Flow 1 risky: tcp 10.220.20.67:58574 -> 10.220.20.67:60102