Wikipedia:Sockpuppet investigations/SPI/CheckUser criteria

Situation	How to proceed

In these cases, file a case and request a check

Evasion of ArbCom or Wikimedia Foundation bans or remedies	Link to the closed case. Supply evidence to show the active user is the banned party.
Ongoing, serious pattern of vandalism involving dozens of incidents	Supply diffs of the vandalism.
Possible vote fraud	Link to the vote(s).
3RR violation using sockpuppets	Link to four or more diffs showing the 3RR violation.
Evasion of community-based bans or blocks	Link to block log of the original account. Supply evidence to show the user is the banned or blocked party.
Likely undetected or "sleeper" socks, getting an IP block (of a repeat sock-user)	Link to or point to a possible reason, or if enough socks exist, the archive.
'Messy' and complex cases where behavior alone cannot determine which accounts are socks.	Link to diffs that show the likelihood that each account listed could be a possible sockpuppet.
You believe a check is warranted anyway	Give a brief summary of the situation, link to further discussions, and supply supporting diffs.

In these cases, do not request CheckUser

Obvious, disruptive sock puppet	Block. No checkuser is necessary.
Disruptive "throwaway" account used only for a few edits	Block. No checkuser is necessary.
Checkuser to confirm a user has been using a specific IP address	File an SPI request without checkuser. For privacy reasons, checkusers will not publicly connect IP addresses to accounts.
Checkuser on yourself to "prove your innocence"	Such requests are not accepted. Please do not ask.
Question about a possible sock puppet related to an open arbitration case	Request on the arbitration case pages that a checkuser be run.
Suspected " good hand bad hand " use to avoid scrutiny	Initially file an investigation with no check requested, except in severe cases.
Suspected administrator sockpuppetry or multiple account abuse	Report to the Arbitration Committee . They may have to desysop the administrator.
Other disruption of articles	Report to AN/I, or file a case without CU and ask if checkuser should be requested.
Open proxy where you already know the IP address	List on Wikipedia:WikiProject on open proxies.
You want access to the checkuser tool yourself	Access is rarely granted, and not requested here. Please see Wikipedia:CheckUser.