This research aims to conduct digital forensic analysis on web phishing practices
using the framework provided by the National Institute of Standards and Technology
Special Publication 800-86 (NIST SP 800-86). The primary focus of the study is to
comprehensively uncover the process of web phishing practices and identify relevant
digital traces associated with such attacks. Specifically, this research is intended to
support investigative teams in exploring and analyzing cases of web phishing,
particularly within the Digital Forensic Center of Universitas Muhammadiyah
Purwokerto. The findings indicate that the implementation of the NIST SP 800-86
method yields effective results in the search and analysis of evidence related to web
phishing attacks. The utilization of forensic software such as Wireshark also proves
to significantly contribute to investigative activities. The resulting analysis report
from this research encompasses crucial information such as phishing URLs, DNS
utilized by attackers, server IP addresses, destination IP addresses, as well as the
identification of attackers and victims through email addresses, which greatly aids in
supporting the investigation process and law enforcement efforts.