Authors: Clara Page & Timothy Bollé
DFRWS USA 2026
Abstract
Over the past decade, the commercial sex industry has increasingly shifted to online platforms, where classified advertisements have become a primary mechanism for connecting clients and service providers. These online environments host large volumes of publicly accessible content that combine textual descriptions, images, contact information, and publication metadata. While such advertisements are routinely examined on a case-by-case basis, their forensic relevance often lies not in isolated ads but in the relationships that can be observed across multiple postings through shared digital traces.
This work presents a technical and exploratory methodology for the forensic collection and analysis of online escort advertisements, grounded in a trace-oriented forensic intelligence perspective. The study focuses on a corpus of online sex classified ads collected in the Toronto (Canada) area using automated web scraping techniques. Both textual and visual traces are extracted and structured within a relational database designed to support cross-referenced and scalable analysis. The methodology is intentionally adaptive and evolves iteratively in response to patterns emerging from the data, rather than relying on a fixed or predefined analytical workflow.
The analytical process unfolds in multiple stages. First, explicit and directly observable links between advertisements are identified using stable digital traces deliberately provided by advertisers, such as phone numbers and usernames, as well as strictly identical images detected through cryptographic hashing. These exact matches allow for the identification of obvious reposts, repeated publications, and direct continuity across advertisements. Image hashing is used at this stage as a baseline technique to establish reliable visual links without engaging in detailed visual interpretation.
Building on these explicit links, the methodology then explores less obvious forms of relatedness between advertisements through similarity-based analyses. Textual content is examined using multiple complementary approaches, including word-based and character-based similarity measures, as well as stylistic features such as emoji usage. Rather than assuming which elements are most indicative of coordination, the analysis is designed to surface patterns of reuse, variation, and consistency across linked advertisements.
In practice, multiple types of digital traces can be used to link advertisements; however, the relative strength and interpretability of these links remain an open empirical question. Rather than assuming that certain traces or combinations of traces are inherently stronger, the methodology adopts an exploratory approach aimed at examining how different links emerge and how their analytical relevance varies across cases. The objective is not to determine criminal activity or establish attribution, but to support the production of forensic intelligence by revealing structural relationships within complex online advertising ecosystems.
Preliminary results show that this trace-based approach reveals recurring organizational patterns ranging from loosely connected clusters to more densely linked groups of advertisements. By emphasizing methodological transparency, reproducibility, and scalability, this work contributes a practical framework for the analysis of online classified ads. The proposed methodology is intended to support investigators, analysts, and researchers by providing tools to better understand coordination and reuse practices in online sex markets, and to inform future investigative and analytical efforts in the context of human trafficking and sexual exploitation.