The Road to Ceuta: Mapping the Online Mobilisation Infrastructure
In July 2026, posts telling people the Ceuta border was open spread through Moroccan Facebook groups faster than any person can type. We traced how. This report walks through the operation in six steps, mapped from 25,335 captured posts.
A small operation with a repeatable routine ran the campaign: it pushed the same post into fourteen existing communities at once, hid it under celebrity hashtags, and moved recruits to WhatsApp.
The post is written
One click posts it
It lands in 6 of the 14 groups
Readers message WhatsApp
The crossing
The campaign ran inside fourteen pre-existing diaspora communities
Fourteen Facebook groups already existed for Moroccans abroad and those hoping to leave: everyday talk about visas, transport, work in Europe. The campaign posted into these communities. Its content made up 4% of what the groups posted this summer – and that 4% was enough: within weeks, tens of thousands crossed at Ceuta.
| Group | Posts | Texts | Ratio | Active | Role in the chains | Tier |
|---|---|---|---|---|---|---|
| Haraga Tanger malaga | 241 | 156 | 1.5 | 1 Jul – 16 Aug | in both posting lists | hub carrier |
| Haraga melilla 2023 🇪🇸 | 166 | 132 | 1.3 | 1 Jul – 16 Aug | in both posting lists | hub carrier |
| الغربة LGhorba 🌎✈️🛳️ | 109 | 76 | 1.4 | 1 Jul – 7 Aug | list A | hub carrier |
| Haraga_maroc عشاق الغربة | 101 | 76 | 1.3 | 4 Jul – 16 Aug | list A · starts the 16 Aug run | hub carrier |
| Haraga EUROPA 🇪🇸🇩🇪🇨🇵🇪🇺 | 98 | 81 | 1.2 | 3 Jul – 16 Aug | list B | hub carrier |
| Transporte Lghorba | 94 | 69 | 1.4 | 1 Jul – 16 Aug | list A | hub carrier |
| Lghorba 🗼الغربة 🇮🇹 | 72 | 25 | 2.9 | 1 Jul – 16 Aug | highest repetition in the ring | — |
| HARAGA | 37 | 28 | 1.3 | 6 Jul – 16 Aug | list A · first group in 4 runs | amplifier |
| Haraga groupe | 30 | 23 | 1.3 | 4 Jul – 16 Aug | list B | amplifier |
| lGhorba ✈️🛬 الغربة · tiktok | 26 | 24 | 1.1 | 3 Jul – 16 Aug | list A | amplifier |
| Haraga oropa 🇪🇦⛵🇮🇹 | 18 | 15 | 1.2 | 3 Jul – 16 Aug | list B | amplifier |
| haraga melilla | 12 | 10 | 1.2 | 29 Jul – 16 Aug | joins the 16 Aug run | amplifier |
| 🚤 Haraga 🛫 Ispania 🇪🇦 | 4 | 3 | 1.3 | 15 Jul – 6 Aug | logistics posts only | amplifier |
| Haraga 2020 | 1 | 1 | 1.0 | 30 Jul | single post | — |
Group members were not commenting on the news – they were organising journeys, naming departure points across Morocco (Casablanca, Marrakech) and as far as Jijel on the Algerian coast, about 1,300 km from Ceuta.
The same text was posted into six groups, in the same order
On 29 July, the same recruitment text – "a legal loophole means Spain cannot send you back" – appeared word for word in six different groups within 81 seconds. The same six groups, in the same order, took three different recruitment texts that day – at 15:23, 18:40 and 19:24. Press play to watch the fastest of the three at real measured timings.
والسبب استغلال ثغرة قانونية وضعتها الحكومة الإسبانية وهي حظر إرجاع المهاجرين الذين دخلو المياه الدولية الإسبانية في مدينتي سبتة ومليلية المحتلتين ✌️🇪🇦
#الغربة_عشقي
Too fast for hand-posting
The shortest measured wait between two groups is 2 seconds, against a median of 16s. Opening a second group, pasting and publishing by hand cannot be done in 2 seconds.
Too uneven for a scheduler
The waits are uneven – 2 to 122 seconds, no fixed rhythm. A program running on a timer would post at even intervals.
One or more people using a mass-posting tool
Software that pushes one text into a saved list of groups with one click, operated by hand. The tool explains the 2-second gaps; the human hand explains the uneven rhythm. How many hands share the tool, the data does not show.
The posting has a daily rhythm: silent at night, heaviest in the evening
We placed all 1,014 campaign posts from the 14 groups on a 24-hour clock (UTC+1, the local time of the target audience). The same rhythm repeats daily: almost nothing between 02:00 and 07:00, steady posting through the day, and the heaviest volume in the evening.
The rhythm rules out one thing only: a program posting continuously on a server. The heaviest posting fell on the evening hours, which are the peak engagement window on Facebook.
One account disguised its posts as celebrity content
On 29 and 30 July, 32 posts closed with the same block of hashtags about Harry Potter, Harry Styles and hairstyles. The tags pushed those posts into entertainment feeds, where they reached people outside the groups, and where border-related keyword checks do not look.
A captured post, reproduced with its full hashtag tail. The highlighted tags have nothing to do with migration: #harrypotter appears on 37 campaign posts, the other four on 32 each.
All hashtags in the block start with "ha" – the pattern you get when someone types two letters and accepts the phone's hashtag suggestions. The campaign's own tag #haraga begins with the same two letters, so those suggestions would have surfaced every time it was typed – likely how the disguise was found. The ring hijacks other popular reach tags the same way, such as #fyp #viral and others.
The two tag sets did different jobs, and that shows in when they stopped. The celebrity tags existed only to push posts into entertainment feeds. The diaspora tags are how the intended audience finds the content.
Recruits were moved from public posts to private WhatsApp chats
The public posts did the advertising; the practical conversation happened in private. Campaign posts carried 22 different WhatsApp contacts – 9 group invite links and 13 phone numbers – and the numbers changed roughly every week, the way burner phones do: as one went quiet, a new one appeared. Weekly rotation is operational security – contacts retired before they draw attention – and it reads as a maintained recruitment layer rather than spontaneous community organising.
The contacts were maintained like burner phones: as one went quiet, a new one appeared, roughly weekly. The captured numbers are Moroccan, Egyptian, Dutch and Spanish. After 8 August no contact appears in public – a week before the 15 August date, recruitment had moved fully into private chats.
The tool ran again on 16 August, carrying content unrelated to migration
On the morning of 16 August, the day after the failed crossing, the tool ran again – this time carrying a post about a student event held that day at an Algerian university, nothing to do with migration. The capability remains in place for whatever is advertised next, and monitoring keyed to migration keywords does not see it between campaigns.
The same groups
All seven groups in the 16 August chain are July ring groups, matched by Facebook group ID. The run happened inside the same network, not in a new set of groups.
The same speed signature
The post moved from group to group every 13.4 seconds on average – in July the pace was 13.5. The shortest gap was 3 seconds, too fast for hand-posting, and the gaps were uneven, unlike a scheduler's.
The merged lists
Through July the tool posted to two separate lists of groups. The 16 August run placed one text across groups from both lists in a single sequence – the first time the two were combined.
The unbroken tag signature
The diaspora tag block runs through these same groups from 1 July to 16 August without a break – the channel's identity never changed.
94s
The morning after police stopped the second crossing attempt, one identical post appeared in seven of the fourteen groups within 94 seconds – the same one-click posting pattern as in July, and the widest single spread of the whole monitoring period. This time the post had nothing to do with migration. The tool and the groups exist independently of the Ceuta campaign, and whoever holds them can point them at another date or another cause.
What the posts promised
Three things stand out: the false claim was assembled in stages rather than invented, a small set of formulas was repeated for weeks, and the strongest recruitment argument was that everyone else was already going.
Posted again and again for two and a half weeks behind a fixed tag tail ending in #paris.
A blessing posted every few days through July from accounts tagging #haraga_europe_officiel.
The same promise as the loophole post – that the border does not hold – delivered as a joke.
The Prophet's instruction to the first Muslim emigrants, with Spain written in where Abyssinia stood. The post frames the crossing as religiously permitted.
The new barrier at the Tarajal spur, circulated with its measurements – practical detail for a reader planning to get around it.
The second date, advertised in the same channel ten days ahead.
What pulled hardest was the feeling that everyone was already going. A family walking, a waiter leaving his tables, teenagers at the crossing – for a reader still hesitating, these scenes say that people like them have decided, and that waiting means being left behind.
How the campaign was run
It borrowed its audience
Fourteen existing diaspora groups carried the posts. Nothing was built, so nothing could be taken down without touching real communities.
It posted with a tool, driven by hand
Identical posts landed in six groups in 81 seconds, with gaps as short as 2 seconds – too fast for hand-posting, too uneven for a scheduler.
Its posting kept a daily rhythm
Near-silent from 02:00 to 07:00, heaviest from 20:00 to 23:00 (UTC+1) – the evening hours when Facebook engagement peaks.
It hid its posts under celebrity hashtags
#harrypotter and four similar tags pushed the posts into entertainment feeds and past border-keyword checks.
It closed deals on WhatsApp, on rotating numbers
22 contacts, changed roughly weekly, moved recruits from public posts to private chats. From 8 August the contacts stopped appearing in public at all.
It recruited with a handful of repeated lines
The same few short texts were re-posted across the ring for weeks: a promise of Europe’s beauty, a blessing for the road, a joke that the border does not hold. Several ran behind the fixed tag block of section 04.
Its strongest argument was that everyone was already going
On 30 July the groups filled with scenes of real departures – families walking, teenagers gathering at the crossing. Every post carries the same signal: everyone around you is already going.
Its machinery outlived it
The morning after police stopped the second crossing attempt, an identical post appeared in seven of the same groups within 94 seconds – at a similar speed to July – this time on an entirely different topic, unrelated to migration. The infrastructure is intact and reusable.
Data. Two data sets underpin this report, both covering 1 Jul – 17 Aug 2026. The first is the unfiltered capture of the fourteen groups – 25,335 posts, everything the groups published. The second is the cross-platform topic set – 12,337 posts and comments across nine platforms that matched the Ceuta topic (Facebook 4,177 · TikTok 2,230 · X 2,203 · Bluesky 1,733 · Instagram 1,026 · YouTube 957 · Threads 9 · Reddit 1 · web 1)
Tools. Narrative detection and topic analysis were performed on Havel, Repsense’s narrative intelligence platform.