For non-email accounts, the operator validated credentials no matter how trivial seeming the website may have been. The operators appear to have been meticulously gathering trivial social information about the individuals. In total, the operator attempted to validate credentials for at least 75 different websites across the two individuals