doublet[.]solly[.]cc

This domain, doublet.solly.cc, is flagged as a credential harvesting phishing portal designed to mimic legitimate login interfaces. Analysis indicates the site likely targeted users by presenting fraudulent authentication pages to capture usernames, passwords, and potentially multi-factor authentication codes. The infrastructure was configured to appear as a trusted service, increasing the likelihood of successful deception through social engineering tactics. Evidence supporting this assessment includes detection by 6 out of 95 security vendors on VirusTotal, registration through NiceNIC International Group Co., Limited, and a creation date of March 10, 2026. The domain appears on 2 security blocklists and was previously resolving to the IP address 188.114.96.3, utilizing Cloudflare and HTTP/3 for traffic obfuscation. The page title, 'solly.cc | 522: Connection timed out,' suggests recent takedown or technical failure, though the domain remains a documented threat. Users who visited doublet.solly.cc should immediately revoke any entered credentials, particularly if reused across other platforms. Monitor accounts linked to the email or username for unauthorized access attempts. Enable multi-factor authentication on all critical services and review recent login activity for anomalies. If financial or personal data was submitted, consider placing a fraud alert with relevant institutions. The domain’s current offline status does not eliminate the risk of previously collected data being exploited.