The latest issue of the journal Perspective on Terrorism features a paper written by our Senior Analyst A. Bolpagni and our Senior Fellow Analyst Dr A. Fisher. The paper presents the first-ever analysis of the stream of URLs within the pro-Islamic State (IS) server TechHaven on Rocket.Chat. The analysis collected URLs shared from the server’s creation in December 2018 up to October 2024.

Based on the creation date of the first rooms, TechHaven was established around December 2018. Today (on 30 March 2026), it is composed of 561 rooms and 12,349 users. There are no institutional media houses active on the platforms, but a heavy presence of Ansar Production media houses. In particular, Ansar Production media houses’ presence is articulated through the activity of translation media houses. Alongside them, other important media houses active on Rocket.Chat are those dedicated to Operational Security (OPSEC) and technical support, followed by several non-institutional media houses. Moreover, besides rooms related to pro-IS media houses, two rooms work as “general discussion rooms”.

This research is the first to present a longitudinal study that spans almost six years (December 2018 to October 2024) of outlink sharing from a Salafi-Jihadi digital safe haven, namely the IS Rocket.Chat server TechHaven, within which IS supporters are free to operate without content removal or external moderation. The period chosen coincides with the date (5 December 2018) of the first sharing of a URL within TechHaven and with the date (1 October 2024) at which data collection was terminated. The study thus aims to map out the pro-IS propaganda stream specifically generated by the sharing of URLs inside the pro-IS server TechHaven on Rocket.Chat. Each URL analysed was considered an element of IS propaganda because it either led to a site containing IS propaganda material or to other social media (whether messaging platforms or social networks) where IS propaganda material could be acquired. Moreover, the research provides valuable insight into how the ecosystem operates when it is not facing disruption.

This is distinct from previous studies that have assessed the Salafi-Jihadi ecosystem by analysing outlinks on social media where Salafi-Jihadis face disruption and account removal, such as Telegram, Facebook, Twitter, and YouTube. This means their distribution propaganda methods evolve to avoid detection, and data collection is often based on availability at a given time. Despite its remarkable significance in spreading the Salafi-Jihadi propaganda online, Rocket.Chat has been rarely analysed to understand its role as a propaganda launchpad within the IS online ecosystem and, broadly speaking, the Salafi-Jihadi online information environment. This paper thus shows how and which URLs are shared by a Salafi-Jihadi group, in this case IS, to direct its propaganda stream when it is not seeking to avoid content removal. As such, we can begin to test some of the prior assumptions about URL sharing. For example, are the same domains used consistently when URL sharing occurs in a safe space, and do all channels in a safe space behave in the same way? Are there other explanations for the fluctuation in the use of specific domains, other than Western disruption efforts?

You can find the paper at the following link on the Perspective on Terrorism website: https://pt.icct.nl/article/navigating-beyond-digital-safe-haven-mapping-course-pro-islamic-state-propaganda-rocketchat?#