claudesktop-app[.]gitlab[.]io

The domain claudesktop-app.gitlab.io is currently active and confirmed to be a credential harvesting phishing site impersonating a legitimate Claude AI desktop client. Analysis indicates the site targets users seeking desktop applications for the Claude AI service, presenting a fraudulent download portal designed to capture login credentials and personal information. The specific threat type is a fake software distribution point with embedded credential harvesting mechanisms. Infrastructure analysis reveals the domain resolves to the IP address 35.185.44.232 and is hosted on GitLab Pages infrastructure, as indicated by the gitlab.io subdomain. The site is flagged by 1 of 95 security vendors on VirusTotal, suggesting limited but present detection. The SSL certificate is issued by GlobalSign nv-sa, providing a veneer of legitimacy while the underlying content remains malicious. No additional blocklist entries or historical abuse reports were identified in this assessment, though the single detection on a major threat intelligence platform warrants immediate caution. Current status remains active, with no evidence of takedown or remediation at the time of analysis. Users are strongly advised to avoid interacting with this domain and to verify the authenticity of any Claude AI-related software through official distribution channels only. Organizations should consider implementing network-level blocks for the domain and IP address 35.185.44.232 to prevent potential credential compromise. Security teams are recommended to monitor for connections to this infrastructure as an indicator of compromise, particularly in environments where AI-related software is in use.