I wonder if they scan GH periodically, or simply see abnormal action on these accounts that are accessed by the exposed keys.