TShark: Challenge I: Teamwork

Prompts and answers

• What is the full URL of the malicious/suspicious domain address?
  hxxp[://]www[.]paypal[.]com4uswebappsresetaccountrecovery[.]timeseaways[.]com/
• When was the URL of the malicious/suspicious domain address first submitted to VirusTotal?
  2017-04-17 22:52:53 UTC
• Which known service was the domain trying to impersonate?
  PayPal
• What is the IP address of the malicious domain?
  184[.]154[.]127[.]226
• What is the email address that was used?
  johnny5alive[at]gmail[.]com