flag startswith / as suspicious