Flow 1 risky: tcp 10.24.8.189:50652 -> 104.156.149.6:80