Flow 1 risky: tcp 1.1.1.1:48502 -> 2.2.2.2:443
Flow 1 midstream: tcp 1.1.1.1:48502 -> 2.2.2.2:443