, I don't know their definition of fishy.
Probably it's some kind of "fishy" definition used in poker slang

(a not experienced player who can be easily manipulated and left with no money)
A specific IP was well behind in blocks vs expected.
It was also at the top of the bad luck statistics.
As I mentioned before, since it was rental that means no one will take responsibility for it, so it's safest to simply block it earlier than a normal miner, rather than risk it continuing.
As I've mentioned a few times

1) There is no way to get anything back for loss from rentals - they won't tell anyone who or what and keep anything they determine was withholding
2) That rental site gets paid no matter what for all good and bad mining
3) The withholding miner on that rental site gets paid until (
IF) they are detected
4) It's a lot easier to hide a withholder of size M in a total hash rate of size N, if N is a larger than M and there is no separation of the actual miners ... i.e. by definition: a rental proxy - as a pool sees it
Edit: and I guess I should add - for the sceptics ...
It's to the advantage of people who rent out hardware and rental sites to withhold, if they are paid no matter what (as *Hash is)
The more blocks they withhold, the fewer blocks found and thus the lower the diff change each 2 weeks.
This all leads to the mining hardware and rental sites making more BTC long term ... at the expense of the pool they are pointed at, and that pool (it's miners) have no recourse.