The team at the Repository of Extremist Aligned Documents (READ) developed this insight by actively monitoring and analysing online extremist ecosystems as part of their commitment to maintaining a curated, up-to-date library available on the principle of qualified free access. Click here to learn more about the platform or sign up for the Repository.
Despite community members insisting that their forums do not advocate for violence, both gore and True Crime Community (TCC) spaces play an important role in the spectrum of mass violence. According to the Polarisation & Extremism Research & Innovation Lab (PERIL)’s Nihilistic Violent Extremism (NVE) tracker, these communities in combination make up a particularly dangerous section of the broader NVE landscape. Similarly, Argentino and Lindsay identified gore and TCC as two of “eight principal ecosystemic pathways that lead into the edgesphere,” a digital space defined by transgressive humour with past involvement in NVE incidents.
The edgesphere spans the modern internet, from private message rooms and social media feeds to dedicated public forums, attracting growing concern and scholarly attention. Beyond the internet, 2026 has seen attacks in Italy, Turkiye, the Philippines, and Mexico, among others, demonstrating its varied geographical and cultural pervasion. As researchers and law enforcement trace perpetrators’ pre-attack activity, investigations have identified engagement with edgesphere sites, including registered accounts on both TCC and gore-centric platforms.
This Insight examines two anonymised websites1 monitored by the READ Team that contribute to the online circulation of extremist content through the lens of fandom and ‘apolitical’ interest. It compares their functions, approaches to handling extremist content, and how they circulate graphic material, drawing out how the two sites differ and overlap, and ultimately analysing the ways they are rendered usable for TCC-inspired extremism.
The Sites
A community of gore fans, expelled from Reddit in 2019 for repeatedly posting footage of the 2019 Christchurch attack, started Site A in April 2022 after using a Telegram group chat in the interim. Site A was, however, not created out of admiration for the Christchurch shooter, and was driven instead by a feeling that people should be able to access gore content if they choose. Although exhibiting a supposedly apolitical interest in violence and gore, it nevertheless provides access to a strain of violence that is made spectacular by design and intended to be shared. Footage of the shooting has been posted to Site A multiple times and, at publication, stands as the site’s second most popular video.
Site B was created in March 2013, within a community milieu connected to an earlier forum used by Sandy Hook shooting perpetrator Adam Lanza, a celebrated figure in TCC circles ever since. After a period of downtime, the site re-emerged with closer ties to the Columbiner subculture and retains a strong identity connected to this lineage; users in this fandom have been categorised as researchers, fangirls, fans, and copycats of Columbine, but interest spans a range of mass and individual attacks. The site has thus grown to include entries on a myriad of other attacks, including school shootings, terrorist attacks and others.
Figure 1. Comparative statistics for Sites A and B. Blue figures are site-reported; orange figures are third-party estimates, recorded 27 October 2026.
Site A is much larger than Site B (Figure 1), potentially because it inherited an interest established by past shock sites and spaces of morbid curiosity. Although the sites serve different purposes, both play important roles in the wider ecosystem that circulates footage and discourse on violent extremism. For A, this stems from the fact that the Site is dedicated to gore, while B focuses on school shootings and, by extension, other violent, physical attacks and/or crimes.
Both sites imitate popular social media engagement mechanisms, amplifying user activity while also restricting certain content. Site A has more Reddit-style social features, where users can upvote posts and give awards to users they feel particularly deserve them. Importantly, this system also gatekeeps certain content, restricting threads about people under 18 to users who have earned a set number of points through upvotes, encouraging community engagement. By comparison, Site B uses a like/dislike system but lacks the same social infrastructure, though comments per thread remain similar (Figure 1). This social element binds users into a tighter online community, and research identifies it as a driver of social media engagement. These posting-reinforcement mechanisms incentivise users to gather and share new information about attacks and attackers, deepening the edgesphere canon and further increasing a user’s involvement.
Threads and Content
Both sites have different sub-sections to identify areas of interest, generally gore subtypes on site A and particular shootings on site B. Site A therefore allows viewers to choose the type of content they want to engage with (such as ‘accident’, ‘electricity’, or ‘shooting’), while additional hashtags (such as ‘TCC’ or ‘racists’) are used to identify common trends across subtypes. While short clips or collections of images presented without deeper discussion are common, users are encouraged by both moderators and peers to create ‘effortposts,’ longer-form posts unpacking or analysing the content with contextual information, timelines or other supplementary detail. In contrast, site B is split into a section on Columbine, representing around a third of all topics and posts, and a section encompassing “Other Crimes,” with users starting generally less-detailed threads that are updated as news emerges.
Users on each site respond quickly to attacks through new threads, speculation and news updates, with a recent Site A example illustrating this (Figure 2). The most directly relevant content relates to terrorism and generally appears as footage/imagery or post-event information. In the first case, video, imagery and eyewitness accounts of attacks are sourced and posted for viewing. Site A is far more prominent in this sense, as it primarily hosts footage and regularly shares videos of attacks and their aftermath. Site B is more active in the second category, where information about an attack, particularly about the perpetrator, is hoarded in individual threads. Depending on the case, this may include structured information such as the type of weapon used and the number of casualties. This should be understood in connection to the gamification and ranking of perpetrators by ‘kill count’. This information also appears in ‘effortposts’ on Site A, despite both sites theoretically banning the sharing of social media information about perpetrators.
Figure 2. Site A posts concerning an attack in 2026, published within a three-day period.
Site A contains far more graphic content, including material posted by profiles displaying extremist symbols. The administrators are, however, aware of potential legal problems, and have issued guidance banning material following what they described as contact from an unspecified government agency warning them about content which could be deemed to be promoting Designated Foreign Terrorist Organizations. Administrators therefore distinguish permissible raw documentary footage from banned training, promotional and supportive material. The continued presence of ISIS and cartel subsections does not itself constitute rule-breaking, but Site A continues to circulate imagery demonstrating jihadi and organised crime’s reputation for extreme violence, which they have used to bolster their public image. This exposes a tension between the legal necessity and the site’s general anti-censorship view. Site B is comparatively much more restrictive; directives from the administration not to post “overly gory” content often lead users to reply to one another asking for links via private message, or to link directly to uncensored content from Site A. This outlinking poses a particular issue for counter-extremism, as the ability to connect users from a more fandom-oriented site to one hosting open extremist material allows access to explicit violent content, which may increase the risk of radicalisation. Gore content may contribute to desensitisation in some contexts and can be exploited by extremist groups seeking to inoculate potential members, or nullify the impact of violent attacks more broadly. The 2025 Antioch High School shooter linked social media accounts that included both sites in his manifesto.
Ideological Links
Both sites display political signals despite presenting themselves as primarily non-political spaces. On Site A, the use of slurs, as well as racialised, transphobic and otherwise offensive imagery – in the form of stickers, memes, slogans and usernames – is common. Rather than assigning a particular ideology to this activity, it should be understood as transgressive activity aligned with anti-censorship and anti-”political correctness” views of extant internet edginess, a view also expressed in inflammatory posts aimed at nations and regulatory bodies that support censorship of the site or its ecosystem. These anti-establishment sentiments are accompanied by a sense of vigilante justice and a specific moral boundary-drawing, wherein posts showing (or claiming to show) violence carried out on perpetrators of sexual crimes, particularly pedophilia, or violence against animals are often highly appreciated. Infamous footage of a father shooting his son’s abuser is the most-upvoted piece of content on the site, while the beating of an alleged animal abuser is fifth. Comments under posts showing harm done to minorities or involving women, Queer or trans people or taking place outside of the West often mock victims, implying a hierarchy and justifying violence through exclusion and othering when directly met with footage of such incidents.
On Site B, overt extremist references take different forms. For example, users find and repost social media accounts used by perpetrators to spread propaganda, and it is not uncommon to see positive comparisons of certain shooters. As part of this, edits spread on both sites, allowing them to function, intentionally or not, as links in the chain of memetic violence. Fanfiction, fan art, and sympathetic retellings of perpetrators’ life stories also serve as pro-attacker evidence that can feed into open praise. READ’s research uncovered links to a neo-fascist forum shared by users, one of whom had recognised another’s username from a far-right site, as well as usernames and profile pictures clearly identifiable as neo-Nazi. Whereas Site A’s sharing often centres on transgressive and graphic violence, Site B can exhibit perpetrator identification alongside a range of visual material (Figure 3). Both platforms also feature extremist symbolism in user profile material (Figure 4).
Figure 3. Selection of material posted on Site B as of 27 October 2026, including perpetrator images, manifesto excerpts, attack reconstructions, fan art, weapons and livestream screenshots.
Figure 4. Examples of extremist symbolism in Site A biography information and a Site B profile picture.
Views on the TCC
Together, the two sites offer insight into how the TCC is regarded and how it functions in reality. Site A users in particular regularly mock TCC-related attackers, especially young ones, commenting negatively on poorly-planned or failed attacks, badly-written manifestos, or ‘cringe’ social media content. In some Site B discussions, criticism also focuses on outcomes, with certain users disparaging an attacker’s lack of kills by referring to them as having a low score. Despite their differing roles, user interactivity and cross-platform movement connect the two communities. This can occur even when participants reject the other community’s identity. Users from Site A credit Site B threads for providing attack details when they post the same information, while Site B users point to Site A when readers request unredacted, gory, or otherwise more violent content. Both tend to see themselves, and each other, as having a healthy interest in each other’s topics, and view levels of engagement as politically disconnected. However, both sites also contain threads linking user accounts to offline acts of violence, with dozens of accounts suggested to belong to perpetrators of real-world crimes including school shootings (Figure 5).
Figure 5. Comments on an account attributed to a school shooting perpetrator on Site A (top), and a Site B discussion claiming to identify an attacker as a user (bottom). Compiled by the authors.
Reporting and discussion of perpetrators’ social media accounts can contribute to cycles of attention around attacks, sometimes linked to meaning quests that can drive anti-society or nihilistic violence in the first place. Further, the manifestos of attackers – TCC and otherwise – can be easily found in both spaces, with running threads collecting new documents as they surface and with individual event/perpetrator-centric posts linking to relevant writings. Both spaces can consequently host extremist material designed to encourage future attacks, although the framing and purpose of content vary by post. Neither Site A nor Site B appears to have a consistent policy for removing accounts attributed to attackers, with more prominent perpetrators’ accounts removed (though copycats have appeared with referential usernames) while others remain online. The community presenting themselves as anti-TCC and opposing violence cannot prevent these channels from circulating material that may be used by individuals contemplating violence.
Conclusions and Recommendations
Researchers and trust-and-safety teams should examine site-specific cultures, cross-check references and distinguish discussion from indications of violent intent. These sites can foster distinctive subcultures ranging from genuine morbid curiosity or research to overt perpetrator celebration, and both their technical features and everyday norms influence how violent material is encountered. It is equally important not to demonise users collectively; there are those with non-extremist interests, and many users of Site A are recorded as having expressed gore as a coping mechanism that displaces harmful feelings instead of acting upon themselves or others. Some individuals have been described as victims as well as perpetrators of violence; research also suggests that NVE involvement is “shaped by trauma, alienation, identity disruption, and online social reinforcement”.
Site A recorded large influxes of users following global events such as October 7th and the assassination of Charlie Kirk. Likewise, Site B attracts discussion following high-profile attacks such as the San Diego shooting, with school attacks a particular focus. Understanding how urgent and sensitive moments generate interest and draw users toward potentially radicalising content offers a mitigating approach. The Global Internet Forum to Counter Terrorism (GIFCT)’s Incident Response Framework and Tech Against Terrorism’s Incident Response Policy offer additional intervention measures for tracking information and circulating content warnings surrounding events in the immediate aftermath of attacks, in order to reduce the chance of users being directed towards gore or TCC-focused sites in their wake. However, monitoring cross-platform recirculation should continue beyond the immediate incident; as Sites A and B demonstrate, repeated engagement and recontextualisation can continue long after the initial event.
- READ has anonymised the names of the two websites to prevent circulation and amplification of extremist and violent content; they are referred to as ‘Site A’ and ‘Site B’ for the purposes of the Insight.
–
The Repository of Extremist Aligned Documents (READ) is a project developed by the Centre for Statecraft & National Security (CSNS) at King’s College London. READ seeks to provide, curate and manage a secure and controlled repository where researchers and experts can access far-right/ideologically motivated violent extremism (IMVE) documents and primary sources, with entries collected according to our inclusion criteria and selected with academic rigour. The library contains four collections: far-right/IMVE-origin, manifestos, Nazi material, and material produced by NVE groups.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.