techlist.io
KREN
cloudflare

What we know about Iran’s Internet shutdown (opens in new tab)

dnsbgpipv6quiccloudflare-radarhttp3network-monitoringinternet-shutdown

Iran’s government effectively disconnected the country from the global Internet on January 8, 2026, amid escalating nationwide protests. Cloudflare observed a near-total loss of traffic after major Iranian networks withdrew most announced IPv6 address space and then lost connectivity almost entirely. Brief access windows on January 9 quickly ended, and the shutdown remained in place through January 10.

Background and Earlier Shutdowns

  • Iran has previously restricted Internet access during protests:
    • More than five days of disruption followed fuel-price protests in November 2019.
    • Connectivity was disrupted across multiple providers during protests after Mahsa/Zhina Amini’s death in September 2022.
  • Internet traffic had already been below normal at the beginning of 2026, suggesting connectivity problems preceded the complete shutdown.

Connectivity Collapsed on January 8

  • At 11:50 UTC, Iranian networks reduced announced IPv6 address space by 98.5%, from over 48 million /48 blocks to roughly 737,000.
  • This caused IPv6’s share of human-generated traffic to fall from about 12% to 2%, before IPv6 traffic nearly disappeared later that afternoon.
  • Between 16:30 and 17:00 UTC, overall traffic dropped by nearly 90%.
  • Major providers affected included:
    • MCCI (AS197207)
    • IranCell (AS44244)
    • TCI (AS58224)
  • By approximately 18:45 UTC, traffic from Iran had fallen effectively to zero, indicating a nationwide disconnection from the global Internet.

Brief Connectivity on January 9

  • Internal traffic remained below 0.01% of pre-shutdown peaks.
  • Access to Cloudflare’s 1.1.1.1 DNS resolver briefly returned around 10:00 UTC, producing a short-lived spike in requests.
  • Several universities also regained connectivity temporarily, including the University of Tehran, Sharif University of Technology, Tehran University of Medical Science, and Tarbiat Modares University.
  • Traffic from these networks disappeared again by roughly 15:00 UTC.

Filtering Changes Before the Shutdown

  • HTTP/3 and QUIC usage declined sharply before the full outage.
  • On IranCell, HTTP/3 usage fell from as high as 40% to 5% by December 31 and continued declining.
  • On TCI, HTTP/3 dropped below 5% around January 3.
  • These changes may indicate increasingly severe filtering and upgraded whitelisting, according to MahsaNet.

Ongoing Disconnection

  • Since January 10, Iran’s Internet traffic has shown no significant recovery.
  • Traffic remains at only a fraction of one percent of previous levels.
  • Cloudflare continues monitoring the situation through Radar’s traffic and routing data.

The available measurements strongly indicate a deliberate, nationwide Internet shutdown rather than an ordinary network failure. Cloudflare Radar’s traffic and routing pages provide the most practical way to follow any restoration or further changes.