Flow 1 risky: tcp 40.77.167.36:64768 -> 89.31.72.220:80