Oren finally came to me with one of the most reasonable explanations of ever seen: the IP address could've been Replit. Oren probably uses it to run bots, or at least test them
this sounds actually pretty reasonable — i’ll look into it
I hope it's right, otherwise I'd probably have nothing left in his defense
Replit use Google Cloud, just check the ASN