auth.budwerk-b2b.de
Open in
urlscan Pro
172.67.205.67
Malicious Activity!
Public Scan
Submission: On March 23 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on February 22nd 2023. Valid for: 3 months.
This is the only time auth.budwerk-b2b.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DKB (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 172.67.205.67 172.67.205.67 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 185.85.0.236 185.85.0.236 | 20546 (SOPRADO-ANY) (SOPRADO-ANY) | |
7 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
dkb.de
www.dkb.de — Cisco Umbrella Rank: 200374 |
504 KB |
3 |
budwerk-b2b.de
1 redirects
auth.budwerk-b2b.de |
14 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
5 | www.dkb.de |
auth.budwerk-b2b.de
|
3 | auth.budwerk-b2b.de |
1 redirects
auth.budwerk-b2b.de
|
7 | 2 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.budwerk-b2b.de GTS CA 1P5 |
2023-02-22 - 2023-05-23 |
3 months | crt.sh |
www.dkb.de DKB CA 1O1 |
2022-09-26 - 2023-10-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://auth.budwerk-b2b.de/DE/lotq1zju=/
Frame ID: 60F59048FFA12FCDC4D93B750304972A
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
DKB - Deutsche Kreditbank AG - Internet BankingPage URL History Show full URLs
-
https://auth.budwerk-b2b.de/DE/lotq1zju=
HTTP 301
https://auth.budwerk-b2b.de/DE/lotq1zju=/ Page URL
Page Statistics
35 Outgoing links
These are links going to different origins than the main page.
Title: Aktivkundenvorteile
Search URL Search Domain Scan URL
Title: Freunde werben
Search URL Search Domain Scan URL
Title: Girokonto
Search URL Search Domain Scan URL
Title: Karten
Search URL Search Domain Scan URL
Title: Sparen
Search URL Search Domain Scan URL
Title: Investieren
Search URL Search Domain Scan URL
Title: Kredite
Search URL Search Domain Scan URL
Title: Baufinanzierung
Search URL Search Domain Scan URL
Title: Zusatzleistungen
Search URL Search Domain Scan URL
Title: Services
Search URL Search Domain Scan URL
Title: Geschäftskunden
Search URL Search Domain Scan URL
Title: DKB Backstage
Search URL Search Domain Scan URL
Title: Erlebe die NFL-Premiere in Deutschland! Gewinne jetzt mit etwas Glück Tickets für das NFL-Spiel am 23.03.2023 in München. Dazu musst du dich nur registrieren und dann 3x deine Visa Karte nutzen. Sei dabei!
Search URL Search Domain Scan URL
Title: Zur DKB-Verwalterplattform
Search URL Search Domain Scan URL
Title: Zur DKB-Treuhänderplattform
Search URL Search Domain Scan URL
Title: Sicherheit im Banking
Search URL Search Domain Scan URL
Title: Internetbetrug erkennen
Search URL Search Domain Scan URL
Title: Karte sperren
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: Youtube
Search URL Search Domain Scan URL
Title: LinkedIn
Search URL Search Domain Scan URL
Title: TikTok
Search URL Search Domain Scan URL
Title: Kreditkarte
Search URL Search Domain Scan URL
Title: Online-Depot
Search URL Search Domain Scan URL
Title: Privatkredit
Search URL Search Domain Scan URL
Title: Studierendenkonto
Search URL Search Domain Scan URL
Title: Geschäftskonto
Search URL Search Domain Scan URL
Title: DKB-Apps
Search URL Search Domain Scan URL
Title: Sicherheit im Banking
Search URL Search Domain Scan URL
Title: Visa Secure
Search URL Search Domain Scan URL
Title: Card Control
Search URL Search Domain Scan URL
Title: Finanzwissen
Search URL Search Domain Scan URL
Title: Geldautomaten suchen
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://auth.budwerk-b2b.de/DE/lotq1zju=
HTTP 301
https://auth.budwerk-b2b.de/DE/lotq1zju=/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
auth.budwerk-b2b.de/DE/lotq1zju=/ Redirect Chain
|
62 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb-global.css
www.dkb.de/wro/ |
237 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ruxitagentjs_ICA2Vfhjqrux_10245220704125537.js
auth.budwerk-b2b.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb_responsive.min.css
www.dkb.de/responsive/scss_generated/ |
601 KB 147 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
product-global.js
www.dkb.de/wro/ |
537 KB 139 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb-global.js
www.dkb.de/wro/ |
563 KB 142 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb-global-print.css
www.dkb.de/wro/ |
221 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
709 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
475 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
208 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
846 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
948 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
686 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
944 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
856 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
669 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
864 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
911 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DKB (Banking)171 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| Base64 object| Abaxx undefined| $ function| jQuery function| DP_jQuery_1679529967688 object| Handlebars function| bindModalOverlay function| handleLinkToModalFromAModal function| addEvent function| toggleAll function| toggleDisabledSelect function| showInfoPopUp function| markAsRead function| getParent function| callInProgress function| showFailureMessage function| hideShowCovered function| getAbsolutePos function| setDateFields function| replaceSpecialChars function| specialCharMap function| getNumberFromInput function| setInputToNumber function| dkbModalOverlay object| SEPA_2_0 function| setCreditorAccountNoIbanLabel function| isDynaTraceAvailable number| lastBrowserSleepCheck object| browserSleepCheckCallback number| browserSleepCheckInterval function| browserSleepCheck boolean| jsMediaQueryInitialized function| initializeJsMediaQuery function| mediaQueryBySize function| mediaQueryXXSmall function| mediaQueryXSmall function| mediaQuerySmall function| mediaQueryMedium function| mediaQueryLarge function| mediaQueryXlarge function| mediaQueryXXLarge function| matchMediaQuery function| is_xxsmall_up function| is_xsmall_up function| is_small_up function| is_medium_up function| is_large_up function| is_xxsmall_only function| is_xsmall_only function| is_small_only function| is_medium_only function| is_large_only function| is_touch_device function| is_small_and_down function| is_medium_and_down boolean| was_small_down boolean| was_medium_down function| initResponsive function| handleDatepickerDialog function| closeDialog function| handleSize undefined| lastDetectedViewportConst function| hasViewPortChanged function| detectedCurrentViewportConst function| handleTypeNumber function| expandableTableToggleDetailsRow function| handleRowSpan function| addDetailRow function| handleNewRowOnSmall function| forceRepaintingcheckboxOnChange function| createValueDateRow function| bindOwlCarouselStartseite function| tryFormatDate function| initTooltips function| showTooltippHover function| hideTooltippHover function| showTooltipp function| closeToolTipOnTouchStart function| hideTooltipp function| handleHeadlineForApplicationNav function| nullOrEmpty function| is_android function| is_app function| is_ipad function| div2 function| div function| enhanceTablePager function| css_browser_selector function| addFixForOpenKeybordOnMobile function| labelFocus function| handleError function| initTabmodulJsVersion function| handleTabClicked function| fixPushTanHintMessage function| hasLocalStorage function| forceViewportDesktop function| openMobileMenu function| closeMobileMenu function| handleMultilineSelectCheckbox function| updateCheckboxStateToParentSpan function| chiptanResponsive number| chipTanWhenLoadedIndex function| handleChipTanWhenLoaded function| handleWebtreckId function| initInputFileds function| initTANInput function| cleanWhitespaces function| replaceSpecialChar function| replaceUmlaute function| replaceSpace function| unfocus string| ajaxLoadingClass function| initSpinner function| prepareSpinnerOnce function| showSpinner function| hideSpinner function| handleFooterAccordion function| addMboUnReadCounter number| scrollPosBeforeMenu function| prepareMobileMenuIfNeeded function| initDropdown function| showGallery function| showCarouselInDialog function| handleCarouselResize function| showOwlCarousel function| handleDynatraceTracking boolean| dtTrackInProgress function| trackTargetBlankLinkClick function| dtTrackAndRedirectToBlank object| iTim function| debounce object| picturefillCFG function| picturefill object| CLX string| CKEDITOR_BASEPATH function| pintHeaderEnabled function| checkEmpty object| mailboxUnreadCounterMap undefined| url number| cPosName number| cPosPin string| agent string| CL string| CR string| BK string| SH string| SP string| HS object| qwertzAlphabetic2 object| qwertzLayout2 object| qwertzLayout undefined| nVer undefined| nAgt undefined| browserName undefined| fullVersion undefined| majorVersion undefined| nameOffset undefined| verOffset undefined| ix undefined| OSName undefined| screenW undefined| screenH undefined| jToolkit undefined| jScreenSize function| createCookie function| readCookie object| serverId object| now object| expireDate object| tc_vars5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
auth.budwerk-b2b.de/ | Name: javascript Value: enabled |
|
auth.budwerk-b2b.de/ | Name: BRSINFO_env Value: windowSize%3D1600x1200 |
|
auth.budwerk-b2b.de/ | Name: BRSINFO_browserPlugins Value: internal-pdf-viewer%3Bmhjfbmdgcfjbbpaeojofohoefgiehjai%3Binternal-nacl-plugin%3B |
|
auth.budwerk-b2b.de/ | Name: BRSINFO_screen Value: width%3D1600%3Bheight%3D1200%3BcolorDepth%3D24 |
|
auth.budwerk-b2b.de/ | Name: DKB_SESS_TIMEOUT Value: 2023-03-23T00:18:07.900Z |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.budwerk-b2b.de
www.dkb.de
172.67.205.67
185.85.0.236
06f7edf3277d44924c26cdb4f3a9a5bdff10471b49b886a34a1544fa37a2a40d
0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9
0fe9650923b3c4d5d1b829c47a2a4eb9b6931a06132036a02c570e355f53ec87
24483b4771b2128af4110c159a9dcb59d15557460f8ecbf0bd0805f0fad5816e
3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0
40d429f458ae28444cebb60baa66d231e696ab81a7e0425cd2361ee1bfa659d1
44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af
49b505ce5e0b406992c9843c684e1281ed94f63f8fc48e4afdbe43d5e8962374
4ff1be8e8663baba428935b3db760312d42247482cf56e28f6a429b5f5d79f6e
5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
6f8aeec4719a2894c2896b8793a3a79c76127258cccf2abe5c44b5abcc5f618d
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
9665ab6f4c4c674d523766bb87ca1c1c3048086cd811d7d4b94e52261fb01db6
a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb
aaaab8bd6ca3c54bdce3326acf1e6ad3de078008ed8e45984f9f9cac1e7c68b8
accd544067de62a415dbe71808fd73229eae18409327498c3e7f951136b82d2a
d75a13cddae198bbb040efae849b4daa89b3059e03d928714b074c37a4a8ecf7
fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd