Flow 1 risky: tcp 127.0.0.1:56451 -> 127.0.0.1:3000