Krisdegioia ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

• Krisdegioia ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• KDegioia ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• 107.3.202.41 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))
• 2601:482:0:81bb:616c:2e50:dd41:d792 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))
• 2601:482:0:81bb:3862:8411:8a2b:f685 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Evidence

• Krisdegioia ( talk · contribs): Former creator of Kris Degioia. User's talk page contains CSD notice (sent to article creator). -- JustBerry ( talk) 02:54, 8 January 2017 (UTC) reply
• 107.3.202.41 ( talk · contribs): Sudden concern for deleted article here. -- JustBerry ( talk) 02:54, 8 January 2017 (UTC) reply
• 2601:482:0:81BB:616C:2E50:DD41:D792 ( talk · contribs): IP-hop mid-conversation here. -- JustBerry ( talk) 02:54, 8 January 2017 (UTC) reply
• KDegioia ( talk · contribs): Created convo mid-conversation here. -- JustBerry ( talk) 02:54, 8 January 2017 (UTC) JustBerry ( talk) 02:54, 8 January 2017 (UTC) reply
• 2601:482:0:81bb:3862:8411:8a2b:f685 ( talk · contribs): Adding "Kris Degioia" to the same article that was similarly edited by previous socks. -- JustBerry ( talk) 04:33, 8 January 2017 (UTC) reply

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Comment: There might be some sleepers lying under Krisdegioia ( talk · contribs) (created October 2016) as not detected in previous CU check (January 2017). -- JustBerry ( talk) 03:24, 8 January 2017 (UTC) reply
•  Comment: Since IPs demonstrate IP-hopping, perhaps a range block? Hopped between IPv4 and IPv6, though. -- JustBerry ( talk) 03:24, 8 January 2017 (UTC) reply
•  Comment: KDegioia ( talk · contribs), however, created after prior CU check. -- JustBerry ( talk) 03:24, 8 January 2017 (UTC) reply

•   Sounds like a duck quacking into a megaphone to me. Krisdegioia was blocked in October 2016. KDegioia and the IPs are clearly the same person. I've blocked KDegioia indefinitely and the IPs for 31 hours. I'm not sure if they're the same person as the sock master. It's very likely this is the "client" to the paid sock farm. A CU confirmed that a sock from this known sock farm recreated a word for word version of the article Krisdegioia originally created -- if that makes any sense. I'm not sure if case split is necessary here since its related? I've left a note on their user talk that their block aside from abusively using multiple accounts also falls under WP:NOTHERE/ WP:IDHT. Mkdw ^talk 07:54, 8 January 2017 (UTC) reply

• Chrisnadeau1973 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• User compare report Auto-generated every hour.
• Editor interaction utility

Now this is odd, another account has just appealed to me on my user talk page, desperate to rescue the deleted article, with the rather nonsensical appeal "no other tweet made by winkipiedia (sic) has gotten that much traction for articles in creation. If it needs help then help us please! Chris nadeau." The "us" makes me wonder if this is meatpuppetry, but given the parade of accounts trying to use us a platform for this non-notable person, I think it's worth a look. Shawn in Montreal ( talk) 23:10, 8 June 2017 (UTC) reply

• I see that @ Bbb23: has blocked Chrisnadeau1973 as a different sockpuppeteer. With a sock account now pleading to not create articles on Degioia (while strangely using the same misspelling of winkipedia). Shawn in Montreal ( talk) 14:53, 9 June 2017 (UTC) reply

• Thanks Bbb23. I'll keep the Chrisnaudeau account in mind if I see other related Degioia/"winkipedia" posts. Shawn in Montreal ( talk) 15:27, 9 June 2017 (UTC) reply

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Unrelated. Odd is an understatement.-- Bbb23 ( talk) 15:19, 9 June 2017 (UTC) reply

• Case closed. Vanjagenije (talk) 17:47, 9 June 2017 (UTC) reply

 Confirmed to Cybercrimes. Mkdw ^talk 23:54, 9 July 2017 (UTC) reply

• Jeffspecht ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• User compare report Auto-generated every hour.
• Editor interaction utility

This account has just popped up, attempting to establish a basis upon which further accounts editing from the same IP as Chrisnadeau1973 should not be blocked by us as socks of Chrisnadeau1973. He claims to be a colleague of Chrisnadeau1973 at work -- on a Sunday, for it's worth -- and appears to want to stake out a rationale for further edits on... what I wonder? Why would a new account who doesn't intend continue spamming on Kris Degioia zero right back to Wikipedia talk:Miscellany for deletion/Draft:Kris Degioia or my user page -- apparently concerned in advance about the outcome of the next CU? Or we're simply being trolled for the lulz, with all these conflicting claims around wanting or not wanting to create articles about this Kris Degoia person. At any rate, WP:QUACK. Shawn in Montreal ( talk) 21:41, 11 June 2017 (UTC) reply

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

 Likely, blocked, tagged, closing.-- Bbb23 ( talk) 00:59, 12 June 2017 (UTC) reply

• Pliespuppy ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• Newfocusnow ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)

• User compare report Auto-generated every hour.
• Editor interaction utility

Both of these users are singularly focused on editing related to Kris Degioia and WTF Multimedia, just as previous socks of Waffen77 had done. Pliespuppy displays the standard sock behavior of making ten rapid fire minor edits to get autoconfirmed, then moving on to the promotional edits. This may also be related to Wikipedia:Sockpuppet investigations/Chrisnadeau1973 and/or Wikipedia:Sockpuppet investigations/IMZahidIqbal both of which involved socks with an interest in promoting Kris Degioia and WTF Multimedia, so maybe this should be cross-checked with those two cases. Deli nk ( talk) 15:44, 7 July 2017 (UTC) Deli nk ( talk) 15:44, 7 July 2017 (UTC) reply

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

• Newfocusnow  Confirmed to Cybercrimes. On a technical level Pilespuppy seems very  Unlikely here, but I haven't looked into a possible connection with Chrisnadeau1973 and IMZahidIqbal — MusikAnimal ^talk 23:42, 8 July 2017 (UTC) reply
•  Relisted to compare with both of these cases. The germane part if the Imza case begins in that archive at 30 April. Based on that case and the Chrisnadeau1973 case, coupled with some oversighted edits that he has seen on his talk page, this looks like it is right up Mkdw's alley if he is willing. Based on this deleted contrib, I'm not sure if one group is trying to poach this from the other or...?
   —  Berean Hunter (talk) 01:34, 9 July 2017 (UTC) reply

@ Berean Hunter: I believe there is a high probability we're dealing with two groups. The original Waffen77 paid sock farm investigated and uncovered in late December 2016 and a second group closely connected to the subject. We don't have anything tangible that connects these two groups together.

• Waffen77 and the other associated accounts were blocked and the promotional-in-tone articles created were nuked. The article Kris Degioia, and similarly titled new articles such as Kris degioia and Kris R Degioia, were repeatedly recreated, in some cases using a word-for-word version. These also spanned into a series of draft and sandbox pages such as Draft:Kris Degioia. An occasional paid sock farm account returns and usually we see them attempt to recreate a number of their paid promotional articles. I believe the IMZahidIqbal socks are more closely related to this first group given the range in topic area.
• Subsequently, accounts claiming to either be the subject (such as Cybercrimes and KDegioia) or having a close connection to the subject (such as Krisdegioia and Newfocusnow) have appeared. CU and behavioural evidence (writing style, grammar, punctuation, spelling, focus, repeated similar arguments, etc.) have connected many of these accounts together. Many being very new single purpose accounts with some of the draft and sandbox pages created by them after the article name was full-protected. I was emailed by one of these accounts where a number issues were disclosed privately following this. For the purposes confidentiality, I cannot speak to the content of what was said. It is however apparent to me that the second set of accounts are separate from the paid sock farm, but have engaged, as shown by SPI cases, their own sock puppetry or meat puppetry, to repeated attempt to have the article recreated. It is possible the subject may meet our notability guidelines but it has yet to be demonstrated clearly in a draft article for it to then be moved to the main space. Additionally, these accounts severely misinterpret our policies and guidelines such as conflict of interest. They have also gone to various admins and other editors who have filed related SPI cases such as Waggie and JustBerry.

I would propose that these be split into two cases: Waffen77 and Krisdegioia, each representing the oldest accounts in their respective groupings per standard SPI procedure. The Chrisnadeau1973 SPI also needs to be split as it contains accounts from each. The first group into Krisdegioia and the second set into Waffen77. Mkdw ^talk 21:41, 9 July 2017 (UTC) reply

I've gone ahead and split/merged the cases and histories accordingly. There were two instances where I couldn't figure out to properly merge them given six pages involved. I manually did those but I think captured 90% of histories correctly. Mkdw ^talk 00:05, 10 July 2017 (UTC) reply

Thank you for doing that and explaining the above. I've looked things over and not seeing anything amiss with the merge or tags. I've blocked the Pliespuppy account as a suspected meat. Closing.
 —  Berean Hunter (talk) 01:24, 10 July 2017 (UTC) reply

• Truthandseek ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• User compare report Auto-generated every hour.
• Editor interaction utility

WP:DUCK, see User talk:Truthandseek/sandbox. Already reported to AIV, placing here for tracking purposes. –  Train2104 ( t •  c) 18:40, 9 July 2017 (UTC) reply

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Confirmed to Cybercrimes. Mkdw ^talk 22:02, 9 July 2017 (UTC) reply
• Closing.
   —  Berean Hunter (talk) 01:24, 10 July 2017 (UTC) reply

• FIGHTER KD ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser( log) · investigate · cuwiki)
• 97.44.4.77 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))
• 97.43.196.70 ( talk ⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser ( log))

• User compare report Auto-generated every hour.
• Editor interaction utility

Sock was found to be likely per this CU report. Entered for the record. IPs blocked.
 —  Berean Hunter (talk) 02:23, 31 July 2017 (UTC) reply

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

•  Confirmed FIGHTER KD to Cybercrimes. Mkdw ^talk 04:18, 31 July 2017 (UTC) reply
• Closing. GAB ^gab 22:56, 31 July 2017 (UTC) reply