Help:Extension:CheckUser

As taken directly from the extension page on MediaWiki:

Usage

Basic interface

1. Go to Special:CheckUser.
2. In the user field, type in the username (without the 'user:' prefix), IP address, or CIDR range.
   • IP: any IPv4 or IPv6 address.
   • CIDR: you can check a range of IP addresses by appending the CIDR prefix (up to /16 for IPv4 (65,536 addresses), up to /64 for IPv6 (~1.8446*10¹⁹ addresses) before revision 7352, up to /48 for IPv6 (~1.2089*10²⁴ addresses or 65536 /64s) after revision 7352). For notation, see Range blocks.
   • XFF: you can check a client IP address provided by X-Forwarded-For headers by appending /xff (for example, 127.0.0.1/xff).
3. Select the information you want to retrieve.
   • Get IPs: returns IP addresses used by a registered user.
   • Get edits from IP: returns all edits made by a user (registered or anonymous) from an IP address or range.
   • Get users: returns user accounts that have edited from an IP or range.
4. In the reason field, type in the reason you are accessing the confidential data. Try to succinctly summarise the situation (for example, "cross-wiki spam"); this will be logged in a log visible only to users with the checkuser-log permission.

Information returned

A typical entry in the CheckUser results for a user summary ("get users") is as follows:

• Example (Talk | contribs) (20:11, 22 April 2024 -- 20:12, 22 April 2024) [5]
  1. 127.0.0.37 XFF: 127.0.0.1, 127.0.0.5

This is formatted to fit a lot of information into a format that can very easily be listed and skimmed, but is difficult to read unless you know what the information provided is. The information is laid out as follows:

• username (user links) (time period when they edited from the given IP or range) [number of edits from the IP or range]
  1. IP address edited from XFF: XFF information provided (can be spoofed)
     

Each IP/XFF combination used to edit is listed, in order of use.

The last ten user agents (browser, operating system, system language, and versions) for each user for edits made in the IP or range are listed afterwards.

XFF Format

XFF (X-Forwarded-For) headers indicate the series of IP addresses used from the user's computer (first) to the last proxy server. In case of Wikimedia, the last proxy server is one of the Wikimedia proxies (listed under $wgSquidServersNoPurge in the Wikimedia configuration file).

In this example:

aaa.aaa.aaa.aaa XFF: 10.4.46.42, 127.0.0.1, aaa.aaa.aaa.aaa, 208.80.152.46

• the first two addresses (10.4.46.42, 127.0.0.1) are private to the originating network and can't be reached directly from the public Internet,
• the third address (aaa.aaa.aaa.aaa) is the "public face" of the editor, usually a broadband or dialup ISP, a company gateway, (but possibly an anonymizer or a malware-compromised server),
• the last address (208.80.152.46) is one of the Wikimedia squids (sq36.wikimedia.org).

MediaWiki configuration settings $wgUsePrivateIPs, $wgSquidServers, $wgSquidServersNoPurge and extensions using the IsTrustedProxy hook (such as Extension:TrustedXFF) change the way an actual IP address used to attribute edits is selected.