  In this paper, we present an extensive study of the promotion of illicit
goods and services on Twitter, a popular online social network(OSN). This study
is made possible through the design and implementation of multiple novel tools
for detecting and analyzing illicit promotion activities as well as their
underlying campaigns. As the results, we observe that illicit promotion is
prevalent on Twitter, along with noticeable existence on other three popular
OSNs including Youtube, Facebook, and TikTok. Particularly, 12 million distinct
posts of illicit promotion (PIPs) have been observed on the Twitter platform,
which are widely distributed in 5 major natural languages and 10 categories of
illicit goods and services, e.g., drugs, data leakage, gambling, and weapon
sales. What are also observed are 580K Twitter accounts publishing PIPs as well
as 37K distinct instant messaging (IM) accounts that are embedded in PIPs and
serve as next hops of communication, which strongly indicates that the
campaigns underpinning PIPs are also of a large scale. Also, an arms race
between Twitter and illicit promotion operators is also observed. On one hand,
Twitter is observed to conduct content moderation in a continuous manner and
almost 80% PIPs will get gradually unpublished within six months since posted.
However, in the meantime, miscreants adopt various evasion tactics to
masquerade their PIPs, which renders more than 90% PIPs keeping hidden from the
detection radar for two months or longer.
