Probably because it accessed it through a user’s browser/connection which until that point hadn’t been flagged as a bit and had consistently shown signs of human use.