i thought the appropriate order of events was to do a suspected sock first and the checkuser as a last resort after the suspected sock only if appropriate thanks for the reply i'll request a checkuser