sterlingconjugategroup[.]com

PhishDestroy identifies sterlingconjugategroup.com as an active technical-support scam endpoint operating with an elevated risk profile. The domain masquerades as a legitimate Microsoft 365 portal to harvest corporate credentials and financial data. All indicators align with a multi-stage phishing campaign targeting enterprise users under the guise of “urgent security alerts.”

This domain was flagged by 7 security vendors out of 95 polled by VirusTotal, placing it above the supply-chain mean for detection accuracy. Registered through OwnRegistrar, Inc., the domain went live on June 05, 2024 and resolves to a single IPv4 address, 163.61.188.5. Despite using a Let’s Encrypt TLS certificate to appear benign, the page presents a spoofed Microsoft login form that exfiltrates captured credentials to a backend server. PassiveDNS cross-checks reveal no historical reputation, and the IP carries a low trust score consistent with newly provisioned hosting used exclusively for phishing.

To mitigate exposure, security teams should immediately block both the domain and IP at the firewall and DNS level. End-users should never enter credentials on unsolicited login pages; instead, verify the URL against the official Microsoft 365 domain list and report suspicious messages via the Microsoft Report Message add-in. If credentials have already been submitted, instruct users to rotate passwords immediately, enable multi-factor authentication, and scan endpoints for follow-on malware droppers delivered through the phishing payload.