(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. On June 16 and June 21, CEP researchers identified posts in a pro-ISIS online chat to purchase phone numbers to bypass SMS verification controls on social media platforms, and a post promoting the use of the Monero cryptocurrency to fund online propaganda. Additionally, the moderator of a similar chat promoted using the Lokinet onion router, which hides IP addresses to conceal users’ identities and locations. CEP researchers also located nine TikTok accounts that posted pro-ISIS propaganda, including one that posted a video that amassed more than 100,000 views.
On Twitter, CEP researchers located an account that posted a notorious antisemitic propaganda film, which had over 200,000 views eight days after it was uploaded, and linked to a Gab page that includes antisemitic, anti-LGBTQ, and white supremacist content. CEP researchers also observed multiple accounts on Telegram celebrating the eighth anniversary of the Charleston church attack, and a Telegram account supporting Phillip Hassler, a neo-Nazi serving a prison sentence in Austria, that posted an enemies list.
In addition, CEP located two fundraisers on GiveSendGo, one benefiting the leader of the Tennessee active club and the other posted by the founder of a New England neo-Nazi group. Researchers also located a Twitter video that promoted the great replacement conspiracy theory, posted by a white supremacist account that CEP had previously reported in January.
Pro-ISIS User Recommends Use of Fake SMS Verification Site and Paying with Monero Cryptocurrency
On June 16, a user of a pro-ISIS chat claimed that they used two websites to obtain phone numbers for verification codes to create Twitter and Instagram accounts. The poster said they used the two verification sites because they accepted the Monero privacy cryptocurrency. The user also recommended using a VPN to enhance privacy and advised against using websites offering free phone numbers for verification purposes. The user claimed that one-time use phone numbers for SMS verification cost between $.20 and $2.
Separately, on June 21, a user of another pro-ISIS chat recommended that other users donate money to a prominent ISIS propaganda website. The site has a donation address for the Monero privacy cryptocurrency. The website contains an archive of ISIS propaganda videos, al-Naba newsletters, Amaq statements, written works, and ISIS magazines.
The pro-ISIS chat user stated that Monero was optimal because of its privacy features.
Admin of Pro-ISIS Chat Recommends Use of Lokinet
On June 21, the moderator of a pro-ISIS chat recommended using the anonymous onion router Lokinet. The admin claimed that Lokinet, similar to Tor, is more secure than other browsers and VPNs. Lokinet is a decentralized onion-routed network that hides IP addresses and claims to block web surveillance.
ISIS Propaganda Located on TikTok
In a sample of content located on June 22, CEP researchers found nine TikTok accounts that posted ISIS and pro-ISIS content. The nine accounts poted clips from official ISIS videos, ISIS nasheeds with pro-ISIS imagery, Amaq and al-Naba news updates, and photos glorifying ISIS leaders and fighters.
One account, which had over 5,700 followers and contained a link to an ISIS propaganda website in its bio, posted six videos between April 24 and June 18, one of which had over 100,000 views, with an average of 49,300 views per video. Another account posted a photo from an ISIS propaganda video that advertised a URL belonging to the same ISIS propaganda website. Multiple pro-ISIS accounts used a variety of pro-ISIS hashtags. The nine accounts had an average of 2,702 followers, ranging between 1,027 and 5,702.
One account was removed before CEP could report it. The other eight accounts were reported to TikTok on June 23. Two accounts were removed from the platform three days later, and six were still online.
Amaq claim on TikTok, posted by a pro-ISIS account. The lSIS logo and certain letters have been blocked out by the uploader to avoid removal. Screenshot taken on June 22.
Photo taken from ISIS video advertising an ISIS propaganda website (URL has been obscured). The video was posted on June 7 and located on June 22. The video had over 670 views.
Notorious Antisemitic Video Spread on Twitter
CEP researchers located a notorious antisemitic video on Twitter, posted by a verified account on June 14. The video, a purported revisionist documentary, promotes antisemitic conspiracy theories, glorifies Nazi Germany, justifies the crimes of the Third Reich, blames Jews for being responsible for both world wars, and contains a speech by the co-founder of the white supremacist Traditional Workers Party, Matthew Heimbach. The full video is over 10 hours and was uploaded to a Twitter thread in eight parts. The first video had over 200,000 views eight days after it was uploaded. The other seven parts had an average of 12,000 views eight days after uploading.
The account that uploaded the video to Twitter contained a link to a Gab page in their bio, which posted a large quantity of antisemitic, anti-LGBTQ, and white supremacist content, including praise of the group Patriot Front. The video has previously been spread extensively by white supremacist groups as an introduction to antisemitism. The Twitter link was shared and promoted by at least a dozen extreme right-wing Telegram channels, including a large neo-Nazi channel with over 10,000 subscribers that former members of a Canadian chapter of the Proud Boys operate.
CEP reported the video to Twitter on June 22, but it was still available four days later.
Part one of the antisemitic video on Twitter. Screenshot taken on June 22.
White Supremacists Celebrate Eighth Anniversary of Charleston Church Attack
Consistent with prior years, numerous extreme right and neo-Nazi Telegram channels celebrated the eighth anniversary of the murder of nine people at Emanuel AME Church in Charleston, South Carolina, by a white supremacist on June 17. Telegram users posted memes glorifying the gunman and encouraging additional acts of violence, links to his manifesto, and letters the gunman wrote from prison.
One Telegram account, which had a prior version removed from the site for violating the platform’s Terms of Service, posted a photo of a similar firearm used by the gunman, stating that the manufacturer should have a sale on the anniversary. A Telegram account affiliated with a website that supports the Atomwaffen Division successor group National Socialist Resistance Front, posted that the Charleston attack was fully justified and that “anything against the system is moral.”
Telegram Channel that Supports Imprisoned Austrian Neo-Nazi Rapper Posts Enemies List
On June 15, a Telegram channel dedicated to supporting the imprisoned Austrian neo-Nazi rapper, Philip Hassler, known as “Mr. Bond,” posted an enemies list of various individuals it identified as having a role in the “investigation, arrest, prosecution, sentencing, appeal trial, and conviction” of Hassler or his brother. Hassler is serving a 10-year prison sentence for promoting neo-Nazism and inciting violence. The list contained 17 names, including judges, prosecutors, other Austrian government officials, and a journalist.
Versions of the list were also posted on Twitter. On June 17, the channel posted a photo glorifying the 2018 Pittsburgh synagogue attacker, one day after he was found guilty of 63 charges for the murder of 11 people.
Neo-Nazis Continue to Fundraise on GiveSendGo
CEP located two fundraisers on GiveSendGo, one benefiting the leader of the Tennessee active club and the other from the founder of the neo-Nazi group NSC on behalf of the family of a recently deceased member.
The first fundraiser, posted on the site on June 17 by the leader of the Tennessee active club, claimed to be for an appeal for an unidentified legal case. The individual has repeatedly made public expressions of his extreme right-wing beliefs and has appeared in various photos promoting different white supremacist active clubs and other groups. He identifies himself as a “pro-White activist” in the GiveSendGo fundraiser.
The second fundraiser was posted by Chris Hood, the leader of NSC, on behalf of the family of NSC member Leo Cullinan, who died of unspecified causes on June 19. The previous day, NSC members sought to shut down and intimidate attendees of a drag event in Concord, New Hampshire.
Video Promoted by White Supremacist Groups Uploaded and Spread Via Twitter
On June 16, a white supremacist Twitter account with almost 9,000 followers posted an approximately 30-minute video on Twitter that promoted the great replacement conspiracy theory. The video, which primarily consists of edited news clips and similar footage, promotes the narrative that white people in the U.S. and Europe are intentionally being demographically replaced, followed by clips showing acts of violence committed by people of color against white people in order to create a narrative of danger and urgency, before concluding with archival footage and photos of natural landscapes and family videos showing idealized white nuclear families. The video received over 30,000 views within six days.
The same account that posted the video also posted flyers for printing that contained QR codes leading to the video and messages stating that white people were under attack. Multiple groups, including the White Lives Matter movement, the Goyim Defense League, and the racist and antisemitic National Justice Party, have recently promoted the video.
CEP reported the video to Twitter on June 22, but it was still available four days later. CEP had additionally reported the same Twitter account that posted the video on January 26 for promoting the neo-Nazi group Nationalist Social Club (NSC). Twitter messaged CEP on April 18, claiming they had suspended the account for violating their “hateful conduct rule.” Despite this alleged suspension, the account has remained online and continued to post hateful material.
Video promoting the great replacement theory on Twitter. Screenshot taken on June 22.
Twitter claim that it had suspended the account in April, 2023.