{
  "abstract": "Credential phishing against browser-authenticated accounts can produce fragmented digital traces across browser storage, phishing infrastructure, network traffic, and account activity records. This study aims to reconstruct a Discord Web account takeover caused by credential phishing through multi-source forensic correlation. Evidence was obtained from Chrome browser artifacts, phishing server logs, Wireshark network captures, and documentation of attacker-side account activity within a controlled experimental scenario. The forensic analysis recovered 10 of 12 expected artifacts, resulting in an Artifact Recovery Rate (ARR) of 83.3%, while 4 of 6 incident stages were supported by at least two evidence items or source layers, producing an Evidence Corroboration Score (ECS) of 66.7%. The reconstructed timeline covers six stages of the incident, from the delivery of a phishing link to the confirmation of account access. The study introduces ARR and ECS as quantitative measures for evaluating artifact recovery and cross-source evidence corroboration. The findings further demonstrate that browser artifacts alone are insufficient to establish a complete account takeover sequence, and that correlation among browser, server, network, and account activity evidence is necessary to construct a coherent and verifiable forensic timeline. These results provide a practical basis for incident responders and forensic examiners to correlate heterogeneous evidence sources when investigating browser-mediated credential phishing.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": null,
  "author_total": 3,
  "authors": [
    {
      "name": "Zulki Yanto Rivai"
    },
    {
      "name": "Anton Yudhana"
    },
    {
      "name": "Imam Riadi"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/2hmtgqygv41z1.bib",
  "cited_by": 0,
  "doi": "10.63158/journalisi.v8i5.1968",
  "fulltext_url": "https://journal-isi.org/index.php/isi/article/view/1968",
  "id": "2hmtgqygv41z1",
  "issns": [
    "2656-5935",
    "2656-4882"
  ],
  "landing_url": "https://doi.org/10.63158/journalisi.v8i5.1968",
  "language": "en",
  "licence": "CC-BY",
  "licence_label": "CC BY",
  "licence_source": "journal",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "lcc",
      "QA1-939"
    ],
    [
      "lcc",
      "QA75.5-76.95"
    ],
    [
      "openalex",
      "1710|Digital and Cyber Forensics"
    ]
  ],
  "openalex": "W7223372233",
  "pdf_url": "https://journal-isi.org/index.php/isi/article/download/1968/1083",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-24",
  "publisher": "Asosiasi Doktor Sistem Informasi Indonesia",
  "ris": "https://research.draconitic.com/paper/2hmtgqygv41z1.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T13:44:48Z",
      "native_id": "de9cbdc971f64bd098a7ec9f65ea6962",
      "source": "doaj",
      "url": "https://doi.org/10.63158/journalisi.v8i5.1968"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "lcc:QA1-939",
      "subfield": "general"
    }
  ],
  "title": "Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing",
  "title_text": "Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T13:44:48Z",
  "url": "https://research.draconitic.com/paper/2hmtgqygv41z1",
  "venue": "Journal of Information Systems and Informatics",
  "versions": []
}