Criticalscore 60 · flagged Thursday, November 5, 2026

rockermail.app

Appeared in the .app zone on Thursday, November 5, 2026; by the end of that day the census found active website about saas & tech. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Microsoft 365
+22
brand in page title, not in the name
matched: icloud
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
ns01.agenturserver.co, ns01.agenturserver.de, ns01.agenturserver.it
First-day state
active website
HTTP status
200
Page title
RockerMail: Mail, Kalender, Kontakte und Aufgaben für den Mac
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 88%· claude-opus-5-5

The page is a German-language landing page for its own product, 'RockerMail', a Mac mail and calendar client, sold at a one-off 29,95 €. It names Microsoft 365, Gmail and iCloud only as supported account types, and its form is a beta waitlist (email, name, account-type checkboxes) with no password field. Related links (promptrocker.at, GitHub) and German agency nameservers fit a genuine small-developer site, not impersonation.

First passlooks benignconfidence 85%· claude-haiku-4-5

RockerMail is a legitimate third-party Mac email client that aggregates Microsoft 365, Gmail, and iCloud accounts—a genuine product category. The page mentions these brands as supported integrations, not impersonation; it has its own branding, pricing model (€29.95), and beta signup. The form collects email and name for beta registration, not credential theft, and links to support.microsoft.com are standard OAuth/integration documentation, not phishing decoys.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, November 5, 2026

Screenshot of rockermail.app taken by the zone census on 2026-11-05

Same data as JSON: /api/zone/domain/rockermail.app. This page is not indexed by search engines and does not link to the site it describes.