getexponentix[.]com

Analysis of the domain getexponentix.com indicates a recent, targeted impersonation campaign aimed at Zoom users. The domain was registered on December 01, 2025 through Cosmotown, Inc., and is delegated to the authoritative nameservers ns1.coldsire.com and ns2.coldsire.com. DNS resolution directs traffic to IP address 104.18.41.175, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No TLS certificate is presented for the host, meaning the site operates without HTTPS protection. Content served at the time of capture displayed the page title "Select a Date & Time - Calendly," suggesting the site was used to lure victims into scheduling a meeting, a common technique in social media phishing attacks. The domain is explicitly listed as impersonating Zoom and is categorized as a Social Media Phishing campaign.

Threat intelligence feeds have recorded the domain on two security blocklists, and it is actively blocked by PhishDestroy and ScamSniffer. The Gridinsoft trust scoring system assigns a rating of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal analysis shows that two out of ninety‑five scanning engines flagged the domain, providing additional confirmation of suspicious behavior. Despite these indicators, the site is currently taken offline, which may be a temporary takedown or a tactical pause by the operators.

Defenders should incorporate getexponentix.com into DNS filtering rules and ensure that any outbound connections to the associated Cloudflare IP are monitored or blocked. Because the site lacks SSL, network sensors can readily detect clear‑text HTTP traffic. Incident response teams should advise users, especially those with Zoom accounts, to be wary of unsolicited Calendly‑style invitations that reference Zoom meetings. Continuous monitoring of the registrar Cosmotown, Inc.