Flow 1 risky: tcp 10.180.156.249:45921 -> 38.229.70.20:8000