Detecting and Understanding the Promotion of Illicit Goods and Services on Twitter

TL;DR

This paper addresses the pervasive promotion of illicit goods and services on Twitter and its cross-platform presence. It introduces a two-part pipeline, the PIP Hunter and PIP Analyzer, to detect, categorize, and map Posts of Illicit Promotion (PIPs) and to uncover the underlying campaigns and contact networks. Key findings include over 12 million PIPs across 5 languages and 10 categories, with porn, gambling, and drugs dominating, and a large ecosystem of IM contacts used for outreach; the work also reveals an arms race with moderation and extensive cross-OSN prevalence. The authors provide a dataset and tooling to support mitigation efforts and advocate for cross-platform collaboration to curb illicit promotion.

Abstract

In this study, we reveal, for the first time, popular online social networks (especially Twitter) are being extensively abused by miscreants to promote illicit goods and services of diverse categories. This study is made possible by multiple machine learning tools that are designed to detect and analyze Posts of Illicit Promotion (PIPs) as well as revealing their underlying promotion campaigns. Particularly, we observe that PIPs are prevalent on Twitter, along with extensive visibility on other three popular OSNs including YouTube, Facebook, and TikTok. For instance, applying our PIP hunter to the Twitter platform for 6 months has led to the discovery of 12 million distinct PIPs which are widely distributed in 5 major natural languages and 10 illicit categories, e.g., drugs, data leakage, gambling, and weapon sales. Along the discovery of PIPs are 580K Twitter accounts publishing PIPs as well as 37K distinct instant messaging accounts that are embedded in PIPs and serve as next hops of communication with prospective customers. Also, an arms race between Twitter and illicit promotion operators is also observed. Especially, 90% PIPs can survice the first two months since getting published on Twitter, which is likely due to the diverse evasion tactics adopted by miscreants to masquerade PIPs.

Figures (8)

• Figure 1: Example posts of illicit promotion on Twitter.
• Figure 2: The methodology to capture and analyze PIPs.
• Figure 3: The cumulative distribution of PIP accounts.
• Figure 4: An example of a pornography PIP.
• Figure 5: Examples of drug PIPs.