What was initially portrayed as a spontaneous wave of despair turns out, in light of a rigorous investigation using open-source intelligence (OSINT) methods, to have been a carefully orchestrated operation of influence, disinformation, and tactical agitation. The mass assault on the borders of the enclaves of Ceuta and Melilla relied on a highly structured digital infrastructure. At the geographic and operational center of this scheme lies a clear strategic hub: a command node operated through telephone lines registered under the international dialing code +213, corresponding to Algeria. The report prepared by intelligence analyst José María Gil Garre details how this actor exploited social media to orchestrate a physical assault on an unprecedented scale.
The analysis draws a fundamental distinction between the channels that merely amplified the campaign and the group managed from Algerian territory. While most social media profiles sought little more than visibility or “likes,” the administrator operating under the +213 country code was entrusted with a strictly tactical and operational mission.
This actor directly managed a WhatsApp messaging channel entitled “سبتة كرياج هجمة” (Hijma Kiraj Sebta / “Assault to Cross into Ceuta”), first identified on July 28, 2026. Later, when Moroccan and Spanish security forces sealed access to Ceuta, the same administrator reacted immediately by launching, on July 31, 2026, a second strategic channel called “هجمة” (Hijma / “Assault”), specifically intended to redirect the operation toward the enclave of Melilla.
Rather than merely circulating images or issuing general calls to action, the administrator operating under the Algerian country code provided what amounted to operational instructions for organization and urban confrontation. Among other directives, participants were instructed to split into micro-cells and small operational groups in order to bypass roadblocks and evade police screening more easily. The administrator also imposed precise timing by ordering the assault to begin immediately after the final evening prayer (Isha). Participants were further instructed to switch off their mobile phones during the night of the operation to prevent geolocation or interception, while psychological conditioning was used to strengthen their resolve to overwhelm security barriers through numerical saturation.
Read also : How the rush to Ceuta shattered the illusion of a European Eldorado
The operation unfolded through a five-phase chronological sequence.
The first phase, devoted to constructing the initial narrative between July 8 and July 15, 2026, began with the manipulation of a judicial ruling. Taking advantage of a decision handed down by Spain’s Supreme Court on July 8, 2026, the propaganda apparatus deliberately distorted the ruling on maritime pushbacks, transforming it into a viral piece of false information claiming that the border had effectively been opened by law and that security forces were no longer permitted to carry out immediate returns.
The second phase, spanning July 15 to July 25, shifted the operation into a stage of large-scale amplification across social media, led by TikTok and Facebook. These platforms were flooded with detailed maritime maps, precise swimming routes from the localities of Belyounech and Fnideq, and extensive logistical guidance on the diving equipment required.
The third phase, between July 28 and July 30, marked the activation of the Algerian +213 command node and the decisive intervention of its operators. The launch of the WhatsApp group administered under the +213 country code enabled the dissemination of direct tactical instructions, culminating in an order for a mass gathering in Fnideq during the night of July 30–31.
The fourth phase materialized that same night in the form of a violent physical assault.
The fifth phase, from July 31 to August 2, saw the Algerian network demonstrate remarkable tactical adaptability as the Ceuta route began to collapse. By immediately creating the Hijma Melilla group, the administrator attempted to circumvent the security response by redirecting migratory pressure toward Melilla.
WhatsApp conversation screenshots captured on July 31 confirm this shift within the group entitled “هجمة للكراج نحو مليلية”. The effectiveness and resilience of the campaign rested on a carefully defined division of roles among the various digital platforms within this specialized ecosystem.
Under the direct control of the administrator using the Algerian +213 number, WhatsApp functioned as the command center, coordinating logistics and distributing operational orders in real time. TikTok, for its part, served as the principal instrument of psychological warfare and recruitment. Through particularly active accounts such as @haragaa_ceuta1, directly linked to an Algerian-registered phone number, and @haragama00 (Haraga El Ghorba), the platform amassed nearly seven million views by distributing motivational videos designed to recruit young people.
Read also : How a Spanish court ruling helped trigger the Ceuta migration crisis
At the same time, Facebook hosted at least five major groups bringing together more than 250,000 members, functioning as logistical marketplaces where diving equipment, neoprene suits, and information on police patrols were exchanged. Instagram, meanwhile, provided visual validation through social proof, relying on specialized accounts such as @magog_i and @ceu.ta_haraga to circulate images of successful crossings and sustain the illusion of success.
The analysis concludes that TikTok served as the campaign’s primary mechanism for mass amplification, notably through the account linked to the Algerian phone number, which published assault videos accompanied by the slogan “The border is not the end,” while the Haraga El Ghorba profile alone generated nearly seven million views.
In his overall assessment, analyst José María Gil Garre states with a high degree of confidence that there is material evidence of a planned tactical coordination campaign, a functional specialization among the various digital channels, and the effective location of the administrator operating under the +213 telephone prefix. This is in addition to the demonstrated ability of this Algeria-based actor to redirect the assault from Ceuta toward Melilla in less than 24 hours.
The investigation concludes that the Spanish and Moroccan borders became the theater of a distributed hybrid warfare operation. The documented use of Algeria’s telecommunications network and territory to direct the assaults remotely constitutes a major security threat and demonstrates the existence of highly structured digital interference.
