let's also not forget that they tend to infect all other connected instances too, there's a high number on .ml that are basically Hexbear satellite offices where almost every single commenter is a hb user.