Social Media as a Vector for Escort Ads:

A Study on OnlyFans advertisements on Twitter

Maricarmen Arenas∗ Pratheeksha Nair∗
[email protected] [email protected]
HEC Montreal School of Computer Science, McGill University
Mila - Quebec AI Institute Mila - Quebec AI Institute
Canada Canada

Reihaneh Rabbany Golnoosh Farnadi

[email protected] [email protected]
School of Computer Science, McGill University HEC Montreal
Mila - Quebec AI Institute Mila - Quebec AI Institute
Canada Canada
ABSTRACT KEYWORDS
Online sex trafficking is on the rise and a majority of trafficking clustering, community detection, dense block detection, social me-
victims report being advertised online. The use of OnlyFans as a dia networks
platform for adult content is also increasing, with Twitter as its ACM Reference Format:
main advertising tool. Furthermore, we know that traffickers usually Maricarmen Arenas, Pratheeksha Nair, Reihaneh Rabbany, and Golnoosh
work within a network and control multiple victims. Consequently, Farnadi. 2023. Social Media as a Vector for Escort Ads: A Study on OnlyFans
we suspect that there may be networks of traffickers promoting advertisements on Twitter. In 15th ACM Web Science Conference 2023 (WebSci
multiple OnlyFans accounts belonging to their victims. To this end, ’23), April 30–May 01, 2023, Austin, TX, USA. ACM, New York, NY, USA,
we present the first study of OnlyFans advertisements on Twitter 11 pages. https://doi.org/10.1145/3578503.3583609
in the context of finding organized activities.
Preliminary analysis of this space shows that most tweets related 1 INTRODUCTION
to OnlyFans contain generic text, making text-based methods less Forced sexual exploitation and Human Trafficking (HT) are ne-
reliable. Instead, focusing on what ties the authors of these tweets farious crimes affecting over 4.8 million people in the world [21].
together, we propose a novel method for uncovering coordinated Technology is largely involved in the recruiting of HT victims [29]
networks of users based on their behaviour. Our method, called and a large number of these victims are advertised online on es-
Multi-Level Clustering (MLC), combines two levels of clustering cort websites [31]. This number has been growing over the years
that considers both the network structure as well as embedded and the pandemic has magnified the phenomenon [1] through its
node attribute information. It focuses jointly on user connections aftermaths of reduced employment opportunities leading to the
(through mentions) and content (through shared URLs). We apply isolation of potential victims [11]. Consequently, human traffickers
MLC to real-world data of 2 million tweets pertaining to OnlyFans have taken advantage of the situation and sought out new ways of
and analyse the detected groups. We also evaluate our method advertising their victims1 . We speculate that one of these ways is
on synthetically generated data (with injected ground truth) and through OnlyFans, whose popularity has been in the rise especially
show its superior performance compared to competitive baselines. during COVID-19 [27] and after the downfall of websites such as
Finally, we discuss examples of organized clusters as case studies Pornhub [8] and Backpage [2]. OnlyFans is a subscription-based
and provide interesting conclusions to our study. and pay per view (PPV) social platform created in 2016 that pre-
dominantly hosts adult pornographic content. This platform has
CCS CONCEPTS disrupted the market in the last few years and has seen an expo-
• Applied computing → Sociology; • Computing methodolo- nential increase in the number of users2 (as made evident in Figure
gies → Cluster analysis; 1) especially since the pandemic [17]. Users that post on OnlyFans
also rely on external platforms such as twitter to promote their
∗ Both authors contributed equally to this research. content, build communities and gain followers by sharing each
others’ posts [40, 41].
Permission to make digital or hard copies of all or part of this work for personal or In this study, we investigate the interactions among tweets (such
classroom use is granted without fee provided that copies are not made or distributed
for profit or commercial advantage and that copies bear this notice and the full citation
as mentions and external URLs) to help uncover coordinated and
on the first page. Copyrights for components of this work owned by others than the organized behaviour. HT is primarily an organized activity where
author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or one or more perpetrators traffic multiple victims. While this idea
republish, to post on servers or to redistribute to lists, requires prior specific permission
and/or a fee. Request permissions from [email protected]. has been deeply explored for HT detection in escort ads [3, 25, 28,
WebSci ’23, April 30–May 01, 2023, Austin, TX, USA 32, 33, 39], there are no works, to the best of our knowledge, that
© 2023 Copyright held by the owner/author(s). Publication rights licensed to ACM.
1 https://www.state.gov/reports/2021-trafficking-in-persons-report/
ACM ISBN 979-8-4007-0089-7/23/04. . . $15.00
https://doi.org/10.1145/3578503.3583609 2 https://www.followchain.org/onlyfans-statistics/

260
WebSci ’23, April 30–May 01, 2023, Austin, TX, USA Maricarmen Arenas, Pratheeksha Nair, Reihaneh Rabbany, and Golnoosh Farnadi

look into similar behavior in social media networks. Our study is 2 BACKGROUND
focused on identifying organized groups consisting of a network (or In this section, we discuss some of the relevant background infor-
individual) advertising or promoting multiple OnlyFans accounts. mation for understanding the problem at hand and the proposed
Drawing from previous studies that link HT detection to lockstep solution better. We first talk about previous efforts in HT detection
behaviour [23] and present evidence of lockstep in social media [13, and move on to dense block detection which has been used for
22, 37], we formulate this problem as one of identifying tiny clusters finding bot-like behaviour in social media. We then link this to
(relative to the size of social media networks) that introduce dense general graph clustering and finally to tiny cluster detection in
regions on coupled matrices of users’ activity and interactions. graphs.
Intuitively, small groups of users regularly mentioning one other
and referring to the same set of OnlyFans accounts could be sock- HT detection. Online escort ads are the most commonly used data
puppet accounts [24] handled by the same user and is what we source in HT detection research and several methods have been
are interested in discovering. It is to be noted that the detection of employed to analyze them. These include supervised text processing
such groups warrants further investigation by human experts as models [3, 28, 39], unsupervised template detection methods [25, 26]
identifying HT is not a trivial task. and approaches that establish connections between authors using
To this end, we present MLC an unsupervised multi-level clus- shared features such as phone numbers as evidences [32]. Our work
tering approach for identifying organized groups in Twitter3 . Our fundamentally differs from these methods as we are focused on
method processes both content and connection information jointly Twitter data which is much different from escort ads and contains
from the network. Most of the tweets consist predominantly of connections among users. To the best of our knowledge, one of
links to external OnlyFans accounts and their authors are often the only works that focuses on HT detection in social media[19]
seen mentioning, and being mentioned by, other Twitter accounts. leverages a small set of labelled data and combines both image and
Hence, for content, we analyze the shared URLs and for connections, text. This method also relies on tweets that are similar to escort
we consider user mentions to be a strong indication of connectivity. ads and contain keywords related to HT. In our case, we work
From our hypothesis that traffickers with multiple victims control with tweets related to OnlyFans promotions, which tend to utilize
multiple Twitter accounts and mention each other on the same generic sexual vocabulary and therefore cannot be processed using
tweets to increase traction, we model the graph connectivity using this method; not to mention the lack of labelled data.
user mentions. MLC analyses this data in two levels by first de-
tecting graph communities and then finding overlapping clusters. Dense block detection. Lockstep detection is often applied on
We present two approaches for the second part based on i) partial social media to find bot accounts [7] or suspicious networks of
intersections and ii) joint clustering. We employ our method on con- people [12]. This is done by detecting abnormally high levels of
trolled synthetic experiments (Section 5.1) as well as real-world synchronization between two or more users through their shared
Twitter data dated over five years (Section 5.2). Through the syn- activity (hashtags, mentions, common URLs, etc). Dense block detec-
thetic data experiments, we demonstrate the superior performance tion has also been used for finding lockstep behaviour in the context
of MLC in comparison to off-the-shelf contenders. We then provide of anomaly and fraud detection [35–37]. Finding cliques in graphs is
an analysis of the clusters obtained from the real-world data. Lastly also a related problem and most exact, heuristics and approximated
we also discuss three example clusters as case-studies. solutions scale linearly with the size of the graph, making them
The main contributions of this work may be summarized as difficult to work with on real-world data. Scalable solutions such as
follows: Frauder [20] and its extensions including offline [36, 37], online [38]
and hierarchical [44] sub-tensor detection look for subgraphs with
• We conduct the first study analysing patterns of tweets used large average degree. These methods work on a single matrix (such
to advertise OnlyFans accounts as a proxy for understanding as the graph adjacency matrix) whereas our method detects groups
how sex work advertisements are moving towards social which enforce dense substructures in coupled matrices/graphs.
media platforms
• We introduce an unsupervised method for detecting a spe- Graph clustering. Dense subgraph detection can also be consid-
cific type of lockstep behaviour in Twitter that leads to the ered to be similar to graph clustering and community detection
uncovering of organized groups. which finds groups of densely connected nodes. Louvain [5] and
Infomap [34] are two common methods for community detection
The rest of this paper is organized into five sections. Section 2 based on modularity maximization and information compression
covers the background and previous works related to HT and the respectively. Community structure can also be recovered by clus-
detection of organized groups in social media. We introduce and tering node embeddings which are essentially mappings of nodes
discuss our real-world Twitter data collection in Section 3 and move and subgraphs to Euclidean spaces. Unsupervised GraphSAGE [18],
on to our proposed method in Section 4. Section 5 elucidates our node2vec [14] and attri2vec [43] are common network embedding
experiments on both synthetic and real-world data and presents methods and our synthetic experiments (Table 2) reveal that they
our results. We discuss specific examples in Section 6 and conclude are unable to recover tiny clusters as effectively as MLC. Moreover,
in Section 7. All the abbreviations used in the paper are summarized none of these methods have been explored in the context of HT
in Table 4 in Appendix A. detection.

Tiny cluster detection. Identifying tiny clusters is very challeng-

3 Our code base is released at https://github.com/MultiLevelClustering ing and most modularity optimization methods depend on the

261
Social Media as a Vector for Escort Ads:
A Study on OnlyFans advertisements on Twitter WebSci ’23, April 30–May 01, 2023, Austin, TX, USA

183.9k
Authors serves as the premise of our study. Using the same API, we crawled
175000 Tweets
all available tweets mentioning OnlyFans posted on a single day
150000 143.4k (October 1st) of each year (2017-2021). Figure 1 shows a yearly
125000 increase in the number of tweets as well as the number of authors
mentioning OnlyFans. There is a big jump from 2019 to 2020 with
100000
a 260% increase in the number of tweets and a 221% increase in the
78.9k
75000 68.9k number of authors. It is also to be noted that Twitter itself saw a 97%
50000 increase in its users from 2017 to 20215 . Although we only analyzed
39.8k
tweets from one day of the year, it demonstrates the increase in
25000 21.5k
OnlyFans related activity on Twitter which is further corroborated
2.6k 4.8k 4.1k 6.7k
0
2017 2018 2019 2020 2021
by other reports2 .

Figure 1: Growing popularity of OnlyFans in Twitter from 4 METHODOLOGY

the years 2017 to 2021 in terms of number of tweets and In this section we discuss how we get from collected tweets to
authors. organized groups using MLC. We introduce relevant notation and
delve into details about the proposed method (an overview can be
Table 1: Dataset statistics. RT stands for Retweet. found in Figure 2).

4.1 Notation
Year # Tweets (RT) # Authors # URLs # Mentions
In our dataset, each tweet is posted by an author and contains
2017 404,498 (57%) 63,181 120,495 8,075 mentions of other users (Twitter handles) and external URLs (to
2018 582,690 (71%) 96,265 148,878 13,138 OnlyFans or other web pages). The author-mention and author-
2019 571,244 (88%) 137,823 204,068 26,201 URL information are encoded as non-attributed graphs 𝐺 𝑀 and 𝐺𝑈
2020 586,934 (91%) 192,991 375,788 58,910 respectively with a shared set of author nodes. More specifically,
2021 569,057 (94%) 194,235 369,706 64,379
𝐺 𝑀 = (N; EM ); 𝐺𝑈 = (N; EU )
EM = {(𝑖, 𝑗)|𝑛𝑖 .𝑚𝑒𝑛𝑡𝑖𝑜𝑛 ∩ 𝑛 𝑗 .𝑚𝑒𝑛𝑡𝑖𝑜𝑛 ≠ ∅}
network size and connectedness of clusters [10]. pcv [30] is one of
EU = {(𝑖, 𝑗)|𝑛𝑖 .𝑢𝑟𝑙 ∩ 𝑛 𝑗 .𝑢𝑟𝑙 ≠ ∅}
the few methods focused on finding tiny clusters with theoretical
guarantees which considers bipartite stochastic block models. Our where N ∈ {𝑛 1, 𝑛 2, ..., 𝑛 |N| } is the set of unique authors in the
work considers a more general case of coupled matrices and such dataset. We choose to conduct our analysis separately for each year
combination of different sources of information is proven to be a as we are interested in studying how the communities grow or
necessity for better recovery of community structure [9]. evolve (in terms of size, number of URLs involved, etc) over the
years considering OnlyFans as a platform has grown in popularity
3 DATA in more recent years. For each year t ∈ {2017, 2018, ..., 2021}, we
We curated a dataset of 2 million English tweets related to OnlyFans build a pair of graphs (𝐺 𝑀 , 𝐺𝑈 ) t .
posted between 2017 and 20214 . These tweets were extracted with For the synthetic experiments and Joint Clustering, which work
the Academic track Twitter API (v2) using the query keyword of on attributed graphs, we treat 𝐺 𝑀 as the adjacency matrix and X ∈
“OnlyFans”. We then removed tweets containing the words ‘promo- N |N|𝑥 |U| as the attribute matrix created from author-URL informa-
tion’ and ‘promote’ as these are produced by individuals promoting tion (U is the set of unique URLs in the data).
their services to OnlyFans creators.
We collected tweets daily with a cap of 10,000 tweets per day 4.2 Multi-Level Clustering
(due to the API constraint of 10 million tweets per month). We The proposed method MLC is modular and consists of two levels
started hitting this cap while collecting tweets from 2018 which of graph clustering based on i) the network structure and ii) shared
means that the number of tweets mentioning OnlyFans in a single attributes. Having obtained clusters from the first level, we further
day crossed 10,000 sometime in 2018. In 2017 this number was explore two methods of identifying interesting groups. One is called
much lower, which explains why the data collected from 2017 is Partial Intersection (PI) which considers strictly intersecting groups
significantly smaller in size, as seen in row 1 of Table 1. Although of nodes between the clusters and two is Joint Clustering (JC) which
our method focuses on user mentions and URLs, we also collected implements a second level of clustering on the join of the previ-
other information on the tweets such as their retweets, authors, ous level clusters. As previously discussed, most dense subgraph
hashtags and geolocation (if available). Information on retweets detection algorithms scale linearly with the graph size and since
(and replies) were crawled from and linked to their original tweets. we are interested in smaller clusters, we opt for this two-pronged
Additionally, we ran an experiment to confirm the growing pop- approach that first filters out nodes forming large communities
ularity of OnlyFans in Twitter (as discussed in Section 1), which based on their network structure.
4We do not publish this dataset as it may contain sensitive and person-identifying
information but the data may be collected using the keywords shared 5 https://www.omnicoreagency.com/twitter-statistics/

262
WebSci ’23, April 30–May 01, 2023, Austin, TX, USA Maricarmen Arenas, Pratheeksha Nair, Reihaneh Rabbany, and Golnoosh Farnadi

Figure 2: Workflow of the proposed Multi-level Clustering.

Community Detection. For clustering based on network structure, Partial Intersection. Small includes two sets of communities
we rely on community detection to uncover subgraphs with com- detected from 𝐺 𝑀 and 𝐺𝑈 which we call 𝑆 𝑀 and 𝑆𝑈 . Following
mon behaviour (i.e, mentioning common sets of users and URLs). this, Algorithm 1 finds the groups that intersect between the two.
We employ Louvain algorithm [5, 15] which is popularly used on It loops over both sets of communities and finds groups with at
large networks and relies on a two-step process of modularity opti- least two common nodes and are 40% of both group sizes or more
mization and community aggregation. The former aims at creating (i.e, 𝛼 = 0.4). Having obtained a list of intersecting groups, we then
clusters such that their individual modularity is maximized, ensur- filter out groups mentioning fewer than two users and OnlyFans
ing that the smallest possible sub-networks of nodes with common URLs. These groups (called PI clusters in Figure 2) are then analysed
behavior are identified. Having found these modular clusters, they extensively.
are then aggregated to form a new network where the clusters
act as new nodes and the whole process is repeated till maximum
modularity is achieved. Algorithm 2: This algorithm jointly embeds the node con-
For each year, we apply Louvain on the corresponding graphs nection (𝐺𝑆 ) and content (𝑋𝑆 ) information of the induced
𝐺 𝑀 and 𝐺𝑈 separately and obtain two sets of communities. Each subgraph and clusters the node embeddings to find latent
set is then split into two based on an arbitrary size threshold – dense groups
communities with 2 to 99 nodes and those with 100 or more nodes Input: 𝐺𝑆 , 𝑋𝑆 , 𝜙
(hereby referred to as Small and Big respectively). We suspect Output: 𝑍 , JC clusters
that Big communities carry information about trends on OnlyFans 𝑍 = 𝐺𝑆 𝜙 (𝑋𝑆 )
and the overall sex-work industry and we analyse them separately. JC clusters = HDBSCAN(𝑍 )
Small communities are more likely to contain smaller organized return 𝑍 , JC clusters
activities which may potentially be suspicious and remain the main
focus of our study.

Algorithm 1: This algorithm loops over the communities of Joint Clustering. Alternate to strict intersection, we propose an
authors from the Louvain analysis (𝑆 𝑀 and 𝑆𝑈 ) and returns approach that jointly clusters the nodes from Small communities to
intersecting groups detect latent dense groups. We obtain 𝐺𝑆 as the induced subgraph
of 𝐺 𝑀 containing the nodes from both 𝑆 𝑀 and 𝑆𝑈 . 𝐺𝑆 acts as the
Input: 𝑆 𝑀 , 𝑆𝑈 , 𝛼
Output: IG adjacency matrix and 𝑋𝑆 ∈ N |𝑁𝑆 | × |𝑈𝑆 | is a binary node-attribute
IG = ∅ matrix where 𝑁𝑆 is the set of nodes from 𝐺𝑆 and 𝑈𝑆 is the set of
for 𝑐 1 in 𝑆 𝑀 do URLs they mention. 𝑋𝑖 𝑗 =1 if node 𝑖 mentions URL 𝑗 and 0 otherwise.
for 𝑐 2 in 𝑆𝑈 do Having obtained 𝐺𝑆 and 𝑋𝑆 , Algorithm 2 jointly embeds the
𝐼 = 𝑐1 ∩ 𝑐2 nodes and their attributes to a low-dimensional Euclidean space
|𝐼 | |𝐼 |
if |𝐼 | ≥ 2 AND |𝑐 | ≥ 𝛼 AND |𝑐 | ≥ 𝛼 then 𝑍 ∈ R |𝑁𝑆 | ×𝑑 where 𝑑 is the embedding dimension. We use Singular
1 2
IG = IG ∪ 𝐼 Vector Decomposition as 𝜙 to obtain 𝑍 , projecting 𝑋𝑆 to its first
end 𝑑 left singular vectors. These embeddings preserve similarity be-
end tween nodes in terms of both one-hop neighborhood structure and
attribute information. We then detect latent groups by clustering
end
the node embeddings using a hierarchical clustering method like
return IG
HDBSCAN [6]. The clusters thus obtained (called JC clusters in
Figure 2) are further analyzed.

263
Social Media as a Vector for Escort Ads:
A Study on OnlyFans advertisements on Twitter WebSci ’23, April 30–May 01, 2023, Austin, TX, USA

Table 2: Quality scores (%) comparing the ground truth clus- Baselines. We run the following baselines on our synthetic data:
ters and predicted clusters on the synthetic graphs. Higher Infomap [34] and Louvain [5] from community detection; pcv [30]
values indicate better similarity between the predicted and from dense subgraph or tiny cluster detection; node2vec [14], at-
true cluster labels. tri2vec [43] and unsupervised GraphSAGE [18] from network em-
beddings. Pcv only considers node contents, Infomap, Louvain and
N (x103 ) 2 6 10 14 18 22 26 30 node2vec only consider connections, and the other baselines incor-
Louvain [5] 3.9 2.8 2.4 2.3 2.2 2.2 2.1 2.1 porate both content and connections. We compare two versions of
Infomap [34] 11.1 11.1 11.1 11.1 11.1 11.1 11.1 11.1 the Joint Clustering algorithm where the clustering is done using
node2vec [14] 3.5 3.5 4.7 4.1 4.5 2.5 2.3 2.5 KMeans with k=9 (JC w/KMeans) and HDBSCAN (original JC).
attri2vec [43] 3.8 4.5 5.7 5.4 7.5 4.2 9.4 8.2 Lastly we also compare the Joint Clustering results with a Partial
GraphSAGE [18] 3.3 2.2 1.9 1.9 1.9 1.9 2.0 1.75
pcv [30] 5.3 2.4 1.9 1.7 1.6 1.6 1.5 1.5 intersection approach.
Partial intersection 4.4 2.4 1.7 1.4 1.2 1.0 0.8 0.7
Evaluation. To evaluate partitions (how well coordinated groups
JC w/KMeans 11.7 12.8 13.4 13.2 13.3 13.3 13.4 10.6
are separated from the background and each other), we use the
JC 9.9 19.4 22.1 22.2 22.2 22.6 22.2 22.2
quality score in [30] based on Jaccard similarity which is defined
between two sets as the size of their intersection over their union
and is an indication of how similar the two sets are. Given 𝑘 ground-
truth clusters 𝐶 1...𝑘 and 𝑘¯ inferred clusters 𝐶¯1...𝑘¯ , and 𝐽 (𝐴; 𝐵) as the
5 EXPERIMENTS AND RESULTS Jaccard similarity between A and B, the quality score 𝑞 is
Due to the absence of ground truth in our Twitter data, we verify 𝑘
1 ∑︁
the effectiveness of MLC on synthetic data. In Section 5.1, we 𝑞= max 𝐽 (𝐶𝑖 , 𝐶 𝑗 ) ∈ [0, 1] (1)
design a set of synthetic experiments with built-in ground truth 𝑘 𝑖=1 𝑗=1,..,𝑘
to approximate the real-world problem. Next, in Section 5.2 we Intuitively, the quality score rewards the cluster label alignment that
discuss our observations on applying MLC to the Twitter dataset maximizes Jaccard’s similarity between the predicted and ground
and discuss 3 examples of detected organized activity as case studies. truth cluster labels. We repeat each experiment 4 times and the
This section also contains results from the trend analysis on Big average quality scores are reported in Table 2.
communities.
Clustering results. JC methods outperform all baseline methods
and especially improves with increase in the number of users where
5.1 Synthetic data experiments injected groups occupy only a small fraction (0.5%). JC (with HDB-
Based on observations on our collected dataset, the real-world SCAN) performs significantly better than JC w/KMeans and Partial
graphs are large in terms of number of nodes as well as node intersection. However, it is to be noted that for a fair comparison
attributes and extremely sparse (as indicated by the number of with JC, the graphs for PI were setup differently for the synthetic
authors, URLs and Mentions in Table 1). To approximate this, we experiments than in MLC. The former treats 𝐺 𝑀 as the adjacency
generate synthetic graphs and inject co-orindated groups that act matrix and builds a node attribute matrix using 𝐺𝑈 whereas the
as ground truth. We then compare the ability of different methods latter considers them as two separate graphs. Nonetheless, it is an
to recover these injected groups. important baseline because it also acts as an ablation study where
we compare the strict intersection of the Louvain communities
Synthetic data generation. To generate a synthetic graph with the clusters detected by jointly considering connections and
G=(A; X), we assume that both the adjacency matrix A ∈ [0, 1]𝑛×𝑛 content.
and node attribute matrix X ∈ [0, 1]𝑛×𝑚 of the graph are modelled
by Bernoullli random variables whose distribution can be specified Embedding quality. We also examine the node embeddings
through the latent groups. We set values for P ∈ [0, 1]𝑔×𝑔 and learned by JC and compare the separability of the injected orga-
Q ∈ [0, 1]𝑔×𝑚 such that Pii′ is the probability of an edge existing nized groups from the normal nodes for multiple baselines. Figure
between two nodes belonging to groups 𝑖 and 𝑖 ′ , and Qij indicates 3 shows that JC does a better job compared to other embedding
the probability of a user from latent group 𝑖 having an attribute based methods.
from latent group 𝑗. We also set Zs ∈ {0, 1}𝑛𝑥𝑔 as a binary matrix
that encodes hard partition of 𝑛 nodes into 𝑔 non-overlapping la- 5.2 Real world data
tent node groups. Zs is analogous to Z from Algorithm 2 in the Text clustering experiments. Before applying MLC on our real-
sense that it would contain dense regions representing the injected world Twitter data, we attempted to understand this data by simply
groups. Specific details about the values set for P, Q and Z can be clustering the tweet texts. To this end, we applied KMeans (with
found in [42]. K=5) separately on TFIDF representations of 250,000 tweets from
We inject eight coordinated groups (so 𝑔=9 corresponding to 8 years 2017 and 2021. We observed that both years contained a
injected latent coordinated groups and 1 group of normal users) predominant cluster that made up more than 90% of the total tweets.
with 20 nodes and 20 attributes on differently sized graphs (from To better examine the clusters, we looked into the tweets closer to
2,000 to 30,000 nodes). This means that the ratio of coordinated to each cluster’s centroid and concluded that most clusters contained
normal nodes gradually decreases from 8% to 0.5% of the graph size, the same theme: the promotion of one or more OnlyFans accounts
making it increasingly more challenging to detect them. using generic sexually explicit language. Most of these messages

264
WebSci ’23, April 30–May 01, 2023, Austin, TX, USA Maricarmen Arenas, Pratheeksha Nair, Reihaneh Rabbany, and Golnoosh Farnadi

fewer Big communities, their numbers stay relatively constant

through the years.

Partial Intersection. After applying Algorithm 1 on Small com-

munities, we find intersecting groups of Mentions and URLs as
shown in column ‘Inter.’ in Table 3. Note that the column ‘Filtered’
refers to the number of intersecting groups containing multiple user
mentions and OnlyFans accounts. We also present the boxplots of
the number of tweets, authors, user mentions, OnlyFans accounts,
URLs and Twitter accounts found in the PI clusters in Figure 5a.
We include further discussion on these results in Section 6.

Joint Clustering. For JC, we set the SVD dimension 𝑑 = 100. The
number of joint clusters found using HDBSCAN for each year are
mentioned in the ‘Joint Clustering (Small)’ column of Table 3. Al-
Figure 3: The embeddings learned by JC projected on lower
though the number of JC clusters found each year is lower than
dimensions (using PCA) shows clean separation between
that of PI clusters, JC produces more ‘Filtered’ clusters containing
normal data points and those belonging to injected organized
multiple user mentions and OnlyFans accounts than PI. This sup-
groups.
ports our hypothesis that joint clustering using both Mentions and
URLs is better at finding organized groups. Figure 5b shows the
boxplot of the cluster properties. We also discuss some interesting
seemed to have been automatically generated from the OnlyFans cluster examples in Section 6.
platform. What seemed to differentiate most of these clusters were
the structure of their text (templates). We further applied KMeans on Trend analysis. We conduct an experiment on the Big commu-
the biggest cluster (90% of tweets) using K=5. Once again, the tweets nities to better understand the trends in larger groups in our data
closer to the centroid of each cluster accounted for the generic across the years. For a particular year, we apply separately, a Latent
promotion of OnlyFans accounts. Almost all clusters contained Dirichlet Allocation (LDA) model [4] on the tweets of each cluster,
the expression “unseen and exclusive content” with URLs attached which gives us latent topics present in the text. Although topic
to their tweets. Thus, we concluded that simple text clustering modeling is not very helpful due to the extremely short nature of
methods can only give us limited insights. the text, we group together the top 5 words from the top 10 topics
We also applied a text clustering and template detection algo- for each community within a year. This provides us with a list of
rithm specifically designed for HT detecting from escort ads called highly popular and topical words representing the Big communities
Infoshield [25]. Similar to KMeans, the results were not informative in a year and their word cloud is presented in Figure 6. Similar to
and predominantly contained automatic templates from OnlyFans. our analysis using text clustering (in paragraph 5.2), we do not
Although Infoshield works well on escort ad text, this method is observe a drastic change in the top words from 2017 to 2021. Most
not as helpful in short tweet texts as seen in our data. These exper- of the words including ‘video’, ‘clip’, ‘account’, ‘retweet’, ‘subscrip-
iments tell us that we can not rely solely on textual information for tion’, point towards the promotion of OnlyFans content. However,
detecting organized activity. This further bolsters our approach of we do notice the presence of more words such as ‘boy’ and ‘male’.
focusing on user-interaction activity, i.e. user mentions and linked Considering that most of these tweets are self-promotional or pro-
URLs. moting other accounts, this could possibly hint towards a bigger
than expected male-to-female ratio of OnlyFans creators in our
Community detection. We uncover author communities through data sample.
their shared Mentions and URLs separately (𝑆 𝑀 and 𝑆𝑈 ) for each
year and study the distribution of their sizes in Figure 4. We ob- 6 CASE STUDIES
serve that this distribution resembles a power law where majority To identify interesting examples from the set of organized groups
of the communities consist of unique nodes or lone authors. We dis- detected by MLC (from both Filtered columns in Table 3), we jointly
card these nodes from the rest of our analysis as they are not truly consider the number of tweets, the number of OnlyFans accounts
“communities”. The inset histograms zooming in on the Small com- promoted and the frequency of their promotion within a cluster.
munities show that in most cases, their size distribution decreases For e.g, consider a cluster with 100 tweets promoting 2 OnlyFans ac-
gradually. counts A and B. A and B being promoted 2 and 98 times respectively
The total number of communities per year for both Small and is less interesting than 49 and 51 times. In other words, it is more
Big is mentioned in the first two columns of Table 3. Within Small interesting or suspicious if A and B are almost always promoted
communities we observe that for every year, Mentions contain together. We capture this metric in the ‘OnlyFans acc. entropy’
fewer communities than URLs. URL communities are 125% more boxplot in Figure 5. We find three interesting cases and discuss
than Mention communities in 2017 and 180% more in 2021. This them below.
is not surprising considering that the total number of URLs in
our collected data is substantially higher than the total number of Case study 1. Our first case involves the coordinated promotion
Mentions (see Table 1). On the other hand, since there are much of two OnlyFans accounts found in two PI clusters, one each from

265
Social Media as a Vector for Escort Ads:
A Study on OnlyFans advertisements on Twitter WebSci ’23, April 30–May 01, 2023, Austin, TX, USA

Figure 4: Community size distribution for URL graph and Mention graph for every year. The insets are zoomed in distributions
for the Small communities. Plots are in log-log scale.

Table 3: Year-wise clusters statistics detected from the Small and Big communities.

Partial Intersection (Small) Joint Clustering (Small) Community Detection (Big)

Year Mentions URLs Inter. Filtered Clusters Filtered Mentions URLs
2017 177 346 91 4 36 23 12 14
2018 245 452 111 8 43 25 13 15
2019 492 781 204 5 80 18 16 14
2020 1,679 2,263 660 21 258 81 14 19
2021 1,498 2,680 695 34 235 103 20 21

2017 and 2018. For the sake of privacy and clarity, we name these Case study 2. In 2020 we found a PI cluster of 40 authors promot-
accounts 𝐶𝑆 1𝐴 and 𝐶𝑆 1𝐵 . On closer inspection, we find that 75% (of ing seven OnlyFans accounts through 48 retweets. Most of these
479 tweets) from the group in 2017 and 63% (of 57 tweets) from the OnlyFans accounts were promoted simultaneously and 40% of the
group in 2018 were promoted by the account owners (OnlyFans tweets in the cluster promoted at least two accounts. From this, it
creators) themselves. Consequently, a majority of these tweets were can be inferred that these accounts are aware of one another. JC
automated messages from OnlyFans, this is also indicated by their clusters from 2020 also contained a small group of 15 tweets men-
API source available in the data. 32 authors in 2017 and 8 authors tioning 5 out of these 7 accounts. What stands out here is that the
in 2018 (other than the owners) promoted 𝐶𝑆 1𝐴 and 𝐶𝑆 1𝐵 . Three ratio of tweets to authors in this cluster is close to 1 and all the 5 ac-
of these authors appeared both in 2017 and 2018, which further counts were promoted by a different set of 14 authors. Again there
confirms the coordination between both accounts. Each account is no indication of HT, but we clearly see that there is coordinated
is promoted separately over a 100 times in 2017 and 10 times in behaviour.
2018 and together in 12 tweets in 2017 and 1 tweet in 2018. As of
Case study 3. In 2020, we found a JC cluster containing 25 tweets
today, the OnlyFans account of 𝐶𝑆 1𝐴 no longer exists, but its twitter
promoting 8 OnlyFans accounts. All 8 accounts were promoted
account is still active. 𝐶𝑆 1𝐴 describes themself as a photographer
by a separate group of 7 authors with Twitter handles that follow
and claims to be married to 𝐶𝑆 1𝐵 . This coordinated promotion also
a specific pattern starting with the word ‘OnlyFans’ followed by
appears in the JC clusters from 2017 and 2018. Additionally, we also
promotional words such as ‘boost’ or ‘promo’. It appears that these
find another account (additional to 𝐶𝑆 1𝐴 and 𝐶𝑆 1𝐵 ) that reappears
Twitter accounts were created to promote OnlyFans accounts and
in both years. From these observations, we note that these two
their tweets often include #OnlyFansPromo. According to their
accounts are coordinated but show no further signs of suspicious
profiles, they promote tweets or provide retweets for a fee starting at
activity.
$10. This shows that MLC is able to establish connections between
similar third parties promoting the same accounts. However, the

266
WebSci ’23, April 30–May 01, 2023, Austin, TX, USA Maricarmen Arenas, Pratheeksha Nair, Reihaneh Rabbany, and Golnoosh Farnadi

(a) Partial Intersection.

(b) Joint Clustering.

Figure 5: The properties of the detected organized groups over the years. The y-axis indicates counts in log scale. The red line
shows the mean and the green dotted line is the median. Retweets are in percentage and everything else is a count.

Figure 6: Word Cloud of the most popular and topical words from Big communities for each year. The size of a word is indicative
of its frequency. Words referring to specific usernames or explicit in nature have been blurred.

authors of these tweets are payed promoters, in other words this 7 DISCUSSION
cluster do not show signs of suspicious activity. In this section, we discuss the main conclusions of our study and
summarize them in the following points.

267
Social Media as a Vector for Escort Ads:
A Study on OnlyFans advertisements on Twitter WebSci ’23, April 30–May 01, 2023, Austin, TX, USA

Growing number of communities over the years. From Table 3, we be part of a ‘Share-for-Share’ network, paid promoters or manu-
see an increase in the number of communities between 2017 and ally created fake accounts. Case study 2 shows some signs of a
2020 (numbers stay stable between 2020 and 2021). Apart from 2017, coordinated network, where a group of authors were promoting a
this can not be attributed to the total number of collected tweets different set of accounts seemingly belonging to men of a specific
(Table 1) but to the steady increase in the number of authors, URLs ethnic group. This may be a group of young men trying to help
and Mentions. Additionally, it can also be explained by the Twitter each other by sharing their connections. However, based on the
trends related to OnlyFans promotions with sharp jumps from 2018 information we have, even though men are usually less prone to be
to 2019 and 2019 to 2020 as shown in Figure 1. The number of targets of HT than women, we can not clearly conclude that this
PI clusters and Joint clusters also follows the same trend as they group shows no signs of suspicious behaviour. Case study 3 can be
are built off of the communities. The boxplots in Figure 5 show easily declared as a case of paid promotion where all the posts were
the differences in the two sets of detected clusters. The average promoted by a paid group of Twitter accounts specifically focused
values across each graph within Partial Intersection (Subfigure on OnlyFans promotions.
5a) varies with the year with high variances compared to Joint
Case building and detecting clues. As explained previously, to help
Clustering. Year 2019 stands out with regards to URL, OnlyFans
in our investigation, we filtered out clusters based on the number of
and tweets counts, but shows a higher average of Twitter accounts
mentions and OnlyFans accounts. These filters are based on the idea
than the other years. This explains why 2019 had fewer interesting
that HT being an organized activity involves multiple victims [25]
cases to investigate. On the other hand, Joint clusters tend to have
and therefore will advertise multiple accounts. We observe that
steady yearly averages and variances in each of the properties.
groups with very few tweets are naturally less informative, and
Furthermore, JC clusters contain many more outliers and are more
apart from the number of OnlyFans accounts advertised, we also
homogeneous than PI clusters.
need to consider the frequency of their promotions. For e.g, if a
group of authors promotes an OnlyFans account only once while
Presence of coordinated activities in tweets promoting OnlyFans.
promoting another account on 50 out of 51 tweets, it is difficult
Previous works [40] have concluded that OnlyFans creators often
to conclude that these two accounts are part of the same network.
engage in social instrumental support for various reasons, including
Thus, the groups detected by MLC need to be carefully analyzed
promotion of their content. One such collaboration is ‘Share-for-
and filtered to aid with case building.
Share’ where a creator shares the posts of another creator to get
their own posts shared by them in return. Some creators also rely Advantages of a two-pronged clustering approach. Although the
on paid promotions which generally involve a third party charging Joint clustering approach performs better than Partial intersection
a specific fee per post/share. in the synthetic experiments, we suspect this may be partially attrib-
Another type of activity involves fake profiles where users may uted to the nature of how the graphs were setup in the experiment
be tempted to create fake profiles, either automated or manual, to and observe that it is still able to retrieve interesting example cases.
gain more followers and promote themselves [16]. Such accounts Case studies 1 and 2 were identified from PI clusters whereas JC
are termed as “sock-puppets” and have been studied in the litera- partially corroborated them, while contributing additional insights.
ture [24]. This can lead to a scenario where an agent inadvertently Case study 3 was picked up by JC and not by PI. Hence, we be-
creates a seemingly coordinated network, when in fact this network lieve that MLC using both clustering methods in tandem makes
is controlled by the same person. This does not necessarily mean best usage of both the explicit network structure and the embed-
that the tweets in question are not suspicious. The agent could ded attribute information, leading to a more thorough detection of
either be the creator themself or a trafficker controlling the creator organized groups.
account. Moreover, in social media, agents can appear once and
Comparing and contrasting the two clustering approaches. Both
disappear forever, or reappear using a new account.
Partial Intersection and Joint Clustering are similar in their goal of
In short, there are multiple scenarios to consider when it comes
finding clusters by jointly considering the content and connections
to classifying coordinated networks as suspicious or not. The situa-
between Twitter authors. They differ in the way they represent
tions discussed above are often aimed at supporting smaller creators
the two information. Partial Intersection looks at their join from
and the networks thus formed can get detected by algorithms such
a structural point of view and hence models them as two non-
as ours, mistaking them for being nefarious networks and classify-
attributed graphs. Joint Clustering, on the other hand, treats them
ing them as suspicious. Hence it is imperative to try and understand
as a single attributed graph. We construe this as two ways of looking
the social network under study and be responsible while assigning
at the same problem and find that combining them allows us to
labels. Based on this, we conclude that the organized activity results
reap benefits from both.
presented in Table 3 are not meant to be seen as hard proof of coor-
dinated organized crime groups, but rather as potential preliminary Trends of OnlyFans promotion on Twitter. This study is the first
leads for investigation. to mine and analyse millions of tweets related to OnlyFans. Figure
1 shows that the growing number of tweets are directly connected
Conclusions from case studies. Our analysis of the case studies to the surge of OnlyFans in the last few years, and it is most likely
combined with the above concepts help us outline a conclusion for that this number will continue to flourish through time, inevitably
each case. Case study 1 is most likely a husband-wife duo promot- creating more and more coordinated networks. Simple text analyses
ing each other (as mentioned in the husband’s account description). of our data show that a large number of these tweets are generic and
We speculate that the additional authors found in the cluster may focus on promoting OnlyFans accounts. Moreover, we observe the

268
WebSci ’23, April 30–May 01, 2023, Austin, TX, USA Maricarmen Arenas, Pratheeksha Nair, Reihaneh Rabbany, and Golnoosh Farnadi

sexually explicit vocabulary present in the tweets remain constant Knowledge discovery and data mining. 855–864.
[15] L Guillaume. 2008. Fast unfolding of communities in large networks. Journal
through time. Finally, we also notice certain words such as ‘boy’ and Statistical Mechanics: Theory and Experiment 10 (2008), P1008.
‘male’ showing up in the tweets, which may hint towards higher [16] Supraja Gurajala, Joshua S White, Brian Hudson, Brian R Voter, and Jeanna N
than expected male to female creator ratio. This is also important to Matthews. 2016. Profile characteristics of fake Twitter accounts. Big Data &
Society 3, 2 (2016), 2053951716674236.
note because currently most studies on HT detection or OnlyFans [17] Vaughn Hamilton, Ananta Soneji, Allison McDonald, and Elissa Redmiles. 2022.
creators are focused only on females. " Nudes? Shouldn’t I charge for these?": Exploring What Motivates Content
Creation on OnlyFans. arXiv preprint arXiv:2205.10425 (2022).
Scope for further research. This paper demonstrates that com- [18] Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation
learning on large graphs. Advances in neural information processing systems 30
munity detection and dense block detection are well-suited for (2017).
finding organized groups of OnlyFans advertisements on Twitter. [19] Myriam Hernández-Álvarez. 2019. Detection of possible human trafficking in
Specifically for measuring “suspiciousness”, there are certain clues Twitter. In 2019 International Conference on Information Systems and Software
Technologies (ICI2ST). IEEE, 187–191.
and/or metrics based on which detected groups can be ranked. Al- [20] Bryan Hooi, Hyun Ah Song, Alex Beutel, Neil Shah, Kijung Shin, and Christos
though we currently do this in a way by looking at the OnlyFans Faloutsos. 2016. Fraudar: Bounding graph fraud in the face of camouflage. In
account entropy of clusters, this can be more systematically for- Proceedings of the 22nd ACM SIGKDD international conference on knowledge
discovery and data mining. 895–904.
malized. Lastly, considering that ours is a first exploratory study [21] International Labour Office 2012. ILO Global Estimate of Forced
on this data, we only considered user mentions (for connectivity) Labour. http://www.ilo.org/wcmsp5/groups/public/---ed_norm/---declaration/
documents/publication/wcms_182004.pdf.
and URLs (for content). Future works may incorporate additional [22] Meng Jiang, Peng Cui, Alex Beutel, Christos Faloutsos, and Shiqiang Yang. 2016.
information such as hashtags, OnlyFans accounts, keywords in Inferring lockstep behavior from connectivity pattern in large graphs. Knowledge
the tweets, etc. as additional matrices to jointly find dense blocks. and Information Systems 48, 2 (2016), 399–428.
[23] Aayushi Kulshrestha. 2021. Detection of Organized Activity in Online Escort
One straightforward approach is to concatenate all the matrices Advertisements. McGill University (Canada).
into one joint “content” matrix and apply MLC on it. Extending to [24] Srijan Kumar, Justin Cheng, Jure Leskovec, and VS Subrahmanian. 2017. An
generic Twitter data is also straightforward by selecting the content army of me: Sockpuppets in online discussion communities. In Proceedings of the
26th International Conference on World Wide Web. 857–866.
information that is most relevant to the application, for e.g, Tf-idf [25] Meng-Chieh Lee, Catalina Vajiac, Aayushi Kulshrestha, Sacha Levy, Namyong
vectors of tweet texts. Park, Cara Jones, Reihaneh Rabbany, and Christos Faloutsos. 2021. InfoShield:
generalizable information-theoretic human-trafficking detection. In 2021 IEEE
37th International Conference on Data Engineering (ICDE). IEEE, 1116–1127.
ACKNOWLEDGMENTS [26] Lin Li, Olga Simek, Angela Lai, Matthew Daggett, Charlie K Dagli, and Cara
Jones. 2018. Detection and characterization of human trafficking networks
This research is partially funded from the Canada CIFAR AI Chairs using unsupervised scalable text template matching. In 2018 IEEE International
Program. One of the first authors is also supported by an FRQNT Conference on Big Data (Big Data). IEEE, 3111–3120.
scholarship. [27] Canela López. 2020. A wave of people turned to OnlyFans to earn money when
they lost their jobs due to the pandemic. Insider. https://www. insider. com/people-
are-creating-onlyfans-accounts-after-losing-jobs-during-pandemic-2020-6 (2020).
REFERENCES [28] Anastasija Mensikova and Chris A Mattmann. 2018. Ensemble sentiment analysis
[1] Marwah Adhoob. 2021. Trafficking in persons. IELR 37 (2021), 273. to identify human trafficking in web data. In Workshop on Graph Techniques for
[2] Tatiana Akhund, Daniel Pollack, and Katie Shipp. 2022. Human Trafficking and Adversarial Activity Analytics (GTA 2018), Marina Del Rey, CA, USA. 5–9.
Technology. (2022). [29] SELL DOMESTIC MINOR. 2015. A REPORT ON THE USE OF TECHNOLOGY
[3] Hamidreza Alvari, Paulo Shakarian, and JE Snyder. 2017. Semi-supervised learn- TO RECRUIT, GROOM AND SELL DOMESTIC MINOR SEX TRAFFICKING
ing for detecting human trafficking. Security Informatics 6, 1 (2017), 1–14. VICTIMS. (2015).
[4] David M Blei, Andrew Y Ng, and Michael I Jordan. 2003. Latent dirichlet allocation. [30] Stefan Neumann. 2018. Bipartite stochastic block models with tiny clusters.
Journal of machine Learning research 3, Jan (2003), 993–1022. Advances in Neural Information Processing Systems 31 (2018).
[5] Vincent D Blondel, Jean-Loup Guillaume, Renaud Lambiotte, and Etienne Lefeb- [31] Polaris. 2021. 2020 US National Human Trafficking Hotline Statis-
vre. 2008. Fast unfolding of communities in large networks. Journal of statistical tics. https://polarisproject.org/2020-us-national-human-trafficking-hotline-
mechanics: theory and experiment 2008, 10 (2008), P10008. statistics/.
[6] Ricardo JGB Campello, Davoud Moulavi, and Jörg Sander. 2013. Density-based [32] Reihaneh Rabbany, David Bayani, and Artur Dubrawski. 2018. Active search of
clustering based on hierarchical density estimates. In Pacific-Asia conference on connections for case building and combating human trafficking. In Proceedings of
knowledge discovery and data mining. Springer, 160–172. the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data
[7] Nikan Chavoshi, Hossein Hamooni, and Abdullah Mueen. 2016. Debot: Twitter Mining. 2120–2129.
bot detection via warped correlation.. In Icdm. 817–822. [33] Pia Ramchandani, Hamsa Bastani, and Emily Wyatt. 2021. Unmasking Human
[8] Taylor Comerford. 2022. Pornography Isn’t the Problem: A Feminist Theoretical Trafficking Risk in Commercial Sex Supply Chains with Machine Learning. Avail-
Perspective on the War against Pornhub. BCL Rev. 63 (2022), 1177. able at SSRN 3866259 (2021).
[9] Yash Deshpande, Subhabrata Sen, Andrea Montanari, and Elchanan Mossel. 2018. [34] Martin Rosvall and Carl T Bergstrom. 2008. Maps of random walks on complex
Contextual stochastic block models. Advances in Neural Information Processing networks reveal community structure. Proceedings of the national academy of
Systems 31 (2018). sciences 105, 4 (2008), 1118–1123.
[10] Santo Fortunato and Marc Barthelemy. 2007. Resolution limit in community [35] Kijung Shin, Tina Eliassi-Rad, and Christos Faloutsos. 2016. Corescope: Graph
detection. Proceedings of the national academy of sciences 104, 1 (2007), 36–41. mining using k-core analysis—patterns, anomalies and algorithms. In 2016 IEEE
[11] Maria Grazia Giammarinaro. 2020. COVID-19 Position paper: The impact and 16th international conference on data mining (ICDM). IEEE, 469–478.
consequences of the COVID-19 pandemic on trafficked and exploited persons. [36] Kijung Shin, Bryan Hooi, and Christos Faloutsos. 2016. M-zoom: Fast dense-
Retrieved from COVID-19-Impact-trafficking. pdf (ohchr. org) (2020). block detection in tensors with quality guarantees. In Joint european conference
[12] Maria Giatsoglou, Despoina Chatzakou, Neil Shah, Alex Beutel, Christos Falout- on machine learning and knowledge discovery in databases. Springer, 264–280.
sos, and Athena Vakali. 2015. Nd-sync: Detecting synchronized fraud activities. [37] Kijung Shin, Bryan Hooi, Jisu Kim, and Christos Faloutsos. 2017. D-cube: Dense-
In Pacific-Asia Conference on Knowledge Discovery and Data Mining. Springer, block detection in terabyte-scale tensors. In Proceedings of the Tenth ACM Inter-
201–214. national Conference on Web Search and Data Mining. 681–689.
[13] Maria Giatsoglou, Despoina Chatzakou, Neil Shah, Christos Faloutsos, and [38] Kijung Shin, Bryan Hooi, Jisu Kim, and Christos Faloutsos. 2017. Densealert:
Athena Vakali. 2015. Retweeting activity on twitter: Signs of deception. In Incremental dense-subtensor detection in tensor streams. In Proceedings of the
Pacific-Asia Conference on Knowledge Discovery and Data Mining. Springer, 122– 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data
134. Mining. 1057–1066.
[14] Aditya Grover and Jure Leskovec. 2016. node2vec: Scalable feature learning for [39] Edmund Tong, Amir Zadeh, Cara Jones, and Louis-Philippe Morency. 2017.
networks. In Proceedings of the 22nd ACM SIGKDD international conference on Combating human trafficking with deep multimodal models. arXiv preprint
arXiv:1705.02735 (2017).

269
Social Media as a Vector for Escort Ads:
A Study on OnlyFans advertisements on Twitter WebSci ’23, April 30–May 01, 2023, Austin, TX, USA

[40] Jirassaya Uttarapong, Ross Bonifacio, Rae Jereza, and Donghee Yvette Wohn. A ABBREVIATIONS
2022. Social Support in Digital Patronage: OnlyFans Adult Content Creators
as an Online Community. In CHI Conference on Human Factors in Computing
Systems Extended Abstracts. 1–7. Table 4: Abbreviations used in the paper.
[41] Maxim Vlerick and Jorik Van Hove. 2021. Revolutionising digital sex work: an
analysis of the impact of OnlyFans on sex workers. (07 2021).
[42] Junhao Wang, Sacha Levy, Ren Wang, Aayushi Kulshrestha, and Reihaneh Rab- Short-form Expansion Explanation
bany. 2019. SCG: Spotting Coordinated Groups in Social Media. arXiv preprint MLC Multi-Level Clustering Proposed 2 level clustering method
arXiv:1910.07130 (2019).
[43] Daokun Zhang, Jie Yin, Xingquan Zhu, and Chengqi Zhang. 2019. Attributed net- Proposed method that treats content as
work embedding via subspace discovery. Data Mining and Knowledge Discovery PI Partial Intersection graph and focuses solely on the
33, 6 (2019), 1953–1980. structural component of Twitter graphs
[44] Si Zhang, Dawei Zhou, Mehmet Yigit Yildirim, Scott Alcorn, Jingrui He, Hasan
Davulcu, and Hanghang Tong. 2017. Hidden: hierarchical dense subgraph detec- Proposed method that treats content as
tion with application to financial fraud detection. In Proceedings of the 2017 SIAM JC Joint Clustering node attributes and learns joint
International Conference on Data Mining. SIAM, 570–578. embeddings with connections
Forced sexual exploitation of
HT Human Trafficking
individuals for profit
Graph communities with
Big Big graph communities more than 100 nodes
used for trend analysis
Graph communities with fewer than
Small Small graph communities 100 nodes used for cluster analysis
and finding coordinated activities
Non-attributed graph where nodes
𝐺𝑀 User-mention graph are users and edge between two users
means they mentioned same users
Non-attributed graph where nodes
𝐺𝑈 User-URL graph are users and edge between two users
means they mentioned the same URLs

270