CEP Report Finds Recent ISIS Efforts To Spread Propaganda
The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. Today’s edition shows ISIS’ presence on the dark web, in addition to several new websites that have posted radical and violent content.
Pro-ISIS Information Security and Tech Support Website Located on the Dark Web
CEP researchers located a site on the dark web this week for the pro-ISIS Electronic Horizon Foundation, also known as Horizon. Horizon was founded in January 2016 in order to improve the web security of ISIS and their online supporters. The website, accessible with Tor, a web browser that anonymizes one’s web traffic, is available in Arabic, English and French. Platforms covered include Telegram, Riot, Signal and OONI probe. Operating systems include iOS, Android, Windows and Linux.
“Horizon and their site on the dark web shows the ways in which ISIS and other terror groups will grow and modify their online presence over time,” said CEP researcher Joshua Fisher-Birch. “Unlike on surface web sites, it is significantly harder to remove terror content from the dark web due to its generally hidden and dispersed nature. As regulators step up their efforts to remove ISIS from the Internet, the dark web represents another challenge that will have to be addressed in the future.”
The Horizon dark website offers a variety of information on online anonymity, counter-surveillance and safe communications. It is also similar to an ISIS dark web propaganda depository (that is now available on the surface web). Sites on the dark web can only be accessed semi-anonymously, and are notoriously difficult to remove. Increased counter-surveillance and web security can pose significant challenges for law enforcement and intelligence agencies, as they seek to intercept and disrupt terrorist communications.
Pro-ISIS Electronic Horizon Foundation dark web site, located January 31, 2019.
New ISIS Video Released on Numerous Websites
On January 29, ISIS released a new video from the group’s self-proclaimed province in Kirkuk, Iraq. Titled “Fulfilling the Promise,” the video shows ISIS operating at night in rural villages, executing individuals accused of belonging to tribal militias or the Popular Mobilization Units, and conducting night raids against security forces installations. It also shows that ISIS is still active in northern Iraq, and is capable of hit and ran attacks.
In addition to Telegram, the video was uploaded to at least 23 websites: pc.cd, Myspace, uppom.live, mail.ru, files.fm, nofile.io, Sendvid, Mediafire, Owndrives.com, Tune.pk, Anonfile, Dropbox, Microsoft One Drive, Amazon Cloud, the Internet Archive, Dailymotion, Google Drive, Google Photos, Mega.nz, ok.ru, Transfer.sh, dalfak.com, and Vidio.com. Approximately one to two days later, the video was still available on 7 websites: Myspace, uppom.live, nofile.io, owndrives, Dropbox, Google Photos and Vidio.com. Additionally, the video was located on Facebook on January 31, the same day it was uploaded to that site.
The ISIS video “Fulfilling the Promise” on the Indonesian video streaming site Vidio.com, with over 1,600 views, one day after it was uploaded. Video located on January 31, 2019.
New Pro-ISIS News and Propaganda Site Uses WordPress Design and Cloudflare Name Server
A new propaganda website using the logo of the pro-ISIS Ahlul Tawheed Publications group was located on January 31. The site began posting content on January 30, 2019. In the short time that the site has been active, the admins have posted news items from the pro-ISIS Moata Agency, violent propaganda photo sets and two recently released ISIS videos. The site is on the .gq domain, allotted to Equatorial Guinea. The site uses NameSilo as the registrar and Cloudflare as the name server. The site was built with WordPress.
New pro-ISIS propaganda website, located January 31, 2019.