CheckUser is the process of checking information about two or more users (including named users and temporary accounts). Some administrators are able to check if two or more accounts have been used from the same computer. These users also see User agents. This can help them decide if two accounts are related in the way described above. It is also possible to see if a user is editing from an open proxy.
On this page, users can request some users or IPs to be checked. Good reasons should be given for why a checkuser is needed; you should provide links which show the questionable edits, etc. Questions should usually be created so that they can be answered by yes or no. Responses will be short in order to comply with Wikipedia privacy policy. Sensitive information (like the IP addresses used by an account) are usually not reported. The results are not always clear, and a decision should not be made only on the basis of checkuser results.
Use of the tool
This tool is to be used to fight vandalism, to check for sockpuppet abuse, and to limit disruption of the project. It must be used only to prevent damage to the project.
The tool should not be used for political control; to apply pressure on editors; or as a threat against another editor in a content dispute. There must be a valid reason to check a user. Note that alternative accounts are not forbidden, so long as they are not used in violation of the policies (for example, to vote more than once or to make it look like more people support an idea). Checkusers will refuse a request, if the reason for checking is not good enough to warrant the use of the tool.
SpBot archives all sections tagged with {{Section resolved|1=~~~~}} after 3 days and sections whose most recent comment is older than 90 days. For the archive overview, see Archive.
KSD latest batch of accounts. Same interest in far-right Israel politics. Adding same categories (, ) as prior sock . Recreating an article previously created by a prior sock .
The temp accounts have all edited from the same underlying IP address and in the same topic area, often around editing from named accounts and are quite obvious KSD socks. Please block the underlying IP for each group as has been done for prior temp accounts (see for example). Ravensfire (talk) 14:37, 19 October 2026 (UTC)
confirmed except 1st one and last two. fr33kman 02:38, 20 October 2026 (UTC)
Interesting, especially on the first named account. The habit of this group to use minor for nearly all of their edits and to put the article name as the edit summary is fairly unique in this area. The Limor Son Har-Melech has a large edit from a temp account that was blocked and then a very, very similar edit from AABH , both that use the wikilinked article name as edit-summaries. Combine the overlap in a tight subject area, the interest in categorizing articles and there's a lot of behavior overlap with the KSD sock farm. I did notice the IP change in the two groups, but still the same ISP and same geo location. Ravensfire (talk) 02:56, 20 October 2026 (UTC)
I was asked to dig further so I compared behaviour and ISP information and I think we can confirm these three as belonging to the same sock farm as the others. As such I've blocked them. fr33kman 21:50, 20 October 2026 (UTC)
Thank you for the additional digging on this, Fr33kman. I appreciate it. Ravensfire (talk) 02:03, 21 October 2026 (UTC)
This section is resolved and can be archived. If you disagree, replace this template with your comment. Barrastalk 09:24, 24 October 2026 (UTC)
Obvious socks - see the above report for blocked accounts to check. Please block the underlying IP of the temp account as well. Ravensfire (talk) 14:00, 23 October 2026 (UTC)
Itamar Ben-Gvir has been a very common target for KSD socks. It was recreated by a fairly new account, By-abbot, who has recreated a fairly random range of articles. Ravensfire (talk) 14:00, 23 October 2026 (UTC)
The first account is blocked as KSD sock. Per m:Ombuds commission/2025/Temporary Accounts we are not allowed to link TAs with accounts. I did some clean-up on what I found.
By-abbot seems to be Unrelated. The username might be blockable as it includes "bot". -Barrastalk 20:04, 23 October 2026 (UTC)
Thanks! I was hoping by-abbot was unrelated. While it's a fairly odd list of articles they've translated, so fair their efforts look solid (and much better than the usual KSD junk). Appreciate the help! Ravensfire (talk) 20:08, 23 October 2026 (UTC)
I got confirmation from a different project on the last account that it really is unrelated. Closing. -Barrastalk 09:25, 24 October 2026 (UTC)
This section is resolved and can be archived. If you disagree, replace this template with your comment. Barrastalk 09:25, 24 October 2026 (UTC)
I have no data on Baths by Basement's Basement (last edited in July, too far back); the two other accounts are likely unrelated. Eptalon (talk) 07:52, 24 October 2026 (UTC)
From what I see: user agents match (for all three, Chewinverse, Uknkwow, and Gambinone), but given the actual 'variety' left in the browser world thats not amazing. IP addresses are completly different, and right now, I can't perform a whois lookup on the IPs, so no further info available. With the infos I have, I would tend to say no match (from a CU perspective) Eptalon (talk) 08:18, 24 October 2026 (UTC)
It's all TTT24. Compared with enwiki and cuwiki. I just did a massive clean up. Not sure if I found everything yet. @MathXplore please report if you find anything else suspicious. This is a very proficient sock master with sleepers and everything. -Barrastalk 09:23, 24 October 2026 (UTC)
