memri
June 6, 2016 Inquiry & Analysis Series No. 1255

The Jihadi Cycle On Content-Sharing Web Services 2009-2016 And The Case Of Justpaste.it: Favored By ISIS, Al-Qaeda, And Other Jihadis For Posting Content And Sharing It On Twitter - Jihadis Move To Their Own Platforms (Manbar, Nashir, Alors.Ninja) But Then Return To Justpaste.it

June 6, 2016 | By Steven Stalinsky and R. Sosnow*
Inquiry & Analysis Series No. 1255

Introduction

Social media have long since become the primary means for jihadis and jihadi groups to disseminate content, recruit, fundraise, and more; their use of Twitter and other services to share links to extensive content that they post on content-sharing web services such as Justpaste.it is well documented. In this way, they circumvent restrictions on the social media platforms - such as Twitter's 140-character limit or other platforms' word count or other size limits - that is, they are expanding their posts, sharing much more content than they would otherwise be able to. They are also avoiding having their jihadi content detected and their accounts shut down.

On these content-sharing services, users can freely post photos, documents, declarations, announcements, appeals, and more, and then easily share the links to these pages' content via their social media accounts. All a reader needs to do to access the content is to click on the posted link. Jihadis typically use these services to share photo collections and videos documenting beheadings, executions, and battles, and well as calls for recruitment, transcripts of leaders' speeches, policy documents, and indoctrination materials (WARNING: GRAPHIC IMAGES).

Posting Content On Justpaste.it

For some time now, Justpaste.it has been the most important content-sharing website for jihadis. In four easy steps, anyone can post content on Justpaste.it: 1) Go to justpaste.it. 2) Type in text and upload photos or documents. 3) Click "Publish" to create a web page. 4) Share the link of the web page.

This report will look at the cycle of jihadi preferences for social media content-sharing platforms, led by Justpaste.it. 

Justpaste.it: Operated From Poland, Hosted In Germany, Widely Used By Jihadi Groups And Followers - Including ISIS And Al-Qaeda

The free content-sharing web service Justpaste.it, which allows content to be posted within seconds with no registration required, was established in 2009. In its Terms of Service, Justpaste.it places almost no restrictions on the posting of content; in fact, it "expressly disclaims any and all liability in connection with Content," except for "Content which contains material which it is unlawful for you to possess in the country in which you are resident" and "third party copyright material." It also warns users that they may "be exposed to Content that is factually inaccurate, offensive, indecent, or otherwise objectionable to you" and specifies that users "agree to waive, and hereby do waive, any legal or equitable rights or remedies you have or may have against JustPaste.it with respect to any such Content."[1]

According to its founder and owner Mariusz Zurawek, who operates the website out of his home in Poland, the service was aimed at making posting photos and videos extremely easy. Zurawek said, in December 2015, that since he launched the site its web hosting has been provided by the "German company Hetzner."[2] However, according to the geolocation of the IP address via DNS Lookup, it was hosted in Marina Del Ray, California until September 2015; prior to that, it was registered to Zurawek and hosted in Germany.[3] It is currently not possible to determine where it is hosted, since it is using the U.S.-based reverse proxy service CloudFlare.

 

ISIS Begins Using Justpaste.it: Founder Claims Non-Interference, Expresses Pride That Syrians Chose His Platform, Appreciates "Bad Publicity"; Authorities Ask Him To Remove ISIS Content

Beginning in early 2014, the content posted on Justpaste.it began to include jihadi videos and images from Syria; soon Islamic State (ISIS) fighters began posting a large number of images of executions, beheadings, and massacres, and it became clear that Justpaste.it had become an essential part of the group's social media operations.[4] This coincided with crackdowns by Facebook and YouTube on this type of content.

When jihadis' use of Justpaste.it came to the attention of authorities, later in 2014, Zurawek defended it as a form of freedom of speech: "I do not want to interfere with any type of conflict and stay on one side... I don't have enough information about ISIS to tell the public if they are good or evil. Justpaste.it has many users. I cannot focus on a single group."[5] He also said that he was proud that Syrians had chosen to share images on his site.[6]

In August 2014, the London Metropolitan Police's anti-terrorism unit asked Zurawek to remove individual ISIS posts, and even though the force had no jurisdiction in Poland, he complied, removing up to 2,000 posts, by his count, as of March 2015.

In a December 2015 interview, Zurawek said: "Surprisingly, I found that the bad publicity" his site had gotten from ISIS's use of it "also created a positive impact and attention to the site that made other people start using it for good causes... I have seen an increase in visits since ISIS tried to exploit my service." He added that the hosting company, Hetzner, had once "complained about the ISIS content and wanted to force me to include registration for each content shared. I explained them that 'no registration required' is the main idea of the site and they actually responded well. They agreed that as long as I am being stricter with removing content no registration would be required."[7]    

August 2014: Justpaste.it Removes Some Jihadi Content; October 2014: Jihadis Begin Launching Their Own Content-Sharing Websites

It was apparently this removal of content on Justpaste.it that prompted jihadis to launch their own content-sharing websites - among them Manbar.me, created in October 2014; Nasher.me, created in January 2015; and Alors.ninja, created in July 2015. These content-sharing websites function like Justpaste.it, allowing users to quickly and easily create webpages without the need to register or to provide any identifying information. The links to the pages created on them are then, like Justpaste.it links, tweeted and shared on other social media.  

February 2015: Some Jihadi Content-Sharing Websites Defunct - Justpaste.it Again Used By Jihadis - Use Of New Websites Also Increases

However, a great deal of jihadi content was left undisturbed on Justpaste.it, and now, over a year later, it is again one of the main services used by jihadis, particularly ISIS-affiliated jihadis, for posting content. Manbar.me and Nasher.me are no longer online, since March and February 2015, respectively. However, Alors.ninja was recently discovered by ISIS, and its use is now expanding (see section below); and new services, Sharetext.net and PasteMaker, are also now being used.

Content posted in the past year on Justpaste.it - much of which is posted on a daily basis - includes photos of massacres of hundreds of prisoners and graphic documentation of the beheading of a man with a surrounding audience that included children.[8] Links to this content on Justpaste.it continue to be very widely tweeted and also disseminated on other social media.

Examples Of Jihadi Content On Justpaste.it

The following are examples of content on some of the hundreds of jihadi pages on Justpaste.it (for more, see Appendix I: Further Examples Of Jihadi Content On Justpaste.it). These represent how ISIS and other jihadi groups are using the platform - in clear violation of Justpaste.it's own minimal terms of service, mentioned above.  

On May 15, 2016, @ns_243 tweeted a link to a photo report posted by ISIS's Khurasan Province, i.e. Afghanistan, on Justpaste.it, with the comment: "#Khurasan province, killing three members from the nationalistic #Taliban movement." (WARNING: EXTREMELY GRAPHIC)

The following are the photos from the report on Justpaste.it, titled "Killing three members from the nationalistic Taliban movement." (WARNING: EXTREMELY GRAPHIC)


"The apostate 'Abd Al-Ghafour (Fida'i), one of the members of the nationalistic Taliban movement"


"The apostate Muhammad Raheem (Karuwan), one of the members of the nationalistic Taliban movement"


"The apostate Fadl Al-Rahman, one of the members of the nationalistic Taliban movement.

On March 25, 2016, ISIS's Aleppo Province posted photos of the martyr Abu 'Abd Al-Rahman Al-Akyoli (WARNING: EXTREMELY GRAPHIC):

The same day, Aleppo Province also posted a photo report on Justpaste.it, titled "Where is the Refuge 3" and showing the execution of "apostates." (WARNING: EXTREMELY GRAPHIC)


"The media office of Al-Anbar Province presents a photo report:  Where is the refuge? (3)"


"Moment of execution of the apostate Yahya Muhanna Al-Obaidi"


"Moment of execution of the apostate Yahya Muhanna Al-Obaidi"


"Moment of execution of the apostate Yahya Muhanna Al-Obaidi"


"Moment of execution of the apostate Yahya Muhanna Al-Obaidi"


"Moment of execution of the apostate Ahmad Mu'ayyad Sulaiman Al-Nimrawi"


"Moment of execution of the apostate Ahmad Mu'ayyad Sulaiman Al-Nimrawi"


"Moment of execution of the apostate Ahmad Mu'ayyad Sulaiman Al-Nimrawi"

The link to the above report was tweeted by jihadis, for example, on March 27, 2016 by @jg5gk6. The text stated: "Caliphate News, Ninawa Province, Pictorial Report: Where is the Refuge (3)."

A December 5, 2015 tweet stating "Pictorial Report - Implementation of Allah's ruling on a tyrant, one of Sheikhs of Al-Rafi'iyah group [a Sufi group]" linked to a page of photos on Justpaste.it (WARNING: EXTREMELY GRAPHIC):  

 

Clicking on the Justpaste.it link in the tweet leads the reader to the page of photos; some of the photos on it are:


"Implementation of Allah's ruling on a tyrant, one of Sheikhs of Al-Rafi'iyah group"  


Left: "Implementation of Allah's ruling on a tyrant, one of Sheikhs of Al-Rafi'iyah group." Right: "Reading the verdict of the Islamic court"


"The tyrant is being escorted to the public square to have Allah's ruling applied on him." Right: "The devils he worshiped instead of Allah did not come to his rescue"

An October 25, 2015 tweet linked to a photo report on Justpaste.it of the same day's stoning of two homosexuals in Aleppo province, Syria, before a crowd of onlookers, including children.[9]

Clicking on the Justpaste.it link in the tweet leads the reader to the page of photos; some of the photos on it are: 

 

Manbar.me

Manbar.me (manbar is Arabic for "pulpit") was created in October 2014. It had sections in Arabic and in English. According to a search conducted in January 2015, its information was protected by a service based in Panama City, Panama. It was last seen online in March 2015.[10]

Manbar.me claimed no responsibility for posted content, though some pages did get removed. It should be noted that identical content posted on Justpaste.it was not removed from there. Shortly after its creation, Manbar.me saw heavy use by jihadis, particularly those affiliated with ISIS. Since links to content posted on Manbar.me, like links to content posted on Justpaste.it, were tweeted and retweeted widely by users, and in languages such as Urdu and others, Manbar.me page views could reach into the thousands within a few hours. Like Justpaste.it, Manbar.me required no skill on the part of the user: typing or pasting in text, adding photos or other media, and clicking "post."


Manbar.me input page

ISIS's provincial media offices, including those in Tripoli and Barqa in Libya, used Manbar.me intensively to spread propaganda, including collections of photos of community events and of battles and raids. While users generally identified themselves as official ISIS media offices, not all Twitter accounts that shared links to the pages were official ISIS representatives.

The following are Twitter accounts that tweeted links to Manbar.me pages, as of late January 2015:

Media Offices For ISIS Provinces

Sinai Province


Profile page: "The official account for the Media Office - The Province of Sinai - The Islamic State - This page is for publication and not for communication"

The Twitter account for the Sinai Province (@W_SINA55) posted a number of links to Manbar pages. The following are examples:


"Video production documenting the crimes of the Egyptian and Zionist alliance against the people of Sinai 2"

The Manbar page linked to in the above tweet provided a list of links to download a video of a mass execution. The images and list below are from the corresponding Justpaste.it page, as the Manbar.me page was taken down.

The following page on Manbar.me was created January 27, 2015 and within two days had had 7,308 views.


Justpaste.it page, corresponding to a Manbar.me page, with links to download an execution video

The following tweeted page on Manbar.me was created January 27, 2015, and within two days had had 5,399 views.


"#Syrian_Rasd ||New|| The Media Office of the Province of Diyala presents: Visual Report: lava (5)"; Manbar.me page linked to in the tweet: "Shelling  the barracks of the Safavid army with 60 mm mortar rounds."

For more, see Appendix II: Content From Manbar.me.

Nasher.me

Nasher.me, created January 4, 2015, also allowed users to easily create pages. "Nasher" in Arabic is "publisher." A Whois search showed that its information is protected by the Kirkland, WA-based Whois Privacy Protection Services, Inc. The website was last seen online in March 2015.[11]

Unlike Manbar.me, Nasher.me was in Arabic only.


Nasher.me main page

The following Twitter pages posted links to content on Nasher.me:

Naba' Agency

While not an official ISIS Twitter account, @NABA_NEWS1 disseminated links to Nasher.me pages. This account had 6,369 followers and 4,704 tweets as of February 7, 2015.


Left: "Naba' agency delivers the mujahideen's news; this page is unofficial; news published can be true or false." Right: "#Kirkuk_Province; The Media Office of Kirkuk province presents: the Seizure and Burning of a Quantity of Cigarettes"


"#Province_of_Diyala presents Report 7 (Photos from the Land of Jihad 9)"


Photo Report 7: "Photos from the Land of Jihad"; Bottom left: "The Media Office for the Province of Diyala, February 1, 2015"

Observer

Observer (@azzamalirhabi) posted a number of links to Nasher.me pages.


From page linked to in tweet: "Part from the 'Soor Shnas' battles near the City of Samarra," 26 January, 2015, Photo Report 1


"Part from the battles of 'Soor Shnas' near Samara - targeting the barracks of the Safavid army with heavy arms"; Information on the photo report: "26 January, 2015; number of views [as of 9 February, 2015]: 4,950; views today: 3; Date published: 27 January, 2015"

While Nasher.me is now, as mentioned, offline, there are "Nashir" groups fulfilling a similar function - that is, posting official ISIS releases - in several languages, including English, French, and Farsi, on the encrypted app Telegram.


Nashir English channel, January 6, 2016


Nashir French channel, January 6, 2016.

For more on Nasher.me, see Appendix III: Content From Nasher.me.

Alors.ninja: Recently Adopted By ISIS

It is only recently that ISIS has begun using Alors.ninja as a new platform for uploading and publishing its content. Links to Alors.ninja began appearing on pro-ISIS Twitter accounts and on the pro-ISIS Shumoukh Al-Islam forum in early October 2015. However, the domain itself appears to have been in existence since July 2015.[12] 


The first Twitter accounts to publish Alors.ninja links

The lag between Alors.ninja's July 2015 launch and the appearance of links to it on ISIS Twitter accounts only in October 2015 could be an indication that its creators took a few months to fortify it against cyberattacks and to hide their traces online (see below). Possibly related is the fact that in recent months ISIS has stepped up its use of the Internet Archive (Archive.org) to publish its daily photo reports. While ISIS use of the Internet Archive is not new, it previously published videos on it, not photos, with the now-defunct Nasher.me, as well as Justpaste.it, used for photos. The recent upsurge in publication of links to ISIS photo reports on the Internet Archive may be connected to the fact that Nasher.me is offline, and to the fact that its substitute, Alors.ninja, is not fully utilized by ISIS and its supporters.


Alors.ninja link to page with photos of a recent stoning by ISIS in Ninawa, Iraq; below it is a link to the same photo report on the Internet Archive (Source: Shumoukh Al-Islam, October 9, 2015)

Details about the identity of those behind Alors.ninja are unavailable. The domain is protected by CloudFlare, and information on its owners is hidden by the Whois privacy protection service.

The webpage also prevents web crawlers from accessing it, making it even harder to obtain information about the webpage structure or anything else.

Alors.ninja appears to have been targeted by a cyberattack in early October, and according to one tweet, has beefed up its defense measures as a result.  

The hack was allegedly carried out by a member of the Cyber TeamRox hacker group, and appears to have been a defacement of an Alors.ninja link.

Alors.ninja, which is only in Arabic, is user-friendly; as with Justpaste.it, Manbar.me, or Nasher.me, the user simply uploads content. A visual Captcha test is added to verify that users are not bots, and clicking "publish" generates two links: a URL for sharing the content online, and a private URL for editing the page content later if desired. The user also has the option of providing a name and of adding a password to view the page.

The following are some tweets linking to pages on Alors.ninja:


@b_1_u, October 2, 2015; @3abera_sabil, October 4, 2015.


@SalafAldawila, October 5, 2015; @UmmahBleeding, October 9, 2015.

The introduction to the photo report below states: "Breaking/ ISIS in Falluja/ Damaging of Safavid heavy vehicle known as 'Haffarah' on the outskirts of Al-Lahib/Al-Karmah region after being targeted by heavy weapons, praise be to Allah. Total views: 1,159. Today's views: 1,159."  As of October 19, 2015, this page had 1,744 views.


Caption: "Damaging of Savavid's vehicle known as "Haffarah" in the outskirt of Al-Lahib/Al-Karmah region after being targeted by heavy weapons, praise be to Allah."

Sharetext

Jihadis continue to create their own content-sharing websites, use them for a while, and then return to Justpaste.it. Around February 2016, jihadis began using a platform called Sharetext. The following are several examples of tweets with links to Sharetext pages:

PasteMaker

Another recent such website, announced on March 1, 2016, is PasteMaker, created by the Al-Fajr Technical Committee (FTC), a group of tech-savvy jihadis. They boasted that it "matches" the text- and image-sharing capabilities of Justpaste.it. The new platform was promoted via other jihadi media - for example, in a March 9, 2016 post on the Muslims Safety Tips channel on the encrypted messaging app Telegram that stated that PasteMaker, "developed by Muslims, can be used as replacement for justpasteit which is comparatively secure than others."

However, a MEMRI examination found that this platform neither allows users to upload images, videos, or documents, nor is as simple to use.[13] It remains to be seen whether it will catch on with its intended audience.

Appendix I: Further Examples Of Jihadi Content On Justpaste.it


Top left: Tweet of Justpaste.it link stating: "#AlRaya_Foundation presents the article 'Oh Kharijites, you have brought something if' by Mr. #Ahmad_Abu_Farha." Top right: Tweet of Justpaste.it link stating:: "#The Islamic State/ #ISIS in Kirkuk/ Photos from the #series of those who have passed away." Lower left: Tweet of Justpaste.it link stating: "# ISIS in Kirkuk/ Shelling on the apostate rejectionist group in the city of Shamsiyyah/Daqouq with Katyusha rockets." Lower right: Tweet of Justpaste.it link to newly released second issue of Al-Qaeda's English-language magazine Al-Risalah. October 21, 2015.

Appendix II: Content From Manbar.me

Fallujah Province

The Twitter account for Fallujah Province (@fallujah69) distributed many links to Manbar.me pages. It had 2,893 followers and 2,654 tweets, as of January 27, 2015.


Banner for Fallujah Province Twitter account.


"#Salah Al-Din Province (photo report) (A tour in the vegetable market - The city of #Tikrit) #Ilsamic_State #Remains"; "Urgent: Attacking the Safavid army barracks and the Rafidite [Popular] Mobilization from several points. 8 Rabi' Al-Thani 1436."

Monotheistic Homsi (@alhoms5) had 5,950 followers and nearly 300 tweets as of January 29, 2015.


"The Media Office for #The_Province_of_Salah_Al_Din presents 'Targeting 'Zeel' for the Safavid army with an IED"; "#Province_of_Diyala  presents photo report 4 (Photos from the land of Jihad 8)"

Barqa Province

Barqa Province (@parqa20014) had 465 followers and 69 tweets as of January 30, 2015. It is still online as of this writing, with nearly 5,000 followers and 82 tweets. This account was created October 29, 2014. While it is not very active, this account is noteworthy because it documented early support for ISIS in Libya.


"Barqa Province new of the Islamic State"


"#Islamic_State; the Media Office for the #Province_of_Barqa presents photo report 4 'The Sahawat [Awakening] of #Benghazi and the effects of destruction'"

ISIS-Affiliated News Outlets

ISIS-affiliated news outlets also posted content on Manbar.me:

Syrian Rasd Network (RNN)

Syrian Rasd Network (@shbktrsdalswryt) had approximately 10,000 tweets and 2,470 followers, as of January 27, 2015. These tweets included links to 10 different Manbar pages, to expand them.


"#Observation_of Syria ||New|| The Media Office for the Province of Fallujah presents: Photo Report: repairing and painting of Fallujah mosques:;From page linked to in the tweet: "Part from the battles of 'Sur Shnas' near Samarra- demolishing the Shi'ite militia gatherings with rocket-propelled grenades." The page was created on January 26, 2015, and within three days had had 10,847 views.

Sa'iq News Foundation

Sa'iq News Foundation (@ahdalcvdc) had 2,319 followers and almost 3,000 tweets. This account posted Manbar pages from ISIS media offices based in Iraq.


"#Province_of Raqqa; Photo report (A day with the Hisba in #Tabaqa)"; Manbar.me page linked to in the tweet: "Urgent: Demolishing Peshmerga gatherings in the area of (Aski Mosul)"

Africa For Media

Africa for Media (@ifrikya3) had 12,000 followers and 942 tweets as of January 30, 2015. It posted links to pages on Manbar.me containing updates on ISIS's progress in territories under its control and in areas of North Africa.


"#New: A series revealing the lies of Al-Joulani front [i.e. Jabhat Al-Al-Nusra] (Part 2)"; "O Muslims, beware and fear Allah #Islamic_State #Ansar_Al_Shari'a #Libya #Tunisia #Islamic_Maghreb"

Other Twitter Accounts Sharing Manbar.me Links

Gharib Al-Ghurabaa'  

Gharib Al-Ghurabaa'  (@gharb_alghoura) had 1,995 followers and 1,303 tweets as of January 30, 2015. It posted Manbar.me links almost as soon as they were created, likely indicating that it was closely affiliated with ISIS media offices.

Umm Al-Muthanna Al-Barqawiyya

The Umm Al-Muthanna Al-Barqawiyya (@omalmothana) account distributed many links to Manbar.me pages. It had 1,321 followers and 1,300 tweets as of January 30, 2015. The user's location was given as "State of the Caliphate, The Province of Barqa." Barqa is located in Libya.

More Manbar.me Pages

The page below, on Manbar.me, was created January 19, 2015, and as of February 3, 2015 had had 13,324 views.


"Corpses of the Islamic State at the hands of Peshmerga forces. Photo report || on the killed soldiers of the Caliphate and the traitors from the Karwia tribe over Jalulaa' region ||"

The Manbar.me page below was created on February 1, 2015, and as of February 4, 2015 had received 13,552 views:


"The Media Office for the Province of Al-Khayr Presents Photo report titled (The Seizure of cigarette smugglers in the city of Al-Mayadeen)"

The Manbar.me page below was created on January 31, 2015, and received 7,560 views as of February 4.


Left: "Photo Report on the Da'wa conference in the al-Halabseh area, Al-Fallujah)"; Right: "Part of the games"

The Manbar.me page below, titled "Islamic State Releases From This Week," provided links to view and download several media productions posted both on Manbar.me and on YouTube, archive.org, and on Justpaste.it, and links to download:

Appendix III: Content From Nasher.me

Monotheistic Homsi

Monotheistic Homsi (@alhoms5) had 5,950 followers and nearly 300 tweets as of January 29, 2015, which posted links to Manbar.me, also posted links to Nasher.me pages.


"Islamic #State #Province_of_Al-Khayr; Photo report page 3 (Hanging signs in Ma'dan)"


The Media office for the Province of Al-Khayr; Number of views [as of 9 February, 2015]: 4,377; Number of views today: 4; Date published: 30 January, 2015"

Miscellaneous


""The Province of Al-Janoub [south of Baghdad] ; 'Photo Report 3'; bombing the barracks of the Safavid Army and its militias with 7 <> missiles | Al-'Annaz - Zawba'"; Bottom left logo: "Al-Janoub Media Office"


"Carrying out the punishment of cutting off the hand of a thief in the city of Manbij"

The above page was created September 1, 2015, and as of this writing had nearly 5,000 views.

 

*Steven Stalinsky is Executive Director of MEMRI; R. Sosnow is Head Editor at MEMRI.

 

Endnotes: 

[1] Justpaste.it/jpregulations, accessed November 4, 2015.

[2] Hostadvice.com/blog/justpaste-it-is-the-quickest-way-to-share-content-online, December 16, 2015.

[3] Dawhois.com, accessed September 25, 2015.

[4] BBC, March 13, 2015; The Guardian, August 15, 2014.

[5] The Guardian, August 15, 2014.

[6] BBC, March 13, 2015.

[7]  Hostadvice.com/blog/justpaste-it-is-the-quickest-way-to-share-content-online, December 16, 2015.

[8] BBC, March 13, 2015; The Guardian, August 15, 2014.

[10] Archive.org, October 19, 2015. 

[11] web.archive.org/web/*/nasher.me, accessed December 14, 2015.

[12] Toolbar.netcraft.com/site_report?url=http://www.alors.ninja, accessed October 9, 2015.

Share this Report: