Flow 1 risky: tcp 10.238.26.36:62092 -> 10.220.50.76:21