A vandalism-only account is a registered account that is used only to vandalize Wikipedia.

Most vandalism on Wikipedia is done by anonymous users who do not log in. Such edits can be identified by the IP address in the edit history. Repeated vandalism can eventually lead to being blocked from editing. Usually, administrators would use features such as WHOIS and GeoIP to identify the location to which the IP address of the vandalizing editor is registered to. Generally, shared IP addresses or ranges are blocked for a longer period, especially those registered to schools or organizations (see the section entitled IP addresses below).

As the IP address of a registered editor is not visible in edit histories, many vandals choose to create an account and then vandalize Wikipedia in the same way as an unregistered user. This can allow users to edit via an IP address or range that has been blocked to anonymous users.

Accounts may also be created and used by vandals for certain types of disruptive edits that cannot be performed by unregistered users, such as those to highly targeted pages or page-move vandalism. This is one of the main reasons for requiring that an account be autoconfirmed in order to perform these types of edits. While page protection is one means of reducing this possibility, such vandalism can still occur from new accounts, resulting in the general consensus that they should be blocked as soon as possible (see below).

If you notice any suspicious edits from a user (particularly those who have recently registered and whose user page or user talk page has not been created, i.e. appears as a red link), it is likely to be used only for vandalism. Usernames of such accounts also tend to violate Wikipedia's username policy.

Should you notice such activity from any registered user, revert the edit(s) if not already done before, and then check the user's contributions page to verify whether the other edits from the user are also evidence of vandalism. If this is the case, the account can be reported to Administrator intervention against vandalism as a "vandalism-only account".

Vandalism-only accounts are usually blocked indefinitely, sometimes without warning. The latter is typically the case if the username of the vandalizing account also violates the username policy.

Occasionally, the first block implemented may be temporary, depending on the severity of the vandalism. If vandalism resumes after a temporary block expires, it is extremely rare for the second block to be temporary.

IP addresses

IP addresses cannot be considered vandalism-only accounts, as IP addresses are sometimes shared by many devices (by way of network address translation or a proxy server), and many are reassigned to another computer after a period of time. However, if an IP address has been used only or mostly for vandalism over a long period of time, it may be subject to a very long block, up to a year and occasionally even longer, but is almost never blocked indefinitely.

• Wikipedia:Blocking policy
• Wikipedia:Open proxies