Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
Make sure there are no local checkusers or policies.
Reason(s): On w:zh:WP:VPM, User:PMDdeSN posted CheckUser's data publicly that it would be a violation of privacy agreement, so it need to check whether User:PMDdeSN is one of zh.wikipedia CUer. Maybe it would find nothing because it can be evade if someone know the principle of CheckUser. --Cwek (talk) 02:57, 21 September 2017 (UTC)
The ombudsman commission is aware of this incident and is looking into it. This shouldn't preclude further actions by CU in this matter if there is a clear and compelling reason to do so, however. Craig Franklin (talk) 02:26, 24 September 2017 (UTC).
Reason(s): This user uploaded a video demonstrating IP address change to evade an ISP-level blackholing of Phabricator (gerrit:368775). We've identified a number of ISP addresses from public records for Maroc Telecom phab:Z567#10425, but need assistance in finding more ranges. Dispenser (talk) 18:11, 25 August 2017 (UTC)
Deferred to c:COM:RFCU. Hello. Commons has their own CheckUsers, you should request them on their request page. Regards, —MarcoAurelio (talk) 10:03, 26 August 2017 (UTC)
I cannot really answer that question because I do not know if OAuth logins leave CU trace. I think they don't, but I'll ping @Tgr (WMF) and BDavis (WMF) for clarification. In any case, I think Phabricator administrators can access IP data about users so if there's sockpuppetry problems over there maybe @AKlapper (WMF) and MModell (WMF) will be able to assist. —MarcoAurelio (talk) 09:53, 27 August 2017 (UTC)
Indeed they don't (although the user had to login to MediaWiki at some point, that you could look up). We can add something to the system logs if you think that would be important, feel free to open a phab task about it. Creating MediaWiki log records would be too much effort compared to how rarely it would be useful, IMO. (Also probably not something CUs should have access to, as OAuth authentication can be used for third-party logon and whatnot.) --Tgr (WMF) (talk) 20:26, 27 August 2017 (UTC)
I'll have a look at those on mediawiki. —MarcoAurelio (talk) 10:33, 28 August 2017 (UTC)
There are not conclusive results at mediawiki. They might be sockpuppets based on what they do, but so far the only connection I see is continental procedence, which is not much. The ranges are also crowded to do a safe IP range block. If someone else with more experience does want to have a look, feel free. —MarcoAurelio (talk) 11:27, 28 August 2017 (UTC)
I've filed a phabricator task. Cleaning up phabricator requires console commands which is why a /8, /11s, and /12s are blackholed, but they still somehow got through two filters. Dispenser (talk) 13:04, 28 August 2017 (UTC)
Is it possible to setup an abuser filter to tag accounts created here (Meta) as a WP0 user (or Moroccan IP or a proxy we blocked on Commons like Azure)? Is it possible to have an idea of where those accounts are created?
Reason(s): There has been a similar pattern of vandalism made by the user excerpted here (please see the record for the entire list), with addition of false information repeatedly and in particular through the alleged sockpuppet. This check is meant to establish a solid proof whether these users are connected in some way, since normal user often reported new user matching the edit pattern without any confirmation that they are related, let alone being the sockpuppet of the master (Hategatestudio) --G(x) (talk) 12:43, 20 September 2017 (UTC)
Hateegatestudio, ThaiMOvieMedia, TPCNotePatipon are unreacheable by checkuser, EvilJohnTv, Herezuma, Tee Patipon, PATIPON191230, Patipon Rattanaphan, Yoshimusic.2017, DonutBigHead, Herenut123, PatiponManutd, DonutLegend, Dramatvoffcial, PatiponDramatv, Patipon99, Thaksin99, Patipon.2017, KiroszLol are Confirmed --Vituzzu (talk) 22:09, 21 September 2017 (UTC)
Reason(s): Apparent impersonation, cross-wiki abuse. A Wikipedia sock puppet investigation was filed by Michael skater, an SPA with no other edits, against Psychicbias and Myerslover, which were accounts of the Wikipedia-blocked user Blastikus (real name, Ben Steigmann, also his Wikiversity user name), acknowledged by him to me privately. Only Psychicbias was not stale. Other accounts were included that were probably not Steigmann, but the filing itself was clearly an attack on a Wikiversity educational resource legitimately created by Steigmann, on a fringe science topic (which some hate). Michael skater claimed to be a Wikiversity user who did not want to disclose his name for fear of being attacked by Steigmann, but Steigmann was nondisruptive on Wikiversity and there was no ongoing dispute. Then a series of new accounts appeared on Wikipedia, purporting to be Steigmann, defiant and provocative, and, as well, linking to the Wikiversity resource. In the next sock investigation, these accounts were listed (only a few are listed above) and were tagged as socks of Blastikus, not by checkuser, based only on sock edits claiming to be Steigmann, and the active administrator then went to Wikiversity and requested action against Steigmann and the resource there, based on "cross-wiki disruption." Nobody in the discussions anywhere suspected that those intensely disruptive edits were not Steigmann, and he was blocked and the resource deleted. Steigmann was inactive and did not discover the situation until this week (per private communication). The user "Sci-fi-", also an SPA, in that discussion, misrepresented the Wikipedia checkuser results, and attacked a Wikiversity administrator, so he is suspected here of being involved in a scheme to disrupt Wikiversity through false flag disruption on Wikipedia. Steigmann had evaded his block, but had not been otherwise disruptive for years, anywhere, and there were only a handful of his actual edits involved. Please check if possible. Thanks. --Abd (talk) 23:34, 20 September 2017 (UTC)
I may be missing something but en.wiki SPI results were confirmed by a checkuser. If these accounts belonged to "Michael skater" I'd expect to see them tagged. --Vituzzu (talk) 22:00, 21 September 2017 (UTC)
The checkuser confirmed the socks listed in the second request were the same user, which is consistent with what I wrote above. "Michael skater" was not checked, as far as we know, in that later request, nor in the earlier one. He filed the earlier request. All the "Blastikus" accounts tagged were not tagged by checkuser from connection with the only non-stale Steigmann account, Psychicbias. What appears clear from my study is that Steigmann was not the set of socks reported in the second request. No new account was connected with Steigmann by checkuser, this was all based on assuming that an account that says "I am Steigmann" is necessarily Steigmann. Because there is a faction, that communicates off-wiki, attacking "pseudoscience" -- it's well known and fairly open -- it is possible that various persons took on various roles, but the possibility here is that Sci-Fi- editing Wikiversity, was also one or more of the fake Wikipedia Steigmann socks, or Michael skater. In addition, Michael skater claimed to have a wikiversity account that he did not want to reveal. That alone could be abusive sock puppetry, cross-wiki (all accounts are now global.) I am supporting a claim of impersonation, illegal and a clear violation of WMF policy. There is no claim here that Wikipedia checkuser results were incorrect, but checkusers did not assert that those socks were Psychicbias (recent!), only that they were connected, which is also what I've concluded.
I had to ask if it was possible to reveal but well, also Michael skater was checked at time and nothing interesting was found, so the request will basically turn into a who is Sci-fi-? then fishing, which I don't use to do for non-blocked accounts. --Vituzzu (talk) 15:54, 22 September 2017 (UTC)
If I may, I'd like to add w:User:Mikemikev for geographic area/IP checks, see w:Wikipedia:Sockpuppet investigations/Mikemikev/Archive and this excerpt from Rationalwiki: "Note the above sock IP is the [...] internet sockpupeteer Mikemikev, who is also: RealBrandonPilcher, Brandon Pilchers, Krom Loser, Communist Scientist, EgalitarianJay, Ben Steigmann Blissentia, Antifa Scientist, John Fuerst and JohnFuerstwithhispantsdown (most on Human Varieties talk). On most those socks he is also impersonating people. [...] Antifascist (talk) 19:28, 21 October 2015 (UTC)". I hope this helps! --Marshallsumter (talk) 01:12, 22 September 2017 (UTC)
There is a discussion of this on Marshallsumter's Wikiversity talk page, I just found, but this is a complex mess; the request here is for some fairly simple steward cross-wiki checkuser work, and not for anything else. "Ben Steigmann Blissentia" is interesting; that was a RationalWiki account with only one edit in 2015. It may have been impersonation, not Steigmann. The Wikipedia account by the same name was just created to post in the mass Wikipedia impersonation of Steigmann. The faction possibly involved would have high interest in RationalWiki. --Abd (talk) 01:47, 22 September 2017 (UTC)
I checked on loginwiki, where Psychicbias and Myerslover are stale. The results are that: Ben Steigmann Blissentia, Blastikus the cat, Blastikus Cats, Spirit of Myers, Ben the Blissentia, Jamenta 2, Spirit of James 2, Gggtt Steigmann, Michael skater, Bigcheeses, Sci-fi-, Gavarn1982, AlienMan99, Braude194 and Atheistic guy are Likely the same user. Ruslik (talk) 20:18, 22 September 2017 (UTC)
Done, if I can say so. Thanks! Sci-Fi and Michael skater nails it. This was impersonation and cross-wiki disruption of a vicious kind. As well, Gggtt was probably innocent. I'll notify the relevant administrators and look at the others. --Abd (talk) 20:42, 22 September 2017 (UTC)