A decade after the ‘Caliphate’: The state of the Islamic State online

12 February

By: Moustafa Ayad

This survey of the Islamic State’s online activity is the first in a series analysing the online ecosystems of Islamist terrorist groups across the open web, social media platforms and messaging applications. The next report in the series will focus on al-Qaeda. ISD’s focus on the ecosystems of terrorist content online is aimed at highlighting the impacts of an increasingly fragmented platform landscape. The report also explores the potential impacts of social media platforms loosening their commitment to content moderation on online terrorist activity.^[1] All of the accounts, channels, pages and groups mentioned in the report were flagged using each of the respective platform’s reporting mechanisms.  

New and Improved Pipelines, Same as the Old Pipelines  

The old adage is “pressure bursts pipes,” but for the Islamic State’s^[2] digital ecosystem, pressure just results in new pipelines.  

Tracking and monitoring official^[3] and unofficial^[4] Islamic State (IS) outlets and their supporters online is a Sisyphean undertaking. Faced with universal bans and takedowns, these outlets and their supporters are continually reinventing themselves to evade and stave off deletion. At the same time, social media platforms, internet regulatory bodies and law enforcement are continually faced with new accounts, groups, pages, channels and websites, despite terrorist content being generally illegal and in violation of platform rules. This perennial game, which over the years has been publicly called ‘whack-a-mole’ and ‘cat and mouse,’ has become part and parcel of the ecosystem of platforms.  

Despite the losses in territory in Iraq and Syria in 2019, IS continues to hold on to a valuable internet ecosystem connected through social media platforms such as Facebook, Instagram, TikTok, and X (formerly Twitter), as well as messaging applications such as Telegram, WhatsApp, RocketChat, Element and Gemspace. Ingrained in this ecosystem are more than 93 active and partially defunct unofficial media outlets supporting IS across platforms.^[5] Some of the pro-IS outlets in this ecosystem have alliances composed of as many as 20 groups, while some groups were launched at the time of this report.^[6] Some of these groups solely recycle content with rather poor graphic design and translation, while others command audiences larger than 10,000 on channels solely dedicated to their content.  

The Institute for Strategic Dialogue (ISD) has tracked the growth of these outlets for the past eight years with a specific focus on their propaganda and their tactics in evading and staving off moderation efforts and takedowns. Several of these outlets have restricted their activities to one platform, while several have created a multi-platform presence that allows them to seed their content to different audiences. One constant remains through it all— the Islamic State and its supporters are adapting.  

To that end, ISD analysts reviewed closed forums, private and public channels affiliated with unofficial IS outlets on messaging applications, public accounts, pages and groups on popular social media platforms. This review is not meant to provide a comprehensive picture of every group, outlet and diffused supporters online, but rather to illustrate the group’s pervasive digital presence. To this effort, analysts identified the following:  

• Three websites on the open web linked to Islamic State support groups functioning as aggregators for channels and content, archives and forums. The combined website visitor base of these three websites over the past six months has been just over 421,000, with more than 40 percent of the traffic being unique users.
• 300 accounts and 15 Facebook pages linked to support outlets, some with audiences as large as 22,000. Individual accounts supportive of IS were using ‘professional mode,’ giving them access to features to monetise their content.
• 50 accounts on Instagram, connected to a wider network on Facebook.
• 50 accounts on TikTok, sharing remixed content of IS, as well as official propaganda.
• 15 channels on WhatsApp being used to share IS content and new channels that link to the wider ecosystem of support.
• 15 channels on Telegram being used to share IS content and new channels that link to the wider ecosystem of support.
• 15 channels on Element being used to share IS content and new channels that link to the wider ecosystem of support.
• 10 accounts on X, which happened to have the fastest takedown rates linked to IS support. The accounts typically did not last 72 hours. However, concerningly, two of the accounts seemed to have premium service subscriptions, indicating that X had accepted payments from accounts sharing terrorist content.   

Some of the Islamic State’s adaptation tactics to maintain digital territory has bordered on the absurd, such as using children’s cartoons like Cocomelon as the opening to IS videos. Other tactics have been more practical, such as the use of freely available digital phone numbers to create phalanxes of accounts that can simultaneously pump out content. These tactics, whether absurd or practical, have ensured that the message of IS continues to spread.  

This report assesses the state of IS online a decade after the founding of the so-called ‘caliphate,’ and a generation after the first Salafi-jihadist groups leveraged the internet to globalise their message. While the pressure placed on the IS in the wake of its territorial ascension undeniably altered its digital ecosystem, key questions remain — one of the most pressing being: how does IS hold on to digital territory as its offline operations are increasingly decentralised and spread across continents?  

This report, therefore, provides a platform-by-platform breakdown of the presence of IS support. Despite millions of dollars spent to counter its appeal and dissemination efforts, and entire teams within government and the private sector working to disrupt its ability to ‘post through it,’ the Islamic State and its supporters have not only continued to sustain themselves but developed new modes to spread their messages. Countless actions by law enforcement, governments and social media platforms have undoubtedly been successful, but that success has also resulted in new groups, websites, channels and platforms being exploited by a new generation of supporters of the group. 

Part and parcel of this challenge has been the overarching focus on ‘official’ outlets and their channels. These have been one of the primary concerns of governments for over the past decade. At the same time, unofficial channels and groups have festered. This unofficial ecosystem of support for IS came in tandem with last year’s rise in IS youth attacks and plots the world witnessed last year. According to the Washington Institute for Near East Policy’s Islamic State Select Worldwide Activity Map more than 53 minors were involved in attacks, attack planning or throes of propaganda operations. Several of these cases demonstrated the strength of the Islamic State ecosystem online, which seemingly connected teens in Austria, Belgium, France, Germany, Spain, Sweden, and Switzerland across borders.

Most, if not all, of these cases would be considered inspired, not directed, by IS. The perpetrators created and fashioned their own brands for IS outlets, and in some cases accessed materials that were produced by the group when they were toddlers. Inspired attacks are more likely than not, in this current era of Islamic State, to have an online element, one that scholars have argued could speed up the radicalisation process. While this report does not identify the specific online influences behind these cases, it instead highlights the broader ecosystem of Islamic State support across platforms and the threats it poses. 

Methodology: Sizing up ‘the State’ Online 

Empirically determining the size of the Islamic State online is fraught with methodological challenges, not only because of the decentralised nature of the internet, but also due to the tactics IS’s supporters use to evade takedowns. Creating duplicate accounts, for instance, to stave off the effect of moderation creates the impression of phalanxes of accounts online spreading the IS’s message.  

To gauge the size and impact of these digital communities, analysts collected a sample of IS accounts, channels and websites from a range of platforms to examine both their scale and the interconnected nature of their support ecosystem. Based on these communities, analysts analysed impact of media through views, likes, or reshares.  

All of the accounts, channels and websites were manually reviewed by analysts between December 2024 through January 2025 to ensure they were in fact promoting, encouraging or spreading ideology or content linked to the Islamic State. In some instances, the use of official media was a dead giveaway, however, in others, such as grey news sites^[7], the primary goal was to catfish audiences into believing the page to be linked to a legitimate news organisation, when in reality, it was an IS propaganda outlet. 

Using these platforms, messaging applications and websites as the basis of the study helped ISD pinpoint trends in IS’s use of the internet, including modes by which they are protecting their digital territory and evading threats, as well as their ability to propagate IS ideology and other instructional content to their supporters.   

This report will delve into the key findings of the study, break down the ecosystems of IS support on Platforms (Facebook, Instagram, TikTok, and X) messaging applications (WhatsApp, Telegram and Element) and websites. The conclusion of the report will highlight the interconnected nature of these elements and their centrality to the Islamic State online ecosystem.  

Key Findings: ‘The State’ Continues to Thrive Online  

This report highlights two meta findings. The first is that social media platforms, messaging applications, and the open web continue to be susceptible to exploitation by the Islamic State outlets in the era of a much more fractured internet landscape. The second, being the volume and pace at which unofficial outlets produce and reproduce content is the central issue. In short, more platforms and more unofficial outlets lead to greater challenges in addressing the overall ecosystem of support.  

Unofficial outlets evade moderation not only because they may not have been catalogued by platforms and their moderation teams, but also because they are operating in more languages than before, stretching the limits of trust and safety teams. ISD has noted in the past that Arabic language IS material continues to haunt platforms, and yet, platforms still aren’t effective in catching this content. The same goes for languages such as Kurdish, Pashto, Somali, Amharic, Russian, Filipino and Indonesian.   

There appear to be clear failures at restricting Islamic State activity across several of the platforms (Facebook, Instagram, TikTok and WhatsApp) Despite the tools and teams in place to curb the group’s proliferation, a persistent and visible segment of IS continues to exploit these platforms. Interestingly at the time of writing, X has been able to contain IS content the quickest, while Facebook has been the slowest.

Perhaps the most pertinent takeaway of the report is that IS supporters are choosing to use much more public mainstream platforms just as much as closed messaging applications. With IS activity being coordinated in public view of other users with seemingly no fear of repercussion, the pages, accounts and channels surfaced in this report point to an environment where they have carved out a foothold and continue to take advantage of under-moderation.  

Platform-Specific Findings  

Facebook  

• Facebook remains an epicentre of activity for unofficial outlets supportive of the Islamic State, outpacing the other platforms in terms of accounts and content. Analysts were able to find IS content, accounts, as well as pages and groups with simple keyword searches such as names of IS leaders. Analysts found content posted regularly, such as weekly releases of the official newsletter of the Islamic State, al-Naba, on a page named after it. They also found Facebook-only IS outlets and support groups that were attacking ‘enemy’ pages and organising their activity on Facebook openly through public posts.  
• Out of the 15 public pages on Facebook in support of IS, the largest had more than 22,000 followers. It had shared 80 video reels since its creation in October 2023 which generated more than 1.6 million views. The most watched video, a pair of men driving a car listening to a nasheed used by IS, generated 236,000 views. The second most watched video was stripped from an official IS video created during Ramadan and features children learning religious principles from an IS ideologue, which generated 116,000 views.  
• IS support accounts have primarily transitioned from pages to public profiles, using their public posts to promote and organise activities on Facebook. ISD analysts found 300 accounts promoting IS, coordinating ‘raids’^[8] on Western news outlets and organisations affiliated with the Syrian Salvation Government. The accounts openly shared branded IS material, often facing no moderation whatsoever. 

• IS operational security support groups are organising on Facebook, using both a public page and a private group to coordinate activities. The group known as the Electronic Soldiers of the Caliphate have created a group that assists supporters in the Islamic State in their efforts to bypass moderation, enhance their practices around surveillance and find ways to create more accounts on popular platforms.  
• IS support accounts on Facebook have begun using a feature known as ‘professional mode,’ which unlocks a “dashboard” that gives the accounts creator insights, monetization options, and comment moderation tools. Analysts observed IS accounts leveraging this feature to access analytics, refine their audience targeting and expand their reach.   

Instagram  

• Instagram functions as an extension of IS accounts already on Facebook, with analysts finding links to 50 pro-IS Instagram accounts on Facebook. Many of the 300 accounts on Facebook encountered during the observation period had corresponding accounts on Instagram.  
• Instagram accounts function as central repositories for archived official content in some instances. Analysts found five accounts dedicated to archiving the official content of the Islamic State, such as Amaq and al-Naba, that are not altered in any shape or form.  
• IS Instagram accounts were engaged in sharing methods on how to create bots to automate the distribution of propaganda on Telegram, while linking to their Telegram bot accounts that shared IS content. In effect, Instagram acts as a key hub in the IS ecosystem, broadening a users’ access to content and facilitating interaction with other IS supporters.  
• Unofficial and official IS content with just minor edits, such as cropping out the IS branding on the video, are not being automatically flagged by Instagram. These simple edits are allowing Islamic State accounts and content to fester on the site.  
• Comment sections linked to IS accounts on Instagram are used to share WhatsApp channels for groups of individual supporters of the Islamic State. Similar to how IS accounts on Instagram link to Telegram, they also direct users to WhatsApp channels that distribute IS content, including, in some cases, instructional bomb-making materials. These moderation gaps across Meta platforms highlight ongoing failures in content regulation. 

TikTok 

• TikTok is a key platform for Islamic State supporters to reach new audiences. TikTok allows propagandists to extend their influence beyond a dedicated base of supporters on closed and encrypted platforms, broadening the reach of core narratives from both new and old ideologues. Previous ISD research found a small sample of 20 IS support accounts on TikTok had garnered more than one million views in May 2023 alone.  
• Following the New Year’s Eve IS-inspired attack in New Orleans, which killed 15 people and injured at least 57, accounts on TikTok glorified the attacker in videos that generated thousands of views. The videos, posted by accounts that were observed during the time period, glorified the attacker, Shamsud-Din Jabbar, an American-born resident of Houston, Texas. One video praising the attacker generated more than 10,100 views while another more than 30,000 views.  
• The platform’s IS ecosystem includes news accounts sharing official IS news, media munasireen (supporters spreading propaganda) and alt-jihadists merging chan-culture aesthetics with jihadist propaganda. Analysts found accounts referring to the Sri Lanka Easter bombers as saints, resembling far-right extremist propaganda.

• IS accounts on TikTok not only spread propaganda but also amplify threats against the group’s perceived enemies. Prior to the 29 January 2025, shooting death of Salwan Momika – an Iraqi living in Sweden who set fire to a Quran outside Stockholm’s central mosque – IS-TikTok accounts called for his death and attempted to dox his location. Analysts later found pro-IS TikTok accounts celebrating his killing.  
• Researchers identified over 100 pro-IS videos produced by 20 accounts on TikTok, some surpassing 500,000 views. While most of the videos reviewed by researchers use footage or the sounds of speeches by IS ideologues, others appeared to be calling for action. One specific user at the heart of the IS community on TikTok urged users to “come to Africa” where attacks by IS are currently the most frequent. 

WhatsApp  

• ISD analysts identified 15 public IS support WhatsApp channels (many with over 200 subscribers) linked via Facebook, Instagram and TikTok. Links shared across these platforms suggest that there is a robust community of IS support on Meta’s messaging platform, WhatsApp.  
• WhatsApp channels called to share the ‘warrior’s bag’ instructional material to prepare IS supporters for attacks or combat. ISD analysts found a WhatsApp channel linked to al-Saqri Foundation for Military Sciences, an IS support outlet that has been producing operational material such as ‘200 tips’ – a graphic survival and surveillance guide which has been adapted from an English-language survivalist book and repurposed for supporters that might be planning attacks.

• WhatsApp administrators of IS channels often manage multiple channels, suggesting centralised operations for content dissemination. These WhatsApp networks also link to Telegram and RocketChat channels operating in networks that share similar IS content.  

Telegram  

• While the heyday of IS organising on Telegram may have passed, it remains a key platform for the overall IS ecosystem. However, the toll of constant takedowns at the hands of the platform or law enforcement is making it inhospitable. Analysts still found a robust ecosystem of support and recruitment with accounts dedicated to sharing official and unofficial content for users to spread across other platforms in support of the Islamic State.  
• Much of the Islamic State’s functions, even recruitment into unofficial media groups, is funnelled through networks of automated channels on Telegram, built by supporters of the group. IS supporters on Telegram have long used bots, but now, unofficial media outlets recruit members through a series of automated accounts that they are funnelled to by administrators of IS channels. This provides them with a level of cover, while simultaneously easing the process by which a user is recruited into and supported by seasoned propagandists.  
• Archive channels on Telegram are linked to doppelganger accounts on TikTok and Instagram, indicating once again the interconnected nature of the IS ecosystem. Analysts found numerous examples of TikTok or Instagram accounts posting IS legacy content linked to official outlets but also linking out to Telegram channels providing the same content to interested users.  

Element   

• Element is a decentralised, open-source messaging application that is just as central to Islamic State propaganda operations as Telegram. Analysts observed 15 channels linked to IS accounts that were copycats of Telegram channels, once again highlighting the interconnected nature of the Islamic State ecosystem. The ability to use Element as just another tool in their respective toolboxes online, means that the Islamic State continues to have fall back options in the wake of coordinated takedowns on other platforms.  
• Element is a relatively newer edition to the IS online ecosystem, but it provides both official and unofficial IS support outlets with the ability to stave off coordinated takedowns on other messaging applications, such as Telegram or WhatsApp. Element channels are not just carbon copies of channels on Telegram and WhatsApp; they are an operational security procedure to get around moderation and provide direct access to administrators in unofficial IS support groups.  
• Element channels and groups provide IS supporters with a haven away from content moderation, where instructional explosives material can be shared relatively freely. Analysts found explosives material, as well as poisons recipes shared in 7 of the 15 channels observed during the time period.   

Cross-Platform Case Studies 

‘Face’^[9] (book): The Unofficial Province of Islamic State Online Activity  

As fires raged, decimating acreage and incinerating homes across Los Angeles, the Islamic State penned an article in its al-Naba newsletter titled “With A Punishment From Him, Or By Our Hands.” The article featured photographs of the destruction, along with a screed about the fires being divine punishment for the bombing and killing of thousands of civilians in the Gaza Strip. The article suggested that setting fires near neighbourhoods could have the same effect. The article was released in Arabic.  

Forty-eight hours after its release it was redesigned, translated into English, and released by an unofficial pro-IS outlet operating strictly on Facebook and trying to get a foothold on X. The post, advertised as an editorial in al-Naba in English, was shared more than 779 times across the platform and was easily accessible during the entire monitoring period. This was, unfortunately, not the only lapse in moderation that analysts witnessed during the month-long observation period. Facebook appears to be the favoured platform for IS supporters in several languages. One of the oldest pages found on the platform has been releasing weekly IS radio content in Amharic freely since April 2022 and has released 144 videos including translated speeches by the now-dead al-Qaeda in the Arabian Peninsula (AQAP) ideologue Anwar Awlaki.  

During the month-long observation period, analysts flagged the largest IS supporter-led news page on Facebook, which had more than 22,000 followers and corresponding TikTok, Instagram and Threads accounts, as well as a Telegram channel with more than 30,000 subscribers at the time of this report. The supporter-led news outlet is just one of many IS media outlets operating across Facebook, and evading moderation specifically tasked with rooting out support for terrorist groups. ISD has previously flagged this outlet to Meta in 2022, releasing a report on the ecosystem of these specific outlets on the platform and elsewhere, specifically noting that there were 16 other pages that were conducting similar activities on the platform^[10]. Analysts identified 6 profiles linked to the same outlet, including one that had 9,700 followers and had classified itself as a “news personality.” The outlet had not just recovered from Facebook’s takedowns after the release of ISD’s report but maintained and expanded its ability to continue sharing IS news and propaganda in the wake of the takedowns.

The outlet is perhaps the highest-profile IS support-outlet operating a series of pages and profiles on the platform, but the largest subset of accounts on the platform sharing IS material are public profiles that are a part of micro-networks of propagandists. ISD found 300 accounts that have enabled public posts to support a range of functions, such as the release of official and unofficial content, ‘raid’ organising, and the promotion of Telegram, WhatsApp and Element channels that provide connections into IS networks on messaging applications.  

Analysts noted that the 300 public profiles on Facebook, some with as many as 5,000 friends, were active IS supporters, posting official and unofficial media, and organising ‘raids’ on pages linked to news outlets in the west and in Syria. The ability of these networks of public profiles to thrive on Facebook seems to indicate serious lapses in the platform’s ability to counter dangerous organisations as outlined in its community guidelines. With these failures comes not just increased presence of IS support on Facebook, but the ability of the ecosystem to spread and expand to new online domains.  

InstaState: #NoFilter for Islamic State on Instagram   

Three gruesome videos of Islamic State executions were posted to Instagram in a week time span, each showing the kill point snippets of longer snuff films released by the group over the years. The videos were indicative of the moderation lapses that exist on the platform as well as others that are part of the IS ecosystem. In one video, the point at which explosives detonate and explode the bodies of IS prisoners is shot from different angles capturing the carnage  on full display.  

While the account and its videos are the one instance where analysts were able to surface execution content by a terrorist group — notorious for its brutality, which has been well-documented — other accounts across Instagram were engaged in either recruiting potential supporters, promoting Telegram and WhatsApp channels linked to Islamic State support groups or posting official news from IS outlets. One account, called ‘official news’, posted 34 pieces of content from the Islamic State, namely IS news bulletins, Amaq news, and al-Naba articles, receiving more than 1,400 likes on the content collectively. The account similarly segmented reels of official news bulletins broken down by IS provinces, and one reel category dubbed al-Naba. In one instance, the account publicly posted a photograph from official Islamic State media. The photograph was of a dead bodyfrom a Nigerian village raid led by IS fighters. While the thumbnail image of the body was not blurred, only when analysts clicked on the post were they then presented with a sensitive warning tag. The lapse seemed to indicate that not only was IS content getting past moderation, but that sensitive content was not being blurred at the thumbnail level.  

Several accounts used their bios to link to Telegram and other platforms, where they had a presence and were seeding more Islamic State content than their Instagram profiles. Several of these accounts posted content linked to dead Islamic State ideologues that shaped the Islamic State’s brand when it controlled territory in Iraq and Syria. The most prominent of these ideologues to appear consistently in IS support posts was Abu Ali al Anbari, who was the Islamic State’s deputy with near-mythic reputation amongst the ranks of the group for shaping its ideological worldview.  

Instagram reels were used almost universally by IS accounts on Instagram. One account, using the IS brand for its province in Baghdad, produced 19 English-language reels supporting Islamic State ideologues and its ideology, generating more than 39,600 views collectively. Four of the reels posted by the account featured al Anbari and his lessons from his lectures. The account claimed to be a religious school, and was operating two accounts, with one functioning as a backup. The backup account similarly translated Arabic lectures by ideologues into English and used reels as a vehicle to do so. Its most watched reel was viewed 4,402 times and was a pledge of allegiance to the current ‘caliph’ of the group Abu Hafs al Hashimi al Quraishi.  

TikTok Caliphate: TikTok Hyper-Charging Islamic State Content  

The New Year’s Eve New Orleans truck ramming IS-inspired attack that killed 15 people and injured scores of others excited IS networks across platforms, including TikTok, where there is a significant network of interconnected IS support accounts functioning as media archives and news channels. One account, with a kunya^[11] that insinuated it could be in Iraq, not only excitedly posted the news about the New Orleans attacker, but wrongly claimed he targeted Trump Tower. The account’s initial post calling the attacker Shamsud-Din Jabbar — the American former military veteran — ‘the implementing brother’ was viewed 10,100 times on the platform. The account would go on to post three more times about Jabbar, referring to him as a ‘solider of Islam’ that brought ‘America’s pain’ home. Each of the videos used audio stripped from IS speeches, illustrating a dynamic whereby the platform not only failed to flag the post for the audio used, but also the excited and supportive sentiment by a clearly IS account.  

Another account, by an unofficial media outlet, posted a video on New Year’s Day for a multiplayer game called ‘multiplayer car parking for munasireen’, or supporters, and featured a truck like Jabbar’s driving through the desert and city settings. The video for the game generated some 14,500 views, and came a day before a post featuring Jabbar’s face over a nasheed generated some 30,000 views. The account would release another trailer for the game with two trucks racing each other and crashing into one another, while cruising in a city setting. While the posts may not violate any community guidelines, other posts by the same account, praising Abu Musab al Zarqawi, the leader of the al-Qaeda in Iraq that would go on to become the Islamic State, would surely result in takedowns or bans from the site.  

Out of the 50 accounts that ISD surfaced, several of the accounts were using Russian as the primary language to post content supportive of the Islamic State. One account posted an ethereal video of the now-dead leader of the Islamic State Abu Bakr al-Baghdadi floating in the stars with the text “may the protector (Allah) bless you, those who are martyrs.” The video generated more than 52,700 views. The account linked to a Telegram channel that served users more IS content through the link. Similarly, analysts found two accounts posting copies of past IS official content, such as al-Naba, and Dabiq magazine, as part of a move to archive as much of the content as possible. Both accounts were unimaginatively named “al-Naba” and “Dabiq” and linked to archives on Telegram that would give users back issues of both al-Naba and Dabiq. The al-Naba newsletter account on TikTok posted 29 times, advertising the archive of the newsletter on Telegram, while the Dabiq magazine account posted 4 times, advertising specific issues of the magazine available through another Telegram account that would serve users with issues of the magazine. These two accounts were specifically singled out of the dataset because of their clear usage of both a well-known IS brand and their usage of the official branding of both the newsletter and the magazine, making it slightly confounding on how both accounts got past moderation on the platform.  

Terrorist Notifications: Messaging Applications as the Backend of Islamic State Online Ecosystem  

Telegram, WhatsApp and Element all play a central role in supporting direct communication between supporters on platforms such as Facebook, Instagram and TikTok. Analysts found that all the channels that were observed during the month-long period were linked to accounts or promoted by accounts on Facebook, Instagram and TikTok. This indicates that the ecosystem is interconnected and reliant on both closed messaging applications and public platforms for survival.  

Messaging applications provide users with content and allow them to connect with and learn from one another. Much of that learning revolves around how to protect accounts online or figuring out who amongst them is a “spy,” as well as sharing material that would otherwise be immediately banned on public social media accounts, such as instructional material that could assist in planning for an attack. All the messaging platforms observed during the research period had attack planning materials shared in channels and were simultaneously assisting in getting users access to legacy and new material by the Islamic State.   

The use of numerous messaging applications allows for the Islamic State to continue to thrive in public spaces. The ability to use the accounts on messaging applications to regroup after takedowns on popular platforms, access new accounts and in some cases new phone numbers, makes the issue of containing their presence on popular and mainstream social media platforms all the more difficult.  

‘The State’ of the Islamic State: Conclusion  

IS accounts and channels have plagued platforms and the wider internet for more than a decade. While initially platforms did not have the mechanisms or tools in place to counter the spread of IS communities online, there has been a significant investment by companies, governments and law enforcement to limit their spread. The development of specialised trust and safety teams and automated tools to locate terrorist material, in tandem with coalitions of companies, governments and law enforcement agencies united in staving off the threat from Islamic State accounts and content online have been instrumental in countering the appeal and spread of these accounts.  

The threat persists, albeit in a new environment, with a decentralised series of provinces each with its own threat profile and digital ecosystem of support. Whether it’s the Islamic State of Khorasan Province (ISKP) and the unofficial media outlet Al-Azaim, or Sawt al Ansar, which provides weekly hour-long Somali language updates on the Islamic State’s actions and pronouncements in service of the Islamic State in Somalia, the group’s online presence remains robust. With provinces and affiliates across Asia, the Middle East and Africa, the Islamic State is just as decentralised and dangerous as its online propaganda outlets, which promote its ideology and attacks in more than 40 different languages. 

This report highlights the fact that IS does not appear to be contained on social media. The group and its supporters are continuing to flaunt their ability to use social media platforms for recruitment and propaganda, and to exact revenge on their enemies online. They are similarly finding innovative, low budget hacks to the hurdles placed in their way by social media companies and messaging applications. The interconnectedness of this ecosystem of support indicates that the ‘state of the Islamic State’ online is still substantial, and their ability to not just game platforms, but expand their presence onto new emerging applications, allows them to survive coordinated efforts and automated approaches intended to stop their spread. While the threat is consistently shifting, ISD has consistently made four central recommendations for platforms and messaging services to address this challenge sustainably, which are as salient now as ever:  

• A clear need for more expert moderation and human-led tracking of accounts. This expert moderation should include greater investments in trust and safety divisions, especially in smaller or less profitable markets and languages, with an increased focus on strategies to combat account recidivism. Negating the ability of these outlets to survive takedowns requires both the in-depth tracking of IS support networks on all the platforms in question, and the use of subject, linguistic and contextual expertise in a number of regions.  
• A model of cross-platform network coordination should replace piecemeal takedowns that focus on single actor or account behaviours online. Europol demonstrated this ability in 2019, and again in 2024, when it targeted Islamic State channels in a wide ranging, multiplatform takedown effort, which should be repeated on a continual basis.  
• Enhance capabilities of automated approaches to recognise simple workarounds like “broken text” posting, a format used by all the outlets as a means to get controversial words past moderation mechanisms. While there continue to be issues with artificial intelligence-based approaches to moderation, creating mechanisms by which companies can detect variations in language that allow the outlets to continue to publish inflammatory content is an important endeavour. 
• IS supporters are exploiting platform loopholes to verify media sources. While some platforms continue to play pivotal roles in assisting independent media outlets globally, pro-IS news outlets are spreading out across Meta under the same guise as “independent” and “objective” news. Unlike independent journalists, outlets and civil society groups however, these outlets are only focused on IS actions and ‘official’ news accounts.

Endnotes

[1] Alexa Corsa. “Social Media Companies Decide Content Moderation is Trending Down,” Wall Street Journal, (January 7, 2025).

[2] The author has decided to use the term ‘Islamic State’ as a means to describe the many brands and outlets of the Islamic State rather than the Islamic State of Iraq and Syria or Islamic State of Iraq and the Levant, due to the fact that Islamic State as both a brand and entity is in reality much more diffuse globally. 

[3] Official Islamic State outlets are directly linked to the central media apparatus of the group, and include outlets such as al-Naba newsletter, Amaq, al-Hayat Media Centre, and al-Furqan Media Foundation.  

[4] Unofficial Islamic State outlets are not linked to the central media apparatus but are still branded outlets supportive of the Islamic State and have much larger footprint and are more readily available on platforms and messaging applications than official outlets. Much of the material they rely on comes from official media content, but they have, and do, create original content that gets past moderation at what analysts believe a higher clip.  

[5] ISD determined that 60 percent of these outlets have produced new content in the past six months, making them active, while 40 percent have not produced new content in the past six months but are still available online, making them partially defunct.

[6] ISD conducted a review of the branded media outlets on the Islamic State’s most prominent forum. Defunct outlets were those that had not produced content in a period longer than one year.  

[7] Grey news sites are ‘media organisations’ that are branded as neutral news outlets that share news from the Islamic State’s official news channels repurposed for a wider audience in order to evade moderation and detection.

[8] Raids in this sense are comment bombing and linking to Islamic State content in the comment spaces of an ‘enemy’s page through coordinated action (usually a post is called out to supporters in their networks to take part in targeting specific pages at a given time using content that has been preordained and shared in the comments spaces as well).

[9] Islamic State supporters and unofficial outlets refer to Facebook as ‘Face’.

[10] Moustafa Ayad, Nadeem Khan, Aymenn al-Tamimi, “The Terror Times: The Depth and Breadth of the Islamic State Alternative News Outlet Ecosystem Online,” Institute for Strategic Dialogue, (September 28, 2022).

[11] A kunya is an honorific title, which is sometimes used to denote country of origin.