Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing

Authors

DOI:

https://doi.org/10.63158/journalisi.v8i5.1968

Keywords:

credential phishing, Discord Web, forensic reconstruction, multi-source correlation, browser forensics

Abstract

Credential phishing against browser-authenticated accounts can produce fragmented digital traces across browser storage, phishing infrastructure, network traffic, and account activity records. This study aims to reconstruct a Discord Web account takeover caused by credential phishing through multi-source forensic correlation. Evidence was obtained from Chrome browser artifacts, phishing server logs, Wireshark network captures, and documentation of attacker-side account activity within a controlled experimental scenario. The forensic analysis recovered 10 of 12 expected artifacts, resulting in an Artifact Recovery Rate (ARR) of 83.3%, while 4 of 6 incident stages were supported by at least two evidence items or source layers, producing an Evidence Corroboration Score (ECS) of 66.7%. The reconstructed timeline covers six stages of the incident, from the delivery of a phishing link to the confirmation of account access. The study introduces ARR and ECS as quantitative measures for evaluating artifact recovery and cross-source evidence corroboration. The findings further demonstrate that browser artifacts alone are insufficient to establish a complete account takeover sequence, and that correlation among browser, server, network, and account activity evidence is necessary to construct a coherent and verifiable forensic timeline. These results provide a practical basis for incident responders and forensic examiners to correlate heterogeneous evidence sources when investigating browser-mediated credential phishing.

Downloads

Download data is not yet available.

References

[1] G. Kaur et al., “Social Media in the Digital Age: A Comprehensive Review of Impacts, Challenges and Cybercrime,” Engineering Proceedings, vol. 62, no. 1, 2024, doi: 10.3390/engproc2024062006.

[2] M. F. Safitra, M. Lubis, and H. Fakhrurroja, “Counterattacking Cyber Threats: A Framework for the Future of Cybersecurity,” Sustainability, vol. 15, no. 18, p. 13369, Sep. 2023, doi: 10.3390/su151813369.

[3] Š. Grigaliūnas, R. Brūzgienė, and A. Venčkauskas, “Ontology-Driven Digital Profiling for Identification and Linking Evidence Across Social Media Platform,” IEEE Access, vol. 11, pp. 111672–111691, 2023, doi: 10.1109/ACCESS.2023.3322162.

[4] “Discord Users by Country 2026.” Accessed: Jun. 11, 2026. [Online]. Available: https://worldpopulationreview.com/country-rankings/discord-users-by-country

[5] F. Iqbal, M. Motylinski, and A. MacDermott, “Discord Server Forensics: Analysis and Extraction of Digital Evidence,” in 2021 11th IFIP International Conference on New Technologies, Mobility and Security (NTMS), IEEE, Apr. 2021, pp. 1–8. doi: 10.1109/NTMS49979.2021.9432654.

[6] M. Ahmed et al., “PhishCatcher: Client-Side Defense Against Web Spoofing Attacks Using Machine Learning,” IEEE Access, vol. 11, pp. 61249–61263, 2023, doi: 10.1109/ACCESS.2023.3287226.

[7] S. Asiri, Y. Xiao, S. Alzahrani, S. Li, and T. Li, “A Survey of Intelligent Detection Designs of HTML URL Phishing Attacks,” IEEE Access, vol. 11, pp. 6421–6443, 2023, doi: 10.1109/ACCESS.2023.3237798.

[8] A. K. Jain and B. B. Gupta, “A survey of phishing attack techniques, defence mechanisms and open research challenges,” Enterp. Inf. Syst., vol. 16, no. 4, pp. 527–565, Apr. 2022, doi: 10.1080/17517575.2021.1896786.

[9] S. Berham and S. Morris, “A critical comparison of Brave browser and Google Chrome forensic artefacts,” Journal of Digital Forensics, Security and Law, vol. 17, no. 1, Art no. 4, 2022, doi: 10.15394/jdfsl.2022.1752.

[10] P. Kumari, K. Shukla, and K. Modi, “Reconstructing user activity through browser forensics by examining techniques and ethical considerations,” Journal of Digital Security and Forensics, vol. 2, no. 2, pp. 111-123, Dec. 2025, doi: 10.29121/digisecforensics.v2.i2.2025.67.

[11] A. Raza, M. Hussain, H. Tahir, M. Zeeshan, M. A. Raja, and K.-H. Jung, “Forensic analysis of web browsers lifecycle: A case study,” Journal of Information Security and Applications, vol. 85, p. 103839, Sep. 2024, doi: 10.1016/j.jisa.2024.103839.

[12] D. Komosny, “Evidential value of country location evidence obtained from IP address geolocation,” PeerJ Comput. Sci., vol. 9, p. e1305, Mar. 2023, doi: 10.7717/peerj-cs.1305.

[13] A. Yudhana, I. Riadi, and S. Suharti, “Network Forensics Against Volumetric-Based Distributed Denial of Service Attacks on Cloud and the Edge Computing,” International Journal of Safety and Security Engineering, vol. 12, no. 5, pp. 577–588, Oct. 2022, doi: 10.18280/ijsse.120505.

[14] R. R. Chand, J. Kumar, A. Prasad, and S. Chand, “Effectiveness of Forensic Tools in Extracting Web Browser Artifacts,” in 2025 International Conference on Sustainable Technology and Engineering (i-COSTE), IEEE, Dec. 2025, pp. 1–5. doi: 10.1109/i-COSTE68047.2025.11467264.

[15] L. Rzayeva, A. Zhetpisbayeva, A. Batkuldin, N. Nyssanov, A. Ryzhova, and F. Saeed, “An Intelligent Browser History Forensics Method for Automated Analysis of Web Activity Logs, Credentials, and User Behavioral Profiles,” Algorithms, vol. 19, no. 1, p. 75, Jan. 2026, doi: 10.3390/a19010075.

[16] Z. Morić, V. Dakić, and I. Ogrizek Biškupić, “An Empirical Assessment of Digital Forensic Process Reliability Using Integrated ISO/IEC 27037 and 27041 Standards,” Journal of Cybersecurity and Privacy, vol. 6, no. 2, p. 57, Apr. 2026, doi: 10.3390/jcp6020057.

[17] A. M. Almuhaideb et al., “Homoglyph Attack Detection Model Using Machine Learning and Hash Function,” Journal of Sensor and Actuator Networks, vol. 11, no. 3, p. 54, Sep. 2022, doi: 10.3390/jsan11030054.

[18] R. R. Chand, N. A. Sharma, and M. A. Kabir, “Advancing Web Browser Forensics: Critical Evaluation of Emerging Tools and Techniques,” SN Comput. Sci., vol. 6, no. 4, Art. No. 355, Apr. 2025, doi: 10.1007/s42979-025-03921-6.

[19] M. S. Javed et al., “Analyzing Tor Browser Artifacts for Enhanced Web Forensics, Anonymity, Cybersecurity, and Privacy in Windows-Based Systems,” Information, vol. 15, no. 8, p. 495, Aug. 2024, doi: 10.3390/info15080495.

[20] A. Yudhana, Z. Y. Rivai, and I. Riadi, “Assesing Digital Evidence Availability in Discord Phishing using ISO/IEC 27037 and Anti-Forensics Analysis,” International Journal of Advances in Data and Information Systems, vol. 7, no. 1, pp. 402–413, Apr. 2026, doi: 10.59395/ijadis.v7i1.1518.

[21] S. Bhandari and V. Jusas, “An Abstraction Based Approach for Reconstruction of TimeLine in Digital Forensics,” Symmetry (Basel)., vol. 12, no. 1, p. 104, Jan. 2020, doi: 10.3390/sym12010104.

[22] F. Breitinger, H. Studiawan, and C. Hargreaves, “SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges,” Forensic Science International: Digital Investigation, vol. 53, p. 301932, Jul. 2025, doi: 10.1016/j.fsidi.2025.301932.

[23] S. Pathirana, R. Dushmantha, C. Jayarathna, B. Thilakarathna, A. Senarathna, and A. Wijesooriya, “Next-Gen Mobile Forensics Tool: Timeline Reconstruction from Android Digital Evidence,” in 2026 8th International Congress on Human-Computer Interaction, Optimization and Robotic Applications (ICHORA), IEEE, May 2026, pp. 1–10. doi: 10.1109/ICHORA69329.2026.11536997.

[24] H. Studiawan, I. M. T. Pardede, A. P. Sayakkara, B. A. Pratomo, and A. M. Shiddiqi, “Event Reconstruction From Forensic Timeline with Formal Event Modeling,” in 2026 International Conference on AI Innovations and Industry (ICAIII), IEEE, Apr. 2026, pp. 1–6. doi: 10.1109/ICAIII69475.2026.11521234.

[25] A. M. Alotibi, S. Y. Altaleedi, T. Zia, and E. U. H. Qazi, “Examining the Behavior of Web Browsers Using Popular Forensic Tools,” International Journal of Digital Crime and Forensics, vol. 16, no. 1, pp. 1–22, Jul. 2024, doi: 10.4018/IJDCF.349218.

[26] R. Adila, H. Studiawan, and F. Breitinger, “Forensic Event Reconstruction With Process Mining,” IEEE Access, vol. 14, pp. 18964–18985, 2026, doi: 10.1109/ACCESS.2026.3660165.

Downloads

Published

2026-10-24

Issue

Vol. 8 No. 5 (2026): October

Section

Articles

License

Copyright (c) 2026 Journal of Information Systems and Informatics

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

Author's Declaration

  1. The Authors certify that they have read, understood, and agreed to the Journal of Information Systems and Informatics (JournalISI) submission guidelines, policies, and submission declaration. The submission has been prepared using the provided template.
  2. The Authors certify that all authors have approved the publication of this manuscript and that there is no conflict of interest.
  3. The Authors confirm that the manuscript is their original work, has not received prior publication, is not under consideration for publication elsewhere, and has not been previously published.
  4. The Authors confirm that all authors listed on the title page have contributed significantly to the work, have read the manuscript, attest to the validity and legitimacy of the data and its interpretation, and agree to its submission.
  5. The Authors confirm that the manuscript is not copied from or plagiarized from any other published work.
  6. The Authors declare that the manuscript will not be submitted for publication in any other journal or magazine until a decision is made by the journal editors.
  7. If the manuscript is finally accepted for publication, the Authors confirm that they will either proceed with publication immediately or withdraw the manuscript in accordance with the journal’s withdrawal policies.
  8. The Authors agree that, upon publication of the manuscript in this journal, they transfer copyright or assign exclusive rights to the publisher, including commercial rights

How to Cite

[1]
Z. Y. Rivai, A. Yudhana, and I. Riadi, “Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing”, journalisi, vol. 8, no. 5, pp. 6786–6805, Oct. 2026, doi: 10.63158/journalisi.v8i5.1968.