Flow 1 risky: udp 192.168.1.199:42759 -> 31.220.27.69:80