Wikipedia:Sockpuppet investigations/Konullu/Archive

13 February 2013

 * Suspected sockpuppets


 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved
 * Other similar IP addresses may be involved


 * User compare report Auto-generated every hour.
 * Editor interaction utility

This is obviously WP:DUCK.

Konullu is a POV-pusher (an Azerbaijani nationalist) who has been disrupting articles about Armenia. He is most likely editing as an IP to evade possible sanctions regarding Requests for arbitration/Armenia-Azerbaijan 2. Warning issued to User:Konullu here. He has also been vote-stacking AfDs.
 * Strong evidence of vote-stacking and violation of WP:BLPCRIME: 3 November 2012, Konullu creates an article Gone in 60 Seconds (bank fraud) about an alleged Armenian fraudster. The article is put up for deletion per WP:BLPCRIME: Articles for deletion/Gone in 60 Seconds (bank fraud). Konullu votes "keep" as does and  (the latter's only edits to Wikipedia).  has also edited the article, reinserting a name in violation of WP:BLP.
 * More strong evidence of abusive sock puppetry: Konullu initiates Articles for deletion/List of regions of old Armenia, then both and  register “Delete” votes on the AfD.
 * Disruptive behaviour on Armenian National Congress (1917) by repeated adding of tendentious POV and RefImprove tags  . The talk page reveals his bias .  This was exactly the behaviour for which Konullu was reported to ANI in December  and subsequently received his ARBAA2 warning . His behaviour on this page continues that of, topic-banned on 11 February per WP:ARBAA2 from editing anything relating to Armenia, Turkey and Greece.
 * Evidence that Konullu and the IPs are the same.
 * Konullu lmost always signs off his talk page comments with "Best", e.g., , , , etc. Here are the IPs doing likewise:  ;  ;  ;  ;  ;   (this IP is evidently Konullu because it replies on Konullu's behalf in this talk page conversation).
 * Tag articles with “POV” and “RefImprove” templates: Konullu ;
 * Active on articles about Khojaly in Azerbaijan, e.g. on the Justice for Khojaly article: Konullu and one of the IPs are the biggest contributors : Konullu (168 edits);  (30 edits). Also  has seven edits and  has four edits there. All three have been active on the article only since December 2012.
 * Further evidence of intent to deceive: refers to Konullu in the third person here.
 * might seem like the odd man out, given it has only ever made one edit. However, that edit was to back Konullu on the Articles_for_deletion/Armenian_Congress_of_Eastern_Armenians he had created. The IP appeared there within 14 minutes of Konullu's creation of the page, an especially remarkable feat considering that the AfD was not transcluded properly and thus did not appear under the main AfD listings at that time. The IP geolocates to Hungary, the same as . Some of the other accounts have shown an interest in Hungary too, e.g. on 6 February made two edits to Human trafficking in Hungary   adding Konullu's trademark "POV" and "RefImprove" tags. Likewise, on 2 January  edited Hungarian names . Update Konullu himself has just edited International Business School, Budapest . Seems beyond coincidence now.  Folantin (talk) 14:55, 13 February 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
While the behavioral evidence is strong, I'm a bit confused by the fact that the 195.* group of IPs appears to geolocate to Switzerland, while the others are in Hungary. Could this be a tag-team of two editors, or is there something else going on? CU might be useful. Fut.Perf. ☼ 11:17, 26 February 2013 (UTC)
 * I think that the 195.212.29.* range is addresses for a global mobile network operated by AT&T. A proper WHOIS query shows that they are part of AT&T's GNS Ranges (Global Network Services?) and has the remark "OpenNet customer." http://wikisperience.com/wiki/index.php?title=Openet#Customers_and_Vertical_Markets suggests that OpenNet provides wireless internet to AT&T Mobility. For what it's worth, the addresses do not have any specific geolocation - although whatismyipaddress.com shows them as locating to Switzerland, really they're just Europe-wide. This suggests that the 195.* group could be the same user as 94.*/188.*, simply using a mobile device (although it's hard to tell given the vagueness of the WHOIS return). SpitfireTally-ho! 11:59, 26 February 2013 (UTC)

checkuser in general cannot link an account to IP addresses, due to the 's resolution on the release of personally identifiable information. In any case, the behavioural evidence in this case is very strong and sanctions can probably be applied based on that. SpitfireTally-ho! 12:08, 26 February 2013 (UTC) PS. the admin reviewing this case will probably want to be aware of Arbitration/Requests/Enforcement SpitfireTally-ho! 12:09, 26 February 2013 (UTC)


 * I think this can be closed then. The master account has been topic-banned. If IP activity resumes in circumvention of the ban, they should be blocked on sight. Fut.Perf. ☼ 11:14, 27 February 2013 (UTC)


 * closed. Please feel free to refile if IPs are used to violate the topic-ban. SpitfireTally-ho! 12:40, 27 February 2013 (UTC)

02 March 2013

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Konullu was recently topic banned from editing any articles related to Azerbaijan or Armenia. He was shortly after blocked for violating said topic ban. A mere day after that, one of his articles, Justice for Khojaly, was recreated from a redirect by Alismayilov, who had otherwise been inactive for almost a month. I thought this was strange, so I checked up on Ali's edits. His three edits before this were basically dropping out of the blue to vote delete on AFDs that Konullu started: 1, 2, 3. It's all suspicious enough to warrant a checkuser, I think. Someguy1221 (talk) 09:33, 2 March 2013 (UTC) Someguy1221 (talk) 09:33, 2 March 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Self endorsing, per above. Someguy1221 (talk) 09:33, 2 March 2013 (UTC)
 * - --  DQ   (ʞlɐʇ)  09:41, 2 March 2013 (UTC)
 * As far as I can tell they are ❌. Konullu has though been editing logged out just over 15% of the time in the last CU checkable time period, /arguably/ to avoid scrutiny. There are no 3RR violations that I could see right away if I included the logged out editing. He has not evaded his block or violated his sanctions since they have been placed, and I will be continuing to watch the logged out editing. -- DQ   (ʞlɐʇ)  10:04, 2 March 2013 (UTC)
 * When you're wrong, you're wrong. Thanks DQ. Someguy1221 (talk) 10:06, 2 March 2013 (UTC)