In late December 2025, widespread protests erupted across multiple Iranian cities. These demonstrations, initially driven by frustration over inflation, food prices, and currency devaluation, evolved into calls for a change in the country’s leadership. Subsequently, Internet traffic from Iran has effectively ceased, a phenomenon observable in Cloudflare Radar data.
Background
The Iranian government has a history of imposing Internet shutdowns during periods of civil unrest. For instance, in November 2019, a significant increase in fuel prices triggered protests, leading the government to implement an Internet shutdown that lasted over five days. Similarly, in September 2022, protests and demonstrations swept across Iran following the death in police custody of Mahsa/Zhina Amini, a 22-year-old woman. This event resulted in disruptions to Internet services across various network providers in the subsequent days. Leading up to the current protests, lower traffic volumes were observed at the beginning of the year, hinting at potential connectivity issues before the more severe shutdown.
Internet connectivity in Iran plummeted on January 8
While some traffic anomalies were noted in early 2026, peak traffic levels recovered by January 5 and even surpassed expected volumes in the days that followed. However, this recovery was short-lived. On January 8, IPv6-related shifts provided the first indication of impending changes. At 11:50 UTC (15:20 local time), the amount of IPv6 address space announced by Iranian networks decreased by 98.5%, dropping from over 48 million /48s to just over 737,000 /48s. A significant reduction in announced IP address space, whether IPv6 or IPv4, signifies that networks are no longer broadcasting how to reach those addresses. Such a major drop can indicate an intentional disruption to Internet connectivity, as the path to clients or servers using those IP addresses is severed.
This reduction in announced IPv6 address space caused IPv6’s share of human-generated traffic to fall from approximately 12% to about 2%. This decline in IPv6 traffic remained relatively consistent for roughly 100 minutes before experiencing a further drop just before 13:30 UTC (17:00 local time), leading to the near disappearance of IPv6 traffic from Iran.
Several hours later, overall traffic levels from the country began to rapidly decline. Between 16:30 – 17:00 UTC (20:00 – 20:30 local time), traffic volumes plummeted by nearly 90%, primarily due to a loss of traffic from major Iranian network providers, including MCCI (AS197207), IranCell (AS44244), and TCI (AS58224).
Around 18:45 UTC, Internet traffic from Iran effectively reached zero, indicating a complete shutdown within the country and a disconnection from the global Internet.
Brief windows of connectivity on January 9 — but they don’t last
Following the previous day’s shutdown, internal traffic data revealed an extremely low volume of traffic from Iran, less than 0.01% of pre-shutdown peaks, beginning around 10:00 UTC (13:30 local time) on January 9. Access to Cloudflare’s public DNS resolver, 1.1.1.1, also appeared to be restored around the same time, causing request traffic to briefly surge above the expected range. However, after this spike, only a minimal amount of request traffic to 1.1.1.1 remained.
Several Iranian universities also experienced temporary restoration of connectivity, starting around 11:30 UTC (15:00 local time). These included University of Tehran Informatics Center (AS29068), Sharif University of Technology (AS12660), Tehran University of Medical Science (AS43965), and Tarbita Modares University (AS57745). The intentionality of this restoration is unclear, but traffic from these networks became non-existent again after 15:00 UTC (18:30 local time).
Changes in HTTP traffic preceded the Internet shutdown
In addition to the lower traffic levels observed at the start of the year, a distinct shift in HTTP version usage from human-generated traffic was noted across leading network providers. Previously, up to 40% of HTTP requests on IranCell (AS44244) utilized HTTP/3, but this figure dropped to just 5% by 20:00 UTC (23:30 local time) on December 31 and continued to decline in subsequent days. QUIC usage from the network followed a similar pattern, as it relies on HTTP/3.
On TCI (AS58224), HTTP/3 also accounted for as much as 40% of requests at its peak, but gradually decreased from January 1, falling below 5% starting around 07:00 UTC (10:30 local time) on January 3. QUIC usage on this network also showed a similar trend. MahsaNet, an organization dedicated to combating Internet censorship in Iran, suggested that these shifts might indicate that “Severe filtering and layered, upgraded whitelisting are clearly evident and being implemented” (translation via X).
The shutdown continues
No significant changes have been observed in Iran’s Internet traffic since January 10. The country largely remains cut off from the global Internet, with internal data indicating traffic volumes are still a mere fraction of previous levels. The state of Internet connectivity in Iran continues to be monitored, with updates posted on social media accounts. Cloudflare Radar’s Traffic and Routing pages for Iran, along with insights into the top networks within the country, provide near-real-time metrics.
