Flow 1 risky: tcp 192.168.20.18:50583 -> 72.249.41.52:110