Paranoid Merchants on double spending How can merchants be alerted of Double-spending attacks? Let us take a hypothetical case where a merchant offer a BTC deposit wallet to his users, User deposits Bitcoins and it's credited to his account on 6 confirmations. Let's say, theoretically, the attack has been pulled off and he got his bitcoins back + the funds on the wallet remained as the database haven't been updated due to no alerts of any double spend attacks.

Question regarding this scenario:


How can merchant be alerted of any double-spend attacks ?
Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals
How safe is it to run an out of the box Bitcoin Daemon?
Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?
Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?
If a double-spend attack is pulled off, how to manually verify transactions via the bitcoin daemon and how to know how much amount lost ? Will the saved transaction hash can be re-usable to obtain info about the transactions using gettransaction?
How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?


:::UPDATES:::

I've read most of the answers and seems nobody is able to answer this question:


If a double-spend attack is pulled off, how to manually verify transactions via the bitcoin daemon and how to know how much amount lost ? Will the saved transaction hash can be re-usable to obtain info about the transactions using gettransaction?
Will the attack be able to pull off after 48 hours?
How can merchant be alerted of any double-spend attacks ?


Running their own daemon will achieve that. 


  Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals


Any backend services run by a merchant need to be able to handle block chain reorganisations anyway! They happen normally, randomly, and without malice. Shutting down is obviously not an option for an event which happens more than once a day. Not handling this behaviour will open the merchant up to rampant theft. 


  How safe is it to run an out of the box Bitcoin Daemon?


Reasonably, the daemon is generally considered to be safe and is written in a language that is normally considered to be safe (C++). However, there have been potential code execution problems due to OpenSSL library and miniupnp. A good node would be at a minimum in a different user account, not not different hardware from production services. 


  Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?


Bitcoin XT is irrelevant. The Bitcoin Core software does not handle alerting you to this, however the best canonical chain changing makes it fairly obvious through the RPC interface. 


  Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?


No. Bitcoin Core is extremely intensive on CPU, IO and memory. It is an extremely harsh test of hardware and will frequently find underlying issues like disk and RAM failure better than any other test- at the cost of your stability. You don't want a vulnerable web server next to something storing money. 


  How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?


Perhaps unlikely.