We have noticed some trolls that make several user accounts at the same time to later use for vandalizing on Wikipedia. Even though current software restrictions only allow creating up to 6 accounts in 24 hours per IP, it is still being used by certain trolls.
There should be an option for functionaries to be notified whenever several user accounts are created by the same IP address in a short period of time. This can help with identifying this type of trolls.
Please note that many projects don't have local CUs and identifying this type of trolls through CU is difficult anyway.
An example is provided below, of a vandalizing troll in fa.wikipedia, for demonstration purposes.
19:44, 31 July 2015 User account Fgyhkluorftghyl (Talk | contribs | block) was created
19:43, 31 July 2015 User account Uolajokl (Talk | contribs | block) was created
19:42, 31 July 2015 User account Karmo123 (Talk | contribs | block) was created
19:40, 31 July 2015 User account Marmadokilo (Talk | contribs | block) was created
19:39, 31 July 2015 User account Karmoeri (Talk | contribs | block) was created
[Note: Title and description changed, replacing "sysops" with "functionaries", per discussion below. - June 2016]