This survey of the Islamic State’s online activity is the first in a series analysing the online ecosystems of Islamist terrorist groups across the open web, social media platforms and messaging applications. The next report in the series will focus on al-Qaeda. ISD’s focus on the ecosystems of terrorist content online is aimed at highlighting the impacts of an increasingly fragmented platform landscape. The report also explores the potential impacts of social media platforms loosening their commitment to content moderation on online terrorist activity.^[1] All of the accounts, channels, pages and groups mentioned in the report were flagged using each of the respective platform’s reporting mechanisms.  

New and Improved Pipelines, Same as the Old Pipelines  

The old adage is “pressure bursts pipes,” but for the Islamic State’s^[2] digital ecosystem, pressure just results in new pipelines.  

Tracking and monitoring official^[3] and unofficial^[4] Islamic State (IS) outlets and their supporters online is a Sisyphean undertaking. Faced with universal bans and takedowns, these outlets and their supporters are continually reinventing themselves to evade and stave off deletion. At the same time, social media platforms, internet regulatory bodies and law enforcement are continually faced with new accounts, groups, pages, channels and websites, despite terrorist content being generally illegal and in violation of platform rules. This perennial game, which over the years has been publicly called ‘whack-a-mole’ and ‘cat and mouse,’ has become part and parcel of the ecosystem of platforms.  

Despite the losses in territory in Iraq and Syria in 2019, IS continues to hold on to a valuable internet ecosystem connected through social media platforms such as Facebook, Instagram, TikTok, and X (formerly Twitter), as well as messaging applications such as Telegram, WhatsApp, RocketChat, Element and Gemspace. Ingrained in this ecosystem are more than 93 active and partially defunct unofficial media outlets supporting IS across platforms.^[5] Some of the pro-IS outlets in this ecosystem have alliances composed of as many as 20 groups, while some groups were launched at the time of this report.^[6] Some of these groups solely recycle content with rather poor graphic design and translation, while others command audiences larger than 10,000 on channels solely dedicated to their content.  

The Institute for Strategic Dialogue (ISD) has tracked the growth of these outlets for the past eight years with a specific focus on their propaganda and their tactics in evading and staving off moderation efforts and takedowns. Several of these outlets have restricted their activities to one platform, while several have created a multi-platform presence that allows them to seed their content to different audiences. One constant remains through it all— the Islamic State and its supporters are adapting.  

To that end, ISD analysts reviewed closed forums, private and public channels affiliated with unofficial IS outlets on messaging applications, public accounts, pages and groups on popular social media platforms. This review is not meant to provide a comprehensive picture of every group, outlet and diffused supporters online, but rather to illustrate the group’s pervasive digital presence. To this effort, analysts identified the following:  

• Three websites on the open web linked to Islamic State support groups functioning as aggregators for channels and content, archives and forums. The combined website visitor base of these three websites over the past six months has been just over 421,000, with more than 40 percent of the traffic being unique users.
• 300 accounts and 15 Facebook pages linked to support outlets, some with audiences as large as 22,000. Individual accounts supportive of IS were using ‘professional mode,’ giving them access to features to monetise their content.
• 50 accounts on Instagram, connected to a wider network on Facebook.
• 50 accounts on TikTok, sharing remixed content of IS, as well as official propaganda.
• 15 channels on WhatsApp being used to share IS content and new channels that link to the wider ecosystem of support.
• 15 channels on Telegram being used to share IS content and new channels that link to the wider ecosystem of support.
• 15 channels on Element being used to share IS content and new channels that link to the wider ecosystem of support.
• 10 accounts on X, which happened to have the fastest takedown rates linked to IS support. The accounts typically did not last 72 hours. However, concerningly, two of the accounts seemed to have premium service subscriptions, indicating that X had accepted payments from accounts sharing terrorist content.   

Some of the Islamic State’s adaptation tactics to maintain digital territory has bordered on the absurd, such as using children’s cartoons like Cocomelon as the opening to IS videos. Other tactics have been more practical, such as the use of freely available digital phone numbers to create phalanxes of accounts that can simultaneously pump out content. These tactics, whether absurd or practical, have ensured that the message of IS continues to spread.  

This report assesses the state of IS online a decade after the founding of the so-called ‘caliphate,’ and a generation after the first Salafi-jihadist groups leveraged the internet to globalise their message. While the pressure placed on the IS in the wake of its territorial ascension undeniably altered its digital ecosystem, key questions remain — one of the most pressing being: how does IS hold on to digital territory as its offline operations are increasingly decentralised and spread across continents?  

This report, therefore, provides a platform-by-platform breakdown of the presence of IS support. Despite millions of dollars spent to counter its appeal and dissemination efforts, and entire teams within government and the private sector working to disrupt its ability to ‘post through it,’ the Islamic State and its supporters have not only continued to sustain themselves but developed new modes to spread their messages. Countless actions by law enforcement, governments and social media platforms have undoubtedly been successful, but that success has also resulted in new groups, websites, channels and platforms being exploited by a new generation of supporters of the group. 

Part and parcel of this challenge has been the overarching focus on ‘official’ outlets and their channels. These have been one of the primary concerns of governments for over the past decade. At the same time, unofficial channels and groups have festered. This unofficial ecosystem of support for IS came in tandem with last year’s rise in IS youth attacks and plots the world witnessed last year. According to the Washington Institute for Near East Policy’s Islamic State Select Worldwide Activity Map more than 53 minors were involved in attacks, attack planning or throes of propaganda operations. Several of these cases demonstrated the strength of the Islamic State ecosystem online, which seemingly connected teens in Austria, Belgium, France, Germany, Spain, Sweden, and Switzerland across borders.

Most, if not all, of these cases would be considered inspired, not directed, by IS. The perpetrators created and fashioned their own brands for IS outlets, and in some cases accessed materials that were produced by the group when they were toddlers. Inspired attacks are more likely than not, in this current era of Islamic State, to have an online element, one that scholars have argued could speed up the radicalisation process. While this report does not identify the specific online influences behind these cases, it instead highlights the broader ecosystem of Islamic State support across platforms and the threats it poses. 

Methodology: Sizing up ‘the State’ Online 

Empirically determining the size of the Islamic State online is fraught with methodological challenges, not only because of the decentralised nature of the internet, but also due to the tactics IS’s supporters use to evade takedowns. Creating duplicate accounts, for instance, to stave off the effect of moderation creates the impression of phalanxes of accounts online spreading the IS’s message.  

To gauge the size and impact of these digital communities, analysts collected a sample of IS accounts, channels and websites from a range of platforms to examine both their scale and the interconnected nature of their support ecosystem. Based on these communities, analysts analysed impact of media through views, likes, or reshares.  

All of the accounts, channels and websites were manually reviewed by analysts between December 2024 through January 2025 to ensure they were in fact promoting, encouraging or spreading ideology or content linked to the Islamic State. In some instances, the use of official media was a dead giveaway, however, in others, such as grey news sites^[7], the primary goal was to catfish audiences into believing the page to be linked to a legitimate news organisation, when in reality, it was an IS propaganda outlet. 

Using these platforms, messaging applications and websites as the basis of the study helped ISD pinpoint trends in IS’s use of the internet, including modes by which they are protecting their digital territory and evading threats, as well as their ability to propagate IS ideology and other instructional content to their supporters.   

This report will delve into the key findings of the study, break down the ecosystems of IS support on Platforms (Facebook, Instagram, TikTok, and X) messaging applications (WhatsApp, Telegram and Element) and websites. The conclusion of the report will highlight the interconnected nature of these elements and their centrality to the Islamic State online ecosystem.  

Key Findings: ‘The State’ Continues to Thrive Online  

This report highlights two meta findings. The first is that social media platforms, messaging applications, and the open web continue to be susceptible to exploitation by the Islamic State outlets in the era of a much more fractured internet landscape. The second, being the volume and pace at which unofficial outlets produce and reproduce content is the central issue. In short, more platforms and more unofficial outlets lead to greater challenges in addressing the overall ecosystem of support.  

Unofficial outlets evade moderation not only because they may not have been catalogued by platforms and their moderation teams, but also because they are operating in more languages than before, stretching the limits of trust and safety teams. ISD has noted in the past that Arabic language IS material continues to haunt platforms, and yet, platforms still aren’t effective in catching this content. The same goes for languages such as Kurdish, Pashto, Somali, Amharic, Russian, Filipino and Indonesian.   

There appear to be clear failures at restricting Islamic State activity across several of the platforms (Facebook, Instagram, TikTok and WhatsApp) Despite the tools and teams in place to curb the group’s proliferation, a persistent and visible segment of IS continues to exploit these platforms. Interestingly at the time of writing, X has been able to contain IS content the quickest, while Facebook has been the slowest.

Perhaps the most pertinent takeaway of the report is that IS supporters are choosing to use much more public mainstream platforms just as much as closed messaging applications. With IS activity being coordinated in public view of other users with seemingly no fear of repercussion, the pages, accounts and channels surfaced in this report point to an environment where they have carved out a foothold and continue to take advantage of under-moderation.  

Platform-Specific Findings  

Facebook  

• Facebook remains an epicentre of activity for unofficial outlets supportive of the Islamic State, outpacing the other platforms in terms of accounts and content. Analysts were able to find IS content, accounts, as well as pages and groups with simple keyword searches such as names of IS leaders. Analysts found content posted regularly, such as weekly releases of the official newsletter of the Islamic State, al-Naba, on a page named after it. They also found Facebook-only IS outlets and support groups that were attacking ‘enemy’ pages and organising their activity on Facebook openly through public posts.  
• Out of the 15 public pages on Facebook in support of IS, the largest had more than 22,000 followers. It had shared 80 video reels since its creation in October 2023 which generated more than 1.6 million views. The most watched video, a pair of men driving a car listening to a nasheed used by IS, generated 236,000 views. The second most watched video was stripped from an official IS video created during Ramadan and features children learning religious principles from an IS ideologue, which generated 116,000 views.  
• IS support accounts have primarily transitioned from pages to public profiles, using their public posts to promote and organise activities on Facebook. ISD analysts found 300 accounts promoting IS, coordinating ‘raids’^[8] on Western news outlets and organisations affiliated with the Syrian Salvation Government. The accounts openly shared branded IS material, often facing no moderation whatsoever. 

• IS operational security support groups are organising on Facebook, using both a public page and a private group to coordinate activities. The group known as the Electronic Soldiers of the Caliphate have created a group that assists supporters in the Islamic State in their efforts to bypass moderation, enhance their practices around surveillance and find ways to create more accounts on popular platforms.  
• IS support accounts on Facebook have begun using a feature known as ‘professional mode,’ which unlocks a “dashboard” that gives the accounts creator insights, monetization options, and comment moderation tools. Analysts observed IS accounts leveraging this feature to access analytics, refine their audience targeting and expand their reach.   

Instagram  

• Instagram functions as an extension of IS accounts already on Facebook, with analysts finding links to 50 pro-IS Instagram accounts on Facebook. Many of the 300 accounts on Facebook encountered during the observation period had corresponding accounts on Instagram.  
• Instagram accounts function as central repositories for archived official content in some instances. Analysts found five accounts dedicated to archiving the official content of the Islamic State, such as Amaq and al-Naba, that are not altered in any shape or form.  
• IS Instagram accounts were engaged in sharing methods on how to create bots to automate the distribution of propaganda on Telegram, while linking to their Telegram bot accounts that shared IS content. In effect, Instagram acts as a key hub in the IS ecosystem, broadening a users’ access to content and facilitating interaction with other IS supporters.  
• Unofficial and official IS content with just minor edits, such as cropping out the IS branding on the video, are not being automatically flagged by Instagram. These simple edits are allowing Islamic State accounts and content to fester on the site.  
• Comment sections linked to IS accounts on Instagram are used to share WhatsApp channels for groups of individual supporters of the Islamic State. Similar to how IS accounts on Instagram link to Telegram, they also direct users to WhatsApp channels that distribute IS content, including, in some cases, instructional bomb-making materials. These moderation gaps across Meta platforms highlight ongoing failures in content regulation. 

TikTok 

• TikTok is a key platform for Islamic State supporters to reach new audiences. TikTok allows propagandists to extend their influence beyond a dedicated base of supporters on closed and encrypted platforms, broadening the reach of core narratives from both new and old ideologues. Previous ISD research found a small sample of 20 IS support accounts on TikTok had garnered more than one million views in May 2023 alone.  
• Following the New Year’s Eve IS-inspired attack in New Orleans, which killed 15 people and injured at least 57, accounts on TikTok glorified the attacker in videos that generated thousands of views. The videos, posted by accounts that were observed during the time period, glorified the attacker, Shamsud-Din Jabbar, an American-born resident of Houston, Texas. One video praising the attacker generated more than 10,100 views while another more than 30,000 views.  
• The platform’s IS ecosystem includes news accounts sharing official IS news, media munasireen (supporters spr