world identity of its operator.
Infrastructure Integrity
The site is protected by Cloudflare CDN/WAF infrastructure, with observed edge addresses and no origin candidates identified in the supplied infrastructure analysis. This separation reduces direct origin exposure and is a mitigating security factor, but it is not by itself proof of legitimacy.
Closing Assessment
Normal evaluation is proportionate, provided that independent merchant-identity, contractual, return or cancellation, and payment-protection checks are completed before credentials or payment details are submitted.
Written analysis generated 2026-08-11 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
No rule findings contributed to this verdict.
Signals weighed against the site
- AbuseIPDB: 41 reports on hosting IP 216.150.1.1 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of posthog.com.
- The request stayed on posthog.com. It was not redirected to another domain. Clear
- Registration is published under Amazon Registrar, Inc.. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-01-23. Noted
- The earliest public archive of this site is from 2011-01-28. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Amazon Registrar, Inc. |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 216.150.1.1 |
| Name servers | JULISSA.NS.CLOUDFLARE.COM, RORY.NS.CLOUDFLARE.COM |
| SSL issuer | YR2 |
| SSL expiry | 2026-10-12 |
| Domain age | 6.55 years (continuous registration) |
| Domain expiry | 2027-01-23 |
| Archive first seen | 2011-01-28 |
| Archive snapshots | 1353 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0% confidence, 41 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about posthog.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.