diff --git a/app/bot.php b/app/bot.php
index 7525b21..f1cefa8 100644
--- a/app/bot.php
+++ b/app/bot.php
@@ -4507,7 +4507,6 @@ DNS-over-HTTPS with IP:
         }
 
         $t = [
-            $this->suspicious('~\d+\.\d+\.\d+\.\d+.+200\s\d+\s0$~', '/logs/upstream_access', $xr, 'possibly a Reality Degenerate'),
             $this->suspicious($this->reg, '/logs/nginx_default_access', $xr, 'possibly a scanner', true),
             $this->suspicious($this->reg, '/logs/nginx_domain_access', $xr, 'possibly a scanner', true),
         ];
@@ -4519,6 +4518,15 @@ DNS-over-HTTPS with IP:
             }
         }
 
+        $r = $this->suspicious('~\d+\.\d+\.\d+\.\d+.+200\s\d+\s0$~', '/logs/upstream_access', $xr, 'possibly a Reality Degenerate');
+        if (!empty($r)) {
+            foreach ($r as $k => $v) {
+                if (count($v) > 30) {
+                    $ip[$k] = $v;
+                }
+            }
+        }
+
         if (!empty($return)) {
             return $ip;
         }