Is the Conquer Directory being scanned?

i tried logging into Conquer on a freshly installed client.
I have also placed ConquerLoader into the Conquer directory.
started player.exe as per normal.
turned on wireshark to log a couple packets.
used CE to edit the first occurrence of auth ip to 127.0.0.1

After i logged on my noob account.. i was surprisingly sent into bot jail after hopping around for a while.

Any idea?

Yes, it's being scanned from 3 modules and the main executable in many places at random time intervals.