The Ceuta Mobilisation Network: Recruitment, Amplification and Operational Security

Between roughly 24 and 30 July 2026, a branded online mobilisation campaign — "هجمة كرياج سبتة", the "Karyaj assault on Ceuta" — converted a diffuse Arabic-language migration audience into a physical mass-crossing attempt at the Moroccan–Spanish border at Ceuta, staged from the beaches and the forested high ground above Fnideq (الفنيدق) and Belyounech. Golden Owl assesses with high confidence that this was not a spontaneous event. It was a coordinated, pre-built and advertised operation, run as a distributed network across a closed coordination core, a public Facebook broadcast surface exceeding one million disclosed memberships, and dozens of self-assembling recruitment cells.

The single most important structural finding is this: there is no leader — there is a brand and a marketplace. The campaign is organised horizontally rather than hierarchically. It has a name, a rotating coded vocabulary, a recognisable visual identity and a set of shared mottos, but no central command whose removal would collapse it. That design is the reason it reached the scale it did, and the reason it is resilient to arrests and takedowns.

The following judgements anchor this report.

·         Central judgement — organisation, not spontaneity. Golden Owl assesses with high confidence that this was a deliberately organised, purpose-built and directed operation, and not a spontaneous popular movement or an accidental social contagion. The finding is forced by the evidence, not assumed: recruitment was targeted and quota-based (one recruiter cast a specific cell of "two girls and six boys"; another assembled a purpose-built "large group"), which is casting rather than a crowd; and the OSINT work Golden Owl conducted on the individual actors — together with the email addresses and telephone numbers it recovered and enriched — revealed trained, multi-layered operational security: name obfuscation, a rotating codeword, compartmented single-purpose accounts, dedicated operational email addresses, and cross-border (including Turkish +90) contact lines used to keep operators hard to attribute. Operators who take this much trouble to conceal identity, geography and coordination are not an accident; they are people who planned an operation and expected to be investigated. The network even pre-scheduled its sequel (a dated 15 August forward call). Full reasoning is set out in Section 13.

·         Structure. The operation ran on three layers: a closed, off-platform coordination core that issued the branded call and instructed followers to re-broadcast it; a public Facebook broadcast surface of around twenty-five Arabic-language assets plus high-reach amplifier pages; and a bottom layer of individually motivated micro-recruiters who each assembled their own crossing cell and moved follow-up into private messages and WhatsApp.

·         Scale. Golden Owl mapped 25 Facebook assets tied to the campaign. The operational core (direct recruitment plus coordination and marketplace groups) carries roughly 478,000 disclosed memberships; the full surface carries roughly 1,032,000 disclosed memberships; and amplifier pages outside the groups reach a further half a million-plus followers. Membership is not the same as unique people — the same accounts recur across many groups — but the exposure is very large.

·         Actors. A small set of identifiable administrators and recruiters supplied the operational layer, including a Casablanca-origin, Istanbul-based recruiter who assembled a vetted cell of "two girls and six boys" and published a Turkish (+90) WhatsApp line as its entry point; a brand cluster ("ناس الغربة") that administers the largest node in the network; a two-account operator built entirely on the string "haragaceuta"; and a Tetouan-area syndicator who pushes identical content into three separate 50,000-member groups.

·         Origin clue. Several independent markers of Algerian provenance attach to the brand infrastructure. Golden Owl assesses these as a genuine, consistent clue to the origin of the asset pool, while the individual operators themselves resolve as Moroccan nationals. This is the strongest structural lead in the case, and it is stated as circumstantial rather than conclusive.

·         Belief system. There is no single ideology and no registered organisation, party, NGO or institution anywhere in the network. Three currents run through it: anti-establishment Moroccan populism, an elite geopolitical-literacy frame, and an apolitical fatalism of exile. Two cross-cutting markers — an Amazigh cultural signature and an ambient "occupied Ceuta" irredentism — appear throughout.

·         Escalation. The network produced its first retaliatory / violent vector during the same window: a hashtag operation across fifteen named northern neighbourhoods closing with "revenge is a duty that must be taken." This is a public-order risk of a different category from crossing recruitment.

·         Outlook. The model is cheap, repeatable and resilient. A forward call for 15 August 2026 was posted on 1 August into a 108,000-member group and remains live. Golden Owl assesses a high likelihood of recurrence.

2.1 The event

Over a compressed window in late July 2026, calls that had been circulating across Arabic-language social media for several days converted into a physical surge on the Ceuta perimeter. Crowds converged on Fnideq and the Bab Sebta crossing. Hundreds attempted the crossing under heavy fog on the night of 27–28 July; the movement peaked around 30 July — Throne Day (عيد العرش) — when Golden Owl assesses that tens of thousands were moved toward or across the border and a large share were subsequently returned to Morocco.

The crossing used two physical methods in parallel: mass swimming around the breakwaters from the Fnideq/Belyounech beaches, and fence approaches ("el-kriaj") staged from the forest above the town. Open reporting and official statements put the swimming route at roughly four-fifths of land entries, which makes the deliberate organisation of the minority fence method — the method that requires numbers, simultaneity and dispersal into teams — one of the most operationally significant signatures in the case (see Section 8.1).

2.2 The human scale

The event was an order of magnitude larger than the recruitment traffic alone would suggest, which is itself evidence that the visible Facebook layer sat on top of something coordinated elsewhere. Official Spanish figures recorded on the order of 50,000 entrants (local officials cited higher), with approximately 48,300 voluntarily returned to Morocco within days. The human cost was severe: at least 67 deaths, rising to 72, most by drowning, with dozens of bodies recovered along the Ceuta coastline in the following days.

Golden Owl draws attention to a detail that is easy to lose in the totals: the network's own groups were, within seventy-two hours, simultaneously issuing crossing calls and carrying missing-person appeals arising from those same crossings — appeals for named minors who had vanished swimming for the enclave. The campaign manufactured its own casualties and then hosted the search for them.

2.3 Chronology

The timeline below is reconstructed from Golden Owl's own collection. The incitement window opens well before the surge and, critically, does not close with it: a forward call for 15 August 2026 was already in circulation before the July dust had settled.

Two features distinguish this from ordinary migration pressure. First, the crossing was preceded by an explicit, dated mobilisation call under a recognised brand. Second, the recruitment catchment was nationwide, not local: security forces locked down bus stations as far south as Casablanca and Agadir to stop young people travelling north to answer the call, which means people were moving specifically for the event, not simply crossing from the adjacent town.

3.1 What this report is

This is a private open-source intelligence assessment produced by Golden Owl. Every finding in it is the product of Golden Owl's own collection and analysis of publicly accessible social-media assets and the identifiers attached to them. Where a judgement is an inference, it is labelled as an assessment and given a confidence level. Where the evidence is circumstantial, it is described as circumstantial.

3.2 What it is not

This report does not rest on the work of other organisations, and it does not reproduce or rely on third-party reporting as the basis for its findings. It is Golden Owl's independent reconstruction of the network from primary artefacts.

3.3 Redaction and responsible publication

Golden Owl recovered a number of hard identifiers during the investigation — telephone numbers on several handsets, at least three email addresses, and cross-platform account handles. In keeping with responsible-publication practice, and because publishing personal contact identifiers would not be lawful, this document does not print any telephone number or email address in full. Identifiers are described instead — for example, "a Turkish (+90) WhatsApp line," "a Moroccan (+212) contact number," or "a Gmail address and Instagram and TikTok handles all built on the string `haragaceuta24`." Names that the actors themselves published or that are integral to the assessment are retained, and a limited set of public group and post links is included for evidential reference. Further screenshots held by Golden Owl can be inserted into this document as required.

3.4 Confidence language

Golden Owl uses a simple scale: established (documentary, directly observed), assessed with high confidence (strong convergent inference), assessed (reasonable inference), and circumstantial (a genuine but unproven indicator). These terms are used deliberately throughout.

Golden Owl assesses the campaign as a three-layer distributed system. This architecture is both the explanation for how it worked at scale and the reason it is resilient to enforcement.

4.1 Layer 1 — the coordination core

At the top sits a closed, off-platform coordination core — a private messaging layer that issued the branded call, set a single gathering point and a unified time, debated crossing tactics (mass swimming versus approaching the fence), and, most importantly, operated a standing instruction that members re-broadcast every call into public Facebook groups. Golden Owl infers the existence and function of this layer from directly observed behaviour on the public surface: synchronised timing across unconnected accounts, the repeated appearance of the same branded call in multiple groups within hours, and the recurring funnel pattern in which an operator posts a public "join the WhatsApp group for migration information" message and places the actual link in the first comment rather than the post body. A second codeword — "الرياح" (the winds) — was observed rotating alongside "الهجمة" (the assault).

4.2 Layer 2 — the public broadcast surface

The middle layer is a network of Arabic-language public Facebook groups and high-reach pages. Its function is less persuasion than two specific services that a crossing audience needs. The first is enforcement-status reporting — "the situation is tightening again"; the beach is closed; interception-versus-success ratios ("~300 intercepted, ~100 rescued at sea, 50+ reaching the beach, 120+ registered at police stations by 09:00"). The second is proof-of-success footage — videos of people who made it across, which convert rumour into apparent proof and recruit the next wave. Golden Owl's assessment is precise: argument did not drive this campaign; proof-of-success footage did.

4.3 Layer 3 — self-assembling cells

The bottom layer is a population of individually motivated micro-recruiters, each of whom builds a personal crossing squad off the broadcast layer and then moves the follow-up into direct messages and WhatsApp. This is the mechanism that makes the campaign resilient: the brand generates demand, and dozens of unconnected individuals independently supply the cells. Remove any one of them and the brand simply produces another.

4.4 Why the design matters

The three layers are only loosely coupled. The coordination core does not need to know the identity of the micro-recruiters; the micro-recruiters do not need to know each other; and the broadcast surface belongs to no one in particular. This is a command-light, brand-heavy structure that behaves less like a smuggling syndicate and more like a franchise with an open marketplace attached. It is engineered — whether by intent or by evolution — for deniability and survivability.

A distinct thread of tradecraft runs through the entire network, and it is worth isolating because it is what keeps the operation alive under moderation pressure. Golden Owl assesses the network's operational security as basic but effective — not sophisticated, but well-matched to the platforms it exploits.

5.1 The rotating codeword

The campaign's core term, "كرياج" (kriaj), is ordinary Darija for a window grille or metal railing; in unrelated household and classifieds groups it is used entirely innocently in the same period. Its repurposing to mean the Fnideq–Ceuta fence crossing gives the campaign a keyword that defeats naive keyword moderation, because filtering on it would sweep up thousands of harmless posts. When "كرياج" attracted attention, the vocabulary rotated to "الهجمة" (the assault) and then "الرياح" (the winds). Golden Owl's assessment is that the vocabulary rotates faster than the venues do.

5.2 Character-splitting

By the counter-messaging phase, moderation-evasion had spread to the search side as well: campaigners writing about the event began splitting keywords with punctuation — for example "الهجـ..ـمة" — to break plain string matching while remaining human-readable. The technique is trivial, but it is a reliable indicator that operators know their content is being scanned.

5.3 The comment-funnel

The most consistent single piece of tradecraft is the link-in-first-comment funnel. Recruitment posts on the public surface rarely contain the operational link; instead the operator posts an innocuous invitation and drops the WhatsApp or Telegram link into the first comment, where post-text scanning does not reach. Golden Owl directly observed this pattern in a live recruitment funnel on 1 August, in which an account offered a "WhatsApp group with migration information — link in the first comment," and members replied asking for it.

5.4 Account hygiene as a signal

Several of the most operationally significant accounts are deliberately locked or deliberately empty — no populated biography fields, no city, no employer, sometimes a false employer claim used as concealment. Golden Owl treats deliberate account hygiene not as innocence but as an indicator of intent: the accounts issuing the sharpest calls are consistently the least attributable, while the merely aspirational accounts are ordinary and populated.

5.5 TTPs at a glance

The table below summarises the observed techniques in a form suitable for monitoring rule design.

Golden Owl identified twenty-five Facebook assets connected to the campaign. They are not equivalent. Five are direct recruitment venues, six are coordination or marketplace venues, four are local community groups colonised by the traffic, four are large aggregators, and the remainder are adjacent-route audiences and syndication endpoints. The tables below list every asset by tier, with its identifier and disclosed membership. Where a group publishes two different counts in different snapshots taken days apart, both are shown; these are snapshots, not contradictions.

6.1 Tier 1 — direct crossing-recruitment groups

These are the venues where the crossing was actually organised. Highest priority.

6.2 Tier 2 — coordination, marketplace and crossing-intelligence groups

6.3 Tier 3 — local groups colonised by the traffic

Collateral infrastructure — repurposed as tracing and status channels, not recruitment venues, and not to be weighted as targets equally with Tiers 1–2.

6.4 Tier 4 — large Spain-migration aggregators (amplification)

6.5 Tier 5 — adjacent-route audiences and endpoints

6.6 Primary group links

Golden Owl-verified nodes, provided for evidential reference.

fnida9 (flagship node):  https://www.facebook.com/groups/461122586996599/

Fnideq Bab Sebta (largest recruitment thread; 15 August call):  https://www.facebook.com/groups/1193176511655298/

Fnideq to Ceuta (the name is the offence):  https://www.facebook.com/groups/694486086717264/

Nas Al-Ghorba Espana (Madrid-registered; Annaba slug):  https://www.facebook.com/groups/1404521329808813/

6.7 The deleted cluster

Golden Owl notes that a takedown-and-arrest wave removed part of the highest-value evidence: several Facebook groups using "Hraga Ceuta" / "Haraga Ceuta" names reached a combined audience in the hundreds of thousands before deletion, and Moroccan authorities reported more than 150 arrests for "digital incitement" (التحريض الرقمي) in the same window. A sweep of that scale strips precisely the accounts and posts a retrospective investigation is designed to catch, which is why the surviving in-group material skews toward 28 July onward — during and after the crossing rather than before it — and why absence of evidence for a given account in the incitement window is not evidence of absence.

Golden Owl distinguishes between direct pressure — venues where people are actually recruited and coordinated — and indirect amplification — venues and pages that motivate and normalise the crossing for a mass audience. This distinction matters because membership size is a poor proxy for culpability: two of the five direct recruitment groups have fewer than 12,000 members each, while the single largest audience touched anywhere in the case is an Algerian regional news group carrying no recruitment at all.

7.1 The core figures

7.2 Two structural caveats

First, these are memberships, not people. The same accounts recur across multiple groups — the Istanbul recruiter posted in at least five, the Tetouan syndicator in at least three, one Beni Chiker operator in at least four — so unique reach is materially below the raw totals. Second, the group totals understate exposure, because the highest-reach content ran on pages and reels outside the groups entirely. In Golden Owl's framing: the groups are where people are recruited; the pages are where they are motivated.

7.3 The amplifier layer

The enabling-media pages are larger than any recruitment group and are the true force multiplier. They are best characterised as enabling media, not organisers — their culpability lies in reach and in the operational value of their border-status reporting, not in intent, and at least one carries an explicit "we do not encourage irregular migration" disclaimer attached to a feed of wall-scaling footage. Golden Owl includes them because any assessment of influence that ignores them would misread the network.

7.4 The reach paradox

The most counter-intuitive finding in the case is that the recruitment posts themselves had small direct reach — tens to a few hundred reactions — while the content that actually moved the population was glorification and news amplification measured in the hundreds of thousands and millions of plays. A single celebratory reel of a young woman reaching a Ceuta beach passed two million views; a returnee testimony reel passed 2.3 million plays; a news reel of "thousands swimming to Ceuta" passed 1.1 million plays. The recruiters convert a few; the amplifiers motivate the many.

Golden Owl's operational read is that any response focused only on the recruitment posts will miss the mechanism. The recruitment layer is small, attributable and legally exposed; the amplification layer is enormous, diffuse and largely protected by the ambiguity of "news." The campaign's genius — if that is the word — is that it separates the two.

The network has no single leader, but it does have a small number of identifiable administrators and recruiters who supplied the operational layer. Golden Owl profiles the load-bearing actors below. In line with the redaction rules in Section 3.3, raw telephone numbers and email addresses are described rather than printed; names that the actors published themselves are retained.

8.1 Aadile Tami — the model cell-builder

Aadile Tami (عادل التامي) is a Moroccan man, originally from Casablanca and resident in Istanbul, operating a "Digital creator" Facebook profile that has been continuously active since 2013. Golden Owl assesses him as the highest-competence cell-builder in the case. Between roughly 17 and 29 July 2026 he posted near-identical recruitment calls under his own name across at least five Moroccan irregular-migration groups, seeking to assemble a squad of 10 to 15 people — explicitly including two women — to storm the Ceuta fence ("el-kriaj") from the forest above Fnideq.

Tradecraft

His tradecraft is what marks him as an organiser rather than an aspirant. He specified a target headcount, a tactical method (split into teams, regroup in the forest), and a route type — the fence, the minority method that requires numbers and simultaneity. He imposed operational security, deliberately withholding the departure date from the open group ("I'm not going to say when, because there are certain people with us"), vetted entrants ("sons of good families and real men"), and moved follow-up into private messages. On 25 July he published a Turkish (+90) WhatsApp line as the entry point to his cell, with the text that the group "has two girls and six boys" and he wanted to add more for the crossing.

The two-handset finding

Golden Owl's identifier work established that the Turkish WhatsApp line he published is a different handset from the personal number registered to his Facebook account — the two end in different digits. This is the single strongest indicator of premeditation in his file: a man improvising posts the phone in his pocket; Tami used a clean, separate operational line for the cell and kept his personal number off it. Combined with the withheld timing, the vetting and the team-splitting, this is method, not impulse.

The three recruitment posts

Golden Owl recovered three principal recruitment posts. Screenshots of two of them are reproduced below; the third is referenced by link.

Post 1 — "10 to 15, split into teams, regroup in the forest":  https://www.facebook.com/groups/1302645485013793/posts/1398624198749254/

Post 2 — assembling a "large group" (link):  https://www.facebook.com/groups/1193176511655298/posts/1837424583897151/

Post 3 — "2 girls and 6 boys" + Turkish WhatsApp line (link):  https://www.facebook.com/groups/694486086717264/posts/875462431952961/

The Istanbul dimension

Golden Owl's reconstruction of his group memberships places him with precision inside a specific set of low-income, migrant-dense Istanbul districts — Esenyurt, Sultangazi, Fatih, Bayezid, Şirinevler/Yenibosna, Başakşehir and others — every one of which appears on Turkey's list of districts closed to new foreign residence registration. He embedded not in Moroccan-diaspora groups but in Syrian community and immigration-procedure groups — the principal social infrastructure of the onward route to Europe — and in second-hand marketplace groups consistent with a subsistence hustle. Golden Owl's assessment is that Turkey was a failed first migration attempt, and Fnideq was Plan B: he spent years next to an organiser's playbook in Istanbul, then applied it to the Ceuta fence. The one Moroccan locality group in his entire membership set is Fnideq, the launch town, 350 km from his Casablanca hometown — a structural tell that recurs across the network.

Ideology and culpability

His political content is, across roughly fifty memberships spanning two countries, zero — no jihadism, no sectarianism, no Western Sahara, no party politics. His worldview is the ghurba frame: emigration as destiny and providence, the state an obstacle to route around. He self-identifies as "son of the migration." Golden Owl found no evidence that he profits; he recruits companions, not customers. The correct characterisation is a peer facilitator acting from personal conviction and personal need, with two aggravating features — the recruitment of two women onto a route on which dozens die annually, and the demonstrated premeditation of the separate operational SIM.

8.2 "ناس الغربة" — the flagship administrator (a brand, not a person)

The badged Admin of the flagship 177,100-member group (fnida9) posts under the display name "ناس الغربة" ("People of Exile"), a "Digital creator" profile with all biographical fields deliberately blank and an Amazigh ⵣ (yaz) glyph in the handle. Golden Owl assesses "ناس الغربة" as a brand rather than a single individual: the same display name exists as at least seven distinct profiles plus two large groups, and it functions as a franchise adopted by multiple operators. Its motto — "عش راجل راك راحل" ("live like a man, you're leaving") — is the fingerprint that binds the cluster together.

Function

This account performs the single most useful administrative function for a crossing audience: enforcement-status reporting. On 28 July it amplified a beach-closure report with the operational read "the situation is tightening again." Four days later, after the mass-casualty phase, the same account pivoted to a mourning post that frames the deaths as a failure of the state, refers to "occupied Ceuta" (سبتة المحتلة), and relocates blame entirely onto unemployment and the absence of a national jobs policy — while the group's "venture or leave" charter and the account's own motto remained unchanged. Golden Owl reads the mourning post as audience retention and reputational insulation after a fatal event, not as a change of position.

The mourning post

The post is reproduced below. Per Golden Owl's editorial decision for this section, it is presented as an image rather than a link. Note the audio choice discussed in Section 10.

8.3 The "haragaceuta" operator — infrastructure, not influencer

A single operator runs two bound Facebook accounts: a profile ("Mou H A Mdlr", self-declared "from Ceuta," self-declared living in Rome) and a page ("العرايشي في Simo Ceuta", i.e. "the Larache man"). The binding is documentary rather than inferential: a Gmail address, an Instagram handle and a TikTok handle all built on the identical string "haragaceuta24" ("Ceuta smugglers 24"); direct reel-resharing between the accounts; and a shared slang self-identifier ("جنقو" with a ninja emoji). He holds the admin function in the group whose name is itself the offence.

The signature

Golden Owl's platform signals place this operator in Morocco — his later accounts carry Moroccan country attribution and Spain/Europe hashtags — which qualifies the self-declared Rome residence. The decisive finding is behavioural: he built accounts across three platforms in a coordinated September 2025 window, some ten months before the crossing, kept them almost empty, ran no monetisation, and holds essentially no personal audience. His own following is around 117 accounts across two platforms; the group he administers has 11,900 members; and the brand he is motto-linked to administers 177,100. This is the profile of infrastructure, not of an influencer — the value is the administrative position on a large surface, not the personal audience.

Golden Owl notes one important negative finding from identifier work: the Moroccan (+212) number on his page returns an aggregator identity that does not match him, and the number appears in a 2019 breach record predating the September-2025 account build — so the number is best treated as recycled or not personally his. His real-world tether is the email, not the phone. His profile is reproduced below.

Operator profile ("Mou H A Mdlr"):  https://www.facebook.com/people/Mou-H-A-Mdlr/61580402073858/

8.4 Said Arbi / Tetouan Global — the syndicator

Operating the page "Tetouan Global" from Azla, a coastal village south of Tetouan, Said Arbi is the network's most tractable operator because he has exposed a working phone number and email on his own page (both withheld here). His role is content syndication, not first-person recruitment: he pushes identical items — breaking-news cards, state-of-emergency claims, cross-border doxxing-awareness posts — simultaneously into at least three separate 50,000-plus migration groups, giving one operator reach across several of the largest nodes at once. Golden Owl's identifier work independently corroborated his forename and surfaced a second, previously unknown email address (a Hotmail account) attached to the same number — the first non-Gmail identifier this network has exposed. Golden Owl rates him the strongest real-world identity in the network.

8.5 Escalation actors and enablers

·         Abdlkrim Elfaidi. Cross-posted a hashtag operation across fifteen named northern neighbourhoods — Ceuta, Melilla, Tangier, Tetouan, Castillejos, Martil, Nador and others — calling for retaliation over violence against migrants, and closing with "revenge is a duty that must be taken." Golden Owl assesses this as the first retaliatory / violent escalation vector in the case, a public-order risk of a different category from crossing recruitment. He also carries a uniform pan-Maghreb #Morocco #Algeria #Tunisia tag set (see Section 10).

·         Hamza Ben Fares. Distributed the direct telephone numbers of Spanish asylum and reception services in Ceuta, explicitly labelled "for minors," behind a false "Works at Meta" profile claim used as concealment. This is the operational bridge between "get across" and "claim unaccompanied-minor status on arrival."

·         Noureddine Ajouhraten (Tangier). The highest-amplitude ideological voice, framing the crossing as "the real referendum" against the Moroccan state — narrative normalisation rather than direct recruitment, and the single highest-engagement item in the case.

·         Marwan / Mazouk Allouss (Beni Chiker). Runs a nature-and-travel page on the Melilla fence that seeds migration engagement bait and performs the missing-persons function; posted inflated crossing statistics ("more than 1,000 swam," "+329% in four months").

·         Anwar Nordine (Khouribga). Authored an open "who's coming with me to hit the kriaj from Fnideq to Ceuta" call from an empty profile.

·         "Riteb Riteb." A deliberately locked account that, on 1 August, posted the next mobilisation date — "on the 15th something is going to happen in Fnideq" — the live 15 August forward call analysed in Section 15.

·         "Souad the American." A disposable, field-empty identity that ran a live WhatsApp funnel on 1 August using the link-in-first-comment technique.

8.6 Enabling media

Four high-reach pages carried the event without issuing recruitment calls: zoom.fnideq (213,000 followers, a Fnideq "border-city" news asset whose enforcement-status reporting is its operational value), Espana bil-Arabi (189,000, Meta-verified, an explicitly pro-Sánchez diaspora page), Elhijra News (152,000, a "media agency" with an anti-irregular-migration disclaimer over wall-scaling footage), and Hassan Vlog ⵣ (8,900, a glorification account that valorised a female swimmer's crossing with a discovery-engineered hashtag set). Golden Owl includes these as enabling media — material to reach and motivation, not to intent.

Golden Owl models the campaign as a loosely coupled, scale-free network rather than a chain of command. Three properties follow from that model, and each has an operational consequence.

9.1 No single point of failure

Because the brand generates demand and the cells are self-assembling, removing any single account degrades nothing. The load-bearing assets are not the recruiters but the two ostensibly-local news surfaces — the 213,000-follower Fnideq page and the 177,100-member flagship group — whose enforcement-status reporting is what actually enables crossings. Even those are substitutable: when groups are deleted, mirror groups appear within days, and Golden Owl observed newly created assets already operational during the July window.

9.2 Positional power versus personal reach

The actors who matter are not the ones with the largest audiences; they are the ones holding administrative position on a large surface. The clearest illustration is the "haragaceuta" operator, who has almost no personal following but holds an admin seat on a surface of many thousands. Plotting personal audience against positional reach separates the influencers (on the diagonal) from the infrastructure (far below it).

9.3 Geographic dispersion

The operators are not concentrated in Fnideq. They sit in Istanbul, in Rome-facing and Madrid-registered assets, and across northern Morocco — Casablanca, Khouribga, Tangier, Tetouan/Azla, Beni Chiker and Nador — with a nationwide catchment reaching to Agadir. This dispersion is itself a resilience feature: there is no single jurisdiction, and no single physical place, whose disruption stops the network.

9.4 The Ceuta–Melilla interchange

Golden Owl assesses the eastern (Nador→Melilla) and western (Fnideq→Ceuta) audiences as a single interchangeable pool. Melilla-branded groups carry live Ceuta traffic, and users flow to whichever enclave is reported as soft. A Ceuta-only collection scope would miss the coordination; the correct unit of analysis is the northern enclave route as a whole.

One of the most important questions for this assessment is where the campaign's infrastructure originated. Golden Owl's own investigation surfaced several independent markers of Algerian provenance attached to the brand cluster. Taken individually each is circumstantial; taken together they form a pattern too consistent to dismiss as coincidence. Golden Owl relies here only on its own markers, and draws a precise line between the brand and the individuals.

10.1 The four markers

·         The Annaba slug. The 78,000-member "ناس الغربة إسبانيا España" group is geo-registered to Madrid but carries the vanity slug allsratsannaba — Annaba, the Algerian coastal city — indicating it was built on a recycled Algerian community asset and rebranded as a Spain-migration group. Its charter references plural administrators on 24-hour rotation, a professionalised structure rather than a casual group.

·         The Haraga Dz asset. A sister asset under the same brand, "الهجرة و ناس الغربة Haraga Dz," is Algerian-labelled and circulated photographs of the young men who had entered Ceuta.

·         The Hirak anthem. The flagship administrator's mourning post (Figure 12) is soundtracked with "Ultima Verba" by Ouled El Bahdja — the ultras collective of USM Alger and one of the anthems of the Algerian Hirak protest movement. Choosing an Algerian anti-government protest anthem for a Moroccan mourning post codes the deaths as a failure of the state, in a musical vocabulary explicitly associated with demanding regime accountability.

·         The Algerian aggregator. The single largest audience touched anywhere in the case is a 269,700-member Algerian regional group that amplified the campaign's framing.

10.2 The precise reading

Golden Owl draws the line as follows. These markers attach to the brand's asset infrastructure, not to the individual operators. When the administrators themselves are examined, they resolve as Moroccan nationals with no personal Algerian affiliation: the Istanbul recruiter carries not one Algerian marker across roughly fifty memberships (his single non-Moroccan Maghreb group is Tunisian); the "haragaceuta" operator emits only Morocco→Spain/Europe content, a Moroccan flag and a +212 number. The one thread that could connect an individual to Algeria — the shared motto linking the "haragaceuta" operator to the "ناس الغربة" brand — is brand-level, not personal.

The most defensible reading is a Moroccan-run, Morocco-facing operation running on a recycled or acquired Algerian-origin asset pool. That is a genuine and material clue to origin — and the strongest structural lead in the case — while remaining, on present evidence, circumstantial rather than conclusive. Golden Owl states plainly that writing up any individual operator as an "Algerian-linked actor" would not survive scrutiny; the correct claim is that the brand carries unexplained Algerian provenance markers.

The campaign touches six countries, and their evidential weight is not equal. Golden Owl grades each link below.

Golden Owl's synthesis: the operational reality is Moroccan and Morocco-facing, the destination is Spanish, the most operationally competent recruiter staged from Turkey, and the asset infrastructure carries Algerian provenance. Italy is a single self-declared residence that the platform signals do not support. Tunisia is peripheral. The country picture is therefore best read not as a coalition of states but as a Moroccan grievance market running on mixed-provenance infrastructure, with the Algerian thread the one that most warrants onward scrutiny.

There is no single ideology across this network, and no node is affiliated with any registered party, NGO, association or institution. The economic model is audience monetisation (Section 14). Three distinct and partly antagonistic currents run through the material.

12.1 Anti-establishment populism — the dominant register

The highest-amplitude voices frame the mass crossing as a political verdict on the Moroccan state. The clearest example holds that "the mass crossing to Ceuta is the real referendum; the ballot boxes are mere decoration," attacks the government by name, and loads the event with monarchical symbolism by stressing that it fell on Throne Day. A radical fringe extends to explicit anti-monarchy content in the comment threads ("the King must be overthrown"). Golden Owl assesses this current as grievance politics, not organised opposition: it has amplitude but no structure, no membership and no programme.

12.2 Geopolitical-literacy framing — the narrative infrastructure

A distinct node circulates elite Spanish and Anglophone analysis — orchestration theories, the Algeria/Western Sahara rivalry, EU border politics, threats to suspend Schengen — supplying the post-hoc justification frame: Ceuta as geopolitics, not crime. Its function is to normalise the crossing for a mass audience by dressing it in the language of statecraft. Where it adds its own voice, the register is identitarian solidarity ("our brother").

12.3 Ghurba fatalism — the apolitical core

Against both of the above sits an apolitical worldview: emigration as destiny and providence, the state simply an obstacle to route around. This is the register of the most operational cell-builder, whose political content is effectively zero and whose religious content functions as self-justification for the crossing decision ("don't stay a weak person — make a decision") rather than as doctrine.

12.4 Cross-cutting markers

Two markers appear consistently across the currents. The first is an Amazigh cultural signature (the ⵣ glyph on the flagship admin's handle and on a glorification vlog), assessed as a northern-Morocco / Rif subcultural marker rather than organised activism. The second is "occupied Ceuta" irredentism, used as ambient editorial style across the network rather than as a fringe position, and occasionally sharpened in comment threads into "Ceuta is Moroccan" — recasting an illegal crossing as reclamation of national territory. One diaspora page carries a genuine European party alignment (pro-Sánchez, anti-far-right), the only coherent formal political line anywhere in the set.

12.5 What the ideology is not

Golden Owl states three negative findings plainly, because they close off lines of speculation. There is no jihadism, takfirism or sectarianism anywhere in the network. There is no registered organisation, funding entity or institutional email domain — only free webmail addresses. And there is no single doctrine: the currents are partly antagonistic, and the only thing they reliably share is grievance against the Moroccan state and a belief that leaving is the answer.

This section states the central judgement of the investigation. Having conducted OSINT research across the full set of identified actors — the individual administrators and recruiters, and the digital infrastructure attached to them, including the email addresses and telephone numbers Golden Owl recovered and enriched — Golden Owl assesses with high confidence that the late-July 2026 mass crossing at Ceuta was a deliberately organised, purpose-built and directed operation. It was not a spontaneous popular uprising (*harakat sha'biyya 'afawiyya*), and it was not an accidental, self-igniting social contagion. The evidence points the opposite way: to intent, to preparation, to division of labour, and to trained operational security. The remainder of this section sets out the reasoning that forces this conclusion.

13.1 The reasoning in one paragraph

A spontaneous movement leaves a spontaneous signature: a sudden, leaderless burst of raw emotion, undisciplined accounts, real names, careless contact details, no shared vocabulary, no reusable infrastructure, and no forward planning. This case shows the inverse signature at every layer Golden Owl examined. The mobilisation carried a brand and a fixed vocabulary; it ran on a rotating codeword and deliberate name-obfuscation; its operators used compartmented, single-purpose accounts and contact channels that were built to survive takedowns; recruitment was targeted and quota-based, not open and emotional; and the whole apparatus was engineered for deniability and pre-loaded with a forward call for the next wave. Each of these is a marker of design. Taken together, they are decisive.

13.2 What the recruitment posts prove — targeting, not emotion

The single clearest tell that this was organised is the shape of the recruitment itself. A spontaneous crowd does not specify who may join it. This network did — repeatedly and precisely:

·         One recruiter published a call for a vetted cell of "two girls and six boys" (زوج بنات و ستة اولاد) — an explicit gender ratio and headcount for a single crossing party. That is casting, not a crowd. Selecting the composition of a group by sex and number is a hallmark of a managed operation that is optimising each cell for a specific crossing method and a specific risk profile.

·         The same operator ran a parallel post to assemble a "large group" (مجموعة كبيرة) for the crossing — an explicit call to aggregate strangers into a purpose-built party, again moving the follow-up into private channels.

·         Across the network, the recruitment consistently profiles the desired entrant: young, physically able, willing to move on a fixed date, and routed off-platform for vetting. This is a selection funnel, not a wave of feeling.

Targeting of this kind requires a coordinator who knows what the crossing needs and screens applicants against it. Golden Owl assesses the presence of explicit quota-and-composition recruitment as direct behavioural evidence of organisation: it is not something a leaderless, self-igniting crowd produces.

13.3 What the accounts and contact infrastructure prove — trained operational security

Golden Owl's OSINT work on the individual actors, their email addresses and their telephone numbers returned the same finding from a different direction: these operators were trained in how to conceal themselves, and they built several layers of self-protection into their presence. That level of tradecraft is incompatible with spontaneity. The recovered indicators include:

Golden Owl does not publish the specific email addresses or telephone numbers (see Section 3.3 on responsible redaction), but records that they were found, examined and enriched, and that what they revealed was a multi-layered concealment posture: operational identity separated from personal identity, contact channels separated from geography, and public messaging separated from operational messaging. When operators go to that much trouble to be hard to attribute, the correct inference is not that the event was accidental — it is that someone expected it to be investigated and prepared accordingly.

13.4 The administrator layer — cover, not coincidence

Golden Owl examined the administrators of the network's largest nodes and reached the same conclusion. The administrators do not behave like accidental community moderators who were overtaken by events. They cover themselves — through the same name-obfuscation and account-compartmentation described above — and they interconnect: the same operators recur across multiple large groups, push identical content into several 50,000-member communities simultaneously, and sit at the hinge points between the closed core and the public surface. This is the profile of a managed distribution system with designated operators, not of a spontaneous crowd that happened to find each other. The consistency of the concealment behaviour across independent administrators is itself evidence of a shared playbook — i.e. of training and coordination.

13.5 Forward planning defeats the "spontaneous" reading outright

A spontaneous event ends when the emotion that produced it burns out. This network did the opposite: before the July wave had even finished, it pre-positioned the next one. A dated forward call for 15 August 2026 was published into a 108,000-member group and left live. Scheduling a follow-on mobilisation is planning; planning is organisation. A self-igniting popular movement does not issue itself a calendar invitation for its own sequel.

13.6 Ruling out the alternative explanations

Golden Owl explicitly considered and rejected the spontaneous-movement hypothesis:

·         "It was just desperate young people who self-organised." Desperation is real and is the fuel the operation burns — but fuel is not the engine. The quota-based casting, the synchronised codeword, the compartmented infrastructure and the forward call are all upstream of any individual crosser's desperation. They are supplied by operators, not by the crowd.

·         "It went viral by accident." Virality is present, but it is downstream of a deliberately seeded call and a purpose-built amplifier layer. The core call was manufactured and injected; the crowd amplified it. Amplification is not origination.

·         "There is no leader, so there is no organisation." The absence of a single named leader is by design, not by accident. A horizontal, brandless, marketplace structure with interchangeable operators is a deliberate organisational form chosen for resilience and deniability — it is more organised than a simple hierarchy, not less.

13.7 The bottom line

Golden Owl's conclusion is unambiguous. Every independent line of evidence developed in this investigation — the targeted, quota-based recruitment; the trained, multi-layered operational security found across the actors, their email addresses and their telephone numbers; the self-concealing, interconnected administrator layer; the branded, coded, deniable network design; and the pre-planned forward call — converges on the same judgement. This was a purposeful, directed, organisation-based operation. It was not spontaneous, not accidental, and not an organic popular movement. The people who built it knew how to hide, knew whom they wanted to move, and knew they would be looked for. That is the definition of an organised operation, and Golden Owl assesses it as such with high confidence.

Golden Owl treats the economic layer as a first-class part of the network, because it is the only motive for which the case holds direct evidence and because it explains the network's persistence between crossing waves.

14.1 The free layer and the paid layer

Two economies run in parallel. The free layer is the recruitment and glorification content, monetised indirectly through audience growth: nearly every operational account runs in "Professional Mode," farms engagement with follow-loops and reaction-bait, and converts the crossing wave into follower growth and ad-eligible reach. The paid layer is a genuine smuggling marketplace running inside the same groups: open brokerage adverts ("guaranteed for 2, leave a comment"), solicitations from defrauded migrants seeking "an honest person to get us out," and a reported street tariff — brokers collecting youths from Casablanca, Fez and Beni Mellal and charging a few hundred dirhams to deliver them to Ceuta, then abandoning them.

14.2 The attention economics

The reach paradox (Section 7.4) is, at bottom, an economic fact. The glorification and news content vastly out-earns the recruitment content in the only currency the platforms pay out: attention. A single viral reel can carry more reach than every recruitment thread in the case combined. This is why the enabling-media pages are the network's true centre of gravity — they are where the money is, and the recruitment layer is a cheap, high-risk appendage attached to a lucrative, low-risk one.

14.3 The exploitation risk

Golden Owl flags an exploitation dimension that the monetisation frame makes visible. The same groups that carry recruitment also carry commercial sex advertising and missing-person appeals, and at least one vetted cell explicitly included women. A network that monetises migration intent, channels minors and women, and runs alongside a paid smuggling marketplace carries a trafficking-adjacent risk that a purely "digital incitement" framing would understate.

Golden Owl assesses recurrence as likely. The model is cheap, repeatable and resilient: it requires only a brand, a coordination channel, a public broadcast surface and proof-of-success footage, and it regenerates cells faster than enforcement can remove operators.

15.1 The live forward call

The most immediate indicator is a live forward call. On 1 August a deliberately locked account posted, into a 108,000-member group, that "on the 15th something is going to happen in Fnideq" — a mobilisation call for 15 August 2026. The account's locked state suggests deliberate operational hygiene rather than an ordinary member, and the comment thread beneath it is the fastest route to the successor cell's membership. Golden Owl records this call as live and unaddressed.

The 15 August forward call:  https://www.facebook.com/groups/1193176511655298/posts/1843492169957059/

15.2 Leading indicators to monitor

·         Sudden creation of new mirror groups after takedowns (already observed).

·         Rotation of the coded vocabulary and character-splitting of keywords to evade moderation.

·         Re-emergence of proof-of-success footage and enforcement-status reporting on the flagship nodes.

·         Activity spikes on the Fnideq-strip local groups that serve as the physical staging channel.

·         Re-appearance of the escalation / retaliation hashtag vector, which is the most dangerous single development because it points at violence rather than crossing.

15.3 Scenarios

Golden Owl offers three forward scenarios for the 15 August window and beyond.

The through-line across all three is that the brand survives the outcome. Whether the 15 August call succeeds, fails or is displaced, the infrastructure that issued it remains, and the next date will follow.

The late-July 2026 Ceuta crossing was an organised, advertised, distributed campaign — not an accident and not a spontaneous surge. It was issued under a shared brand from a closed coordination core, amplified across a public Facebook surface of roughly one million disclosed memberships and a further half-million-plus in amplifier pages, and executed by dozens of self-assembling cells built by individually motivated micro-recruiters who monetise the same audience they mobilise. Its operators sit in Istanbul, in Rome-facing and Madrid-registered assets, and across northern Morocco. Its ideology is grievance, not doctrine. Its infrastructure carries consistent Algerian-origin markers that Golden Owl assesses as the single strongest lead to who ultimately benefits — while the individual operators resolve as Moroccan nationals.

Golden Owl's controlling judgement is unchanged from the first line of this report: there is no leader; there is a brand and a marketplace. That is why the network is dangerous, why it is resilient, and why it will recur.

For onward monitoring, Golden Owl recommends keying the watch-list on numeric group IDs rather than names, because the coded vocabulary rotates faster than the venues do.

This report is the product of Golden Owl's own open-source collection and analysis of publicly accessible social-media assets and associated identifiers. Findings are presented as Golden Owl assessments, with confidence language applied throughout. In keeping with responsible-publication practice, personal contact identifiers (telephone numbers, email addresses) are described rather than reproduced, and only a limited set of public group and post links is included for evidential reference. Figures and charts in this document were generated programmatically from Golden Owl's structured case data. Screenshots reproduced in this document were captured by Golden Owl; additional screenshots held on file can be inserted as required.