A vandalism-only account is a single-purpose registered account that is used only to vandalize Wikipedia.

Most vandalism on Wikipedia is done by anonymous users. Such edits can be identified by the IP address in the page history. Repeated vandalism can eventually lead to being blocked. Administrators use WHOIS and geolocation to track vandals and perform range blocks. Generally, schools and other problematic organizations are blocked for a longer period (see § IP addresses).

As the IP address of a registered editor is not visible in edit histories, many vandals create an account and vandalize Wikipedia. This can allow editing via an IP address or range that has been blocked to anonymous users.

Vandals may also create accounts to vandalize Wikipedia in ways that cannot be done by unregistered users, such as on protected pages or by page-move vandalism. This is one reason for requiring that an account be autoconfirmed to perform these edits. While page protection is one method of mitigation, such vandalism still occurs from new accounts, resulting in the general consensus that they should be blocked as soon as possible (see below).

If you notice any suspicious edits from a user (particularly those who have recently registered), it is possibly to be used only for vandalism. User talk pages might not have been created (i.e. appears as a red link), may consist of warning messages only, or be blanked by the vandal. Usernames of disruptive accounts^[1] also tend to violate Wikipedia's username policy.

Should you notice such activity from registered users, revert the edit(s) if not already done, and check the user's contributions to verify whether the other edits are vandalism. If so, the account can be reported to Administrator intervention against vandalism as a "vandalism-only account".

Vandalism-only accounts are usually blocked indefinitely, sometimes without warning. The latter is typically the case if the vandal's username violates the username policy.

Occasionally, the first block implemented may be temporary, depending on the severity of the vandalism. If vandalism resumes after a temporary block expires, it is extremely rare for the second block to be temporary.

Cross-wiki vandals should also be reported to meta:Steward requests/Global‎‎ #Requests for global (un)lock and (un)hiding, especially accounts seemingly operated by long-time abusers.

IP addresses

IP addresses cannot be considered vandalism-only accounts, as IP addresses are sometimes shared by many users (by way of network address translation or a proxy server), and many are reassigned to another computer after a period of time. However, if an IP address has been used only or mostly for vandalism over a long period of time, it may be subject to a very long block, up to a year and occasionally even longer, but is almost never blocked indefinitely.

• Wikipedia:Blocking policy
• Wikipedia:Open proxies