After setting up surveillance at Netcom around February 7, Shimmy asked one of the network admins to search the system accounting records of Netcom, looking for any users who had been logged in at times when the Well’s accounts were being illicitly accessed by some user at Netcom. The admin searched through the accounting records by matching the log-ins and log-outs that had occurred during the intrusions, and was eventually able to track down one of the accounts accessing the Well from Netcom’s network. It was the "gkremen" account, and it was mostly being used to dial in to Netcom through the company’s modems in Denver and Raleigh.