claude-desktop-lm[.]gitlab[.]io

This domain, claude-desktop-lm.gitlab.io, is actively engaged in phishing operations impersonating an AI desktop client application to harvest user credentials and sensitive information. Analysis confirms the domain is currently active and operating under the guise of legitimate software distribution, posing a high-risk threat to unsuspecting users. Infrastructure analysis reveals the domain resolves to IP address 35.185.44.232 and is hosted through GitLab Pages, a platform commonly used for legitimate web hosting but exploited in this instance. Security vendor assessments indicate that 1 of 95 VirusTotal engines has flagged this domain as malicious, reflecting early detection but limited widespread recognition. The SSL certificate is issued by GlobalSign nv-sa, providing a superficial layer of legitimacy while failing to mitigate the underlying threat. No historical creation date or additional blocklist entries were identified in available datasets, suggesting this may be a recently deployed campaign. Current status confirms the domain remains active and operational, continuing to serve phishing content. Users and organizations are strongly advised to block access to this domain at the network level and implement endpoint protection rules to prevent interaction. Security teams should monitor for connections to 35.185.44.232 and review logs for any prior access attempts. Given the domain's hosting on a reputable platform, additional scrutiny of similar subdomains under gitlab.io is recommended to identify potential copycat threats. Immediate reporting to the hosting provider is encouraged to facilitate takedown procedures.