In the aftermath of the San Diego mosque shooting on 18 May, public discussion quickly focused on familiar themes surrounding contemporary extremist violence: accelerationism, manifesto culture, online radicalisation, and the digital footprints of the attackers. As journalists, researchers, and social media users attempted to understand the motivations behind the attack, the incident rapidly became another highly mediated moment in the broader online extremism landscape. Three people were killed in the attack, and both assailants took their own lives.
Yet while much of the public conversation remained focused on the attackers themselves, a different type of reaction was simultaneously unfolding inside Islamic State-linked communication platforms on the dark web.
During routine monitoring shortly after the attack, discussions relating to the shooting began appearing across multiple threads as Islamic State (IS) supporters reacted collectively to the incident in real time. Initially, many of the conversations resembled predictable outrage following a high-profile religiously motivated attack in the West. However, the discussions soon evolved beyond simple condemnation and instead became increasingly focused on interpreting the attackers, analysing their online identities, and situating the attack within broader narratives of religiously motivated violence and internet-native radicalisation.
The San Diego mosque shooting therefore offers a timely case study into how Islamic State-linked dark web communities react during the earliest stages following a high-profile incident. More importantly, the discussions provide insight into how rapidly emotionally charged events can be absorbed into decentralised extremist ecosystems capable of generating retaliatory narratives and communal outrage before official propaganda channels or wider public discourse fully stabilise.
This Insight examines how IS supporters on a dark web communication platform collectively processed and interpreted the San Diego attack in real time. It further explores how these early-stage reactions may offer insight into emerging retaliatory narratives, evolving internet-native forms of radicalisation, and potential future threat trajectories following highly publicised religiously motivated attacks.
The San Diego Mosque Shooting and Online Reactions
Following the San Diego mosque shooting, IS supporters on the dark web platform quickly began discussing the incident. Reactions to such high-profile attacks and incidents are not unusual inside jihadist ecosystems. Supporters routinely discuss, celebrate, condemn, or reinterpret major incidents depending on the attack’s ideological framing. However, discussions about the San Diego attack became notable because of the way supporters attempted to understand and categorise the attackers.
The conversations moved beyond outrage and grievance relatively quickly. Users dissected manifesto excerpts, discussed online identities associated with the attackers, referenced “1488” symbolism, and debated the ideological incoherence reflected throughout the attack narrative. In several cases, supporters appeared less interested in the operational details of the shooting than in understanding what type of extremist actor the perpetrators represented.
Figure 1: IS supporters expressing retaliatory sentiments following the San Diego mosque shooting.
This is where the discussions became particularly revealing.
Rather than relying purely on theological or doctrinal interpretations, supporters repeatedly analysed the attackers through internet culture. Users discussed aesthetics, online personas, manifesto presentation styles, social media behaviour, and the fragmented ideological identity reflected throughout the attackers’ online presence.
Figure 2: IS supporters sharing imagery of one of the deceased attackers while celebrating his death and mocking his online persona, with one user stating that he had sent himself to “Jahannam Alhamdulillah” (Hell, Praise to be God).
One supporter notably described the attackers as “TikTok ideology.” The phrase appeared to describe a form of radicalisation shaped not by a coherent ideological doctrine, but by sometimes chaotic online media environments dominated by memes, algorithms, aesthetics, internet subcultures, and fragmented digital identities.
This characterisation is not unfounded. According to the Southern Poverty Law Center, one of the attackers listed his online usernames in their manifesto, and a corresponding TikTok account – which has since been taken down by the platform – contained neo-Nazi and accelerationist content.
Importantly, this did not suggest IS supporters were abandoning traditional ideological frameworks themselves. Instead, the conversations demonstrated that even established jihadist ecosystems are increasingly confronting forms of radicalisation that emerge from highly online environments and do not fit neatly within conventional ideological categories.
Figure 3: IS supporters interpreting the attack through religious narratives, grievance framing, and discussions surrounding the attackers’ identities.
The discussions also reflected a type of thread culture commonly seen across dark web forums and semi-anonymous online communities. Users collectively reacted to unfolding developments, responded to one another in real time, debated interpretations, and collaboratively attempted to decode the attackers’ ideological identity.
Figure 4: IS supporters following developments in the case and expressing anger following the attack.
In many ways, the conversations resembled a communal effort to make sense of a new generation of extremist actors shaped less by coherent doctrine and more by internet-native radicalisation.
For the purposes of this article, “internet-native radicalisation” refers to radicalisation pathways shaped primarily through digitally mediated environments rather than structured ideological pipelines. These pathways are often influenced by algorithmically recommended content, meme ecosystems, internet aesthetics, online grievance communities, fragmented ideological consumption, and viral symbolic culture spread across multiple platforms simultaneously.
“TikTok Ideology” and the Evolution of Extremist Interpretation
The use of the phrase “TikTok ideology” was one of the most revealing aspects of the discussions.
Figure 5: IS supporters characterising the attackers’ worldview as “TikTok ideology” while debating the meaning of the manifesto.
At first glance, the term may appear unserious or dismissive. However, within the context of the conversations, it reflected a broader attempt by IS supporters to categorise a type of attacker that no longer fits neatly into traditional extremist models, such as the rise of those influenced by online subcultures of nihilistic violence.
Historically, extremist movements often relied upon relatively coherent ideological structures. Individuals have been radicalised through organised propaganda pipelines, doctrinal literature, tightly controlled messaging ecosystems, or formalised ideological communities.
The attackers discussed in the San Diego Shooting threads appeared to challenge many of these traditional assumptions.
This became particularly visible in the way supporters reacted to the attackers’ perceived identities and online personas. Several users appeared confused by the apparent ideological contradictions reflected throughout the attackers’ online presence, including discussions surrounding gender identity, aesthetics, internet culture, and white nationalist symbolism existing simultaneously. Rather than treating these contradictions as unusual exceptions, supporters repeatedly attempted to rationalise them as products of chaotic online radicalisation environments in which identity, ideology, aesthetics, and grievance narratives increasingly merge together.
Figure 6: IS supporters dismissing distinctions between Christians, Jews, and Zionists while discussing the attackers.
Supporters repeatedly referenced the fragmented nature of the attackers’ ideological identity. Discussions pointed toward an online environment shaped by accelerationist references, internet symbolism, aesthetics, meme culture, social media performance, and contradictory ideological influences existing simultaneously.
This distinction matters because the conversations revealed that Islamic State supporters themselves increasingly recognise that many contemporary attackers emerge from chaotic online ecosystems rather than singular ideological movements.
The term “TikTok ideology” therefore functioned as shorthand for a broader phenomenon: extremist identities shaped by fragmented digital environments where ideology becomes mixed with internet aesthetics, viral symbolism, online performance, and algorithmically mediated content consumption.
This was particularly visible in discussions surrounding manifesto presentation, online identities, usernames, internet symbolism, and broader online behaviour. The conversations repeatedly returned to questions surrounding how modern attackers consume, remix, and perform extremist identities in online environments.
Retaliatory Narratives and Future Threat Trajectories
Beyond ideological interpretation, the conversations also revealed signs of retaliatory thinking emerging inside the platform.
In one discussion, a supporter explicitly called for an attack targeting a church following the San Diego shooting, while another escalated the rhetoric further by declaring that “we will kill Christian men and use your women as concubines.” A third user responded by invoking retaliatory violence, stating: “if you killed 5 Muslims today, we killed 75 this week and 86 the previous week.”
Figure 7: IS supporters calling for retaliation and violence against Christians following the San Diego shooting.
While isolated statements do not automatically indicate operational capability or imminent attack planning, such rhetoric remains significant given the context in which it emerged: an active Islamic State-linked communication environment reacting collectively to a highly publicised mosque shooting incident.
This point is important because the discussions were not simply abstract ideological commentary. The threads reflected emotional escalation, communal outrage, retaliatory framing, and attempts to situate the attack within broader narratives of perceived persecution against Muslims in the West.
Figure 8: IS supporter attempting to mobilise anger following the San Diego mosque shooting.
From a threat-analysis perspective, these discussions matter not because every expression of outrage leads directly to violence, but because they provide insight into how extremist supporters emotionally process major incidents and incorporate them into broader grievance narratives.
These discussions also highlighted a deeper uncertainty emerging inside extremist ecosystems themselves.
Supporters repeatedly struggled to categorise the attackers within a single ideological framework. Rather than confidently identifying them as conventional white nationalists or accelerationists, users debated their online identities, internet influences, aesthetics, symbolism, and ideological incoherence.
This uncertainty may itself become an important feature of future extremist environments.
Contemporary attackers increasingly emerge from overlapping digital ecosystems where extremist symbolism, grievance narratives, online subcultures, meme communities, accelerationist content, and internet aesthetics merge together fluidly. As a result, ideological identities become harder to categorise cleanly.
Therefore, these conversations provide insight not only into how IS sympathisers reacted to the attack, but also into how jihadist ecosystems themselves are attempting to understand a new generation of extremist actors shaped by fragmented online media environments.
Implications for Researchers and Technology Platforms
The conversations surrounding the San Diego mosque shooting highlight several important challenges for researchers, technology companies, and counter-extremism practitioners.
First, extremist analysis increasingly requires understanding how online culture shapes contemporary radicalisation pathways. The discussions demonstrated that supporters were not solely focused on theology or ideology, but also on aesthetics, internet symbolism, online identities, manifesto culture, and social media behaviour.
Second, dark web discussion environments continue to provide valuable insight into how extremist supporters collectively process major real-world events. These spaces often function as semi-insulated communities where narratives, grievances, retaliatory rhetoric, and emotional escalation can evolve communally away from mainstream visibility.
Third, the conversations suggest that extremist ecosystems themselves are increasingly confronting a generation of attackers shaped by fragmented online environments rather than singular ideological doctrines. This may complicate traditional approaches to identifying extremist pathways online.
Finally, the San Diego case demonstrates why monitoring early-stage reactions inside extremist ecosystems remains important. While inflammatory rhetoric alone does not necessarily indicate imminent violence, these discussions can still provide insight into emerging retaliatory narratives, emotional escalation, and evolving threat trajectories following highly publicised ideologically or religiously motivated attacks.
Conclusion
The Islamic State-linked dark web discussions following the mosque shooting in San Diego offer insight into how contemporary jihadists and their supporters interpret and emotionally process highly publicised acts of violence.
Rather than relying solely on traditional ideological frameworks, IS insiders repeatedly attempted to understand the attackers through internet culture, manifesto aesthetics, online symbolism, and fragmented digital identities. The recurring references to “TikTok ideology” reflected a broader recognition that many contemporary attackers increasingly emerge from chaotic online media environments rather than coherent ideological pipelines.
At the same time, the discussions also demonstrated how quickly retaliatory rhetoric and grievance narratives can emerge inside active extremist communication spaces following religiously motivated attacks. The explicit call by one supporter for an attack targeting a church further underscored the potential security relevance of these conversations.
Ultimately, the San Diego case highlights why analysing extremist discussions themselves, rather than focusing solely on official propaganda outputs, may provide valuable insights into evolving extremist thinking, emerging retaliatory narratives, and future threat trajectories developing inside digitally mediated extremist environments.
—
Muskan Sangwan is a Threat Intelligence Analyst at StealthMole and previously worked as a Senior Counter-Terrorism Intelligence Analyst at the Terrorism Research and Analysis Consortium (TRAC). She specialises in terrorism and extremist ecosystems with special focus on Islamic State (IS) operations, jihadist and far-right movements, the crime–terror nexus, and the growing intersection of cyber threat intelligence and dark-web activity.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.