doubleksout[.]com

Analysis indicates that doubleksout.com is presently active and exhibits characteristics consistent with a phishing infrastructure. The domain returns an HTTP 302 redirect and its page title is reported as “Domain suspended”. It is listed on a single security blocklist and has been identified in one AlienVault OTX pulse. Registration information shows the registrar as Register SPA, and the authoritative nameservers are suspended1.plaindns.net and suspended2.plaindns.net. DNS resolution points to IP address 195.110.124.154, which is associated with an Italian VIP VLAN. The IP has been flagged by PhishDestroy and by VirusTotal, where 13 of 91 security vendors submitted a detection. Although the exact content served by the site has not been examined, the combination of a redirect, suspicious nameserver naming, blocklist presence, and multiple vendor detections strongly suggests malicious intent. Defenders should block doubleksout.com at the DNS and proxy layers, consider adding the IP 195.110.124.154 to network deny lists, and monitor related traffic for credential harvesting attempts. Ongoing observation is advised to confirm any changes in the domain’s behavior.