I found them. They're acting very strangely. No wonder they got banned.
Discussion
I think it is mainly because the frequency of their bot hit the relays quite a lot thus looks like suspicious traffic. If i'm not mistaken they also access relays using various location (Europe, Asia, America) maybe to make sure their reports are correct (online relays reports)
yes
[02/Dec/2023:17:30:11 +0300] "GET / HTTP/1.1" 200 292 "-" "node-fetch/1.0 (+https://github.com/bitinn/node-fetch)"
[02/Dec/2023:17:30:11 +0300] "GET / HTTP/1.1" 101 2 "-" "-"
from six servers in a short amount of time