cloudflareAug 13, 2026

Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal (opens in new tab)

The August 12, 2025 total solar eclipse caused a measurable, temporary decline in Internet activity across Europe. Cloudflare Radar data shows that HTTP traffic dropped most sharply when the eclipse reached maximum obscuration, especially in countries along the path of totality. Traffic generally returned to normal within minutes as people resumed using their devices. ## Traffic Drops Matched Eclipse Timing - Cloudflare analyzed HTTP requests in five-minute intervals across affected countries. - Traffic reductions aligned closely with each location’s moment of maximum eclipse. - The strongest declines occurred in Iceland, Ireland, the UK, France, Spain, and Portugal. - Countries with only shallow partial eclipses, including Sweden, Denmark, Poland, and Switzerland, saw little or no decline. - Regions experiencing deep eclipses recorded traffic drops of roughly 15% to 30%. - Traffic typically rebounded shortly after maximum obscuration. ## Eclipse Depth Predicted Internet Activity - Researchers compared each country’s peak solar obscuration with its average traffic change during the surrounding 15-minute window. - The results showed a clear downward relationship: greater obscuration generally produced larger traffic declines. - Local factors such as population density, cloud cover, and time of day caused some variation, but the precise timing supported the eclipse as the primary cause. - Solar obscuration was calculated geometrically using the apparent sizes and positions of the sun and moon, measuring how much of the sun’s disk was covered every five minutes. ## Iceland, Spain, and Portugal Saw the Largest Declines - Country-level traffic changes ranged from a 9.3% increase to a 46.7% decrease. - Iceland, Spain, and Portugal experienced the most dramatic reductions. - Norway and Sweden saw slight increases above normal levels. - Denmark experienced the smallest overall change, while Poland quickly returned to baseline. - Eclipse-day traffic was compared with the median traffic from the three previous Wednesdays, using matching times of day to reduce the effect of unusual weekly patterns. ## Physical Events Reshape Digital Behavior - The findings show that Internet traffic reflects where people direct their attention. - The eclipse reduced online activity because people temporarily stopped using their devices to observe it, not because of technical network problems. - Traffic normalized quickly afterward, demonstrating how a shared real-world event can create a continent-wide but short-lived shift in digital behavior. - Cloudflare Radar can be used to study similar changes during major global events.

cloudflare-radardata-visualizationstatistical-analysishttp+2

cloudflareJul 28, 2026

Natural disasters and government interference: examining Q2 2026’s major Internet disruption event (opens in new tab)

Cloudflare’s Q2 2026 outage review shows how dependent Internet connectivity remains on physical infrastructure, government policy, and complex technical systems. Disruptions ranged from typhoons, earthquakes, and power failures to shutdowns, war-related data-center damage, DNSSEC errors, and submarine cable cuts. Despite these failures, regional networks generally remained resilient, with Cloudflare Radar revealing both the scale and distinctive patterns of each outage. ### Natural Disasters and Power Failures - Super Typhoon Sinlaku passed north of Guam in April, causing power and water disruptions. - Internet traffic fell as much as 80% below expected levels on April 13–14. - Two earthquakes in northern Venezuela on June 24 produced an immediate drop in HTTP traffic. - The decline was especially visible at Fibex Telecom, CANTV, and VNET. - A nationwide power outage in Tanzania on June 27 caused Internet traffic to collapse for at least five hours. - These events demonstrate that storms, earthquakes, and electricity failures can produce similar connectivity impacts, reinforcing the need for redundancy in power, routing, and physical network paths. ### Government Shutdowns and Geopolitical Conflict - Iran began restoring Internet access on May 26 after an 88-day near-total blackout. - Traffic initially recovered to about 40% of pre-outage levels, later reaching 90% before settling near 59%. - Connectivity returned closer to the country’s recent pre-shutdown baseline, rather than fully normal levels. - AWS’s `me-central-1` region in the UAE continued to experience reduced traffic after drone strikes damaged infrastructure in the UAE and Bahrain. - The disruption affected applications hosted in the region even when those applications themselves remained operational. - Iraq imposed three exam-related shutdowns, while Sudan imposed ten. - Sudan’s outages generally lasted about 3.5 hours. - Iraq’s shutdowns lasted roughly 90 minutes. - These incidents illustrate how governments can deliberately switch off, throttle, or selectively restore national connectivity. ### DNSSEC Failure in Germany - On May 5, a DNSSEC key rollover at DENIC caused invalid signatures for Germany’s `.de` domain. - DNS resolvers validating DNSSEC rejected `.de` responses and returned `SERVFAIL`, making affected websites unreachable worldwide until service was restored at 23:15 UTC on May 5. - Cloudflare observed an increase in `.de` queries because failed responses could not be effectively cached, forcing repeated lookups and retries. - Users experienced the incident as widespread website unavailability rather than as an obvious cryptographic or DNS problem. ### Cable and Infrastructure Vulnerabilities - A submarine cable cut in Saint Lucia further demonstrated how regional connectivity can depend on a small number of physical links. - Together with the German DNSSEC failure, the incident shows that routine infrastructure maintenance and single physical-path failures can have effects far beyond the location where the fault occurs. Cloudflare’s findings underline the importance of network redundancy, careful operational procedures, and continuous monitoring. Internet outages may have very different causes, but their effects on users can look remarkably similar: sudden loss of access to communication, applications, and essential information.

cloudflare-radarawsdnssecinternet-infrastructure+3

cloudflareJul 21, 2026

How the 2026 World Cup affected Internet traffic (opens in new tab)

The 2026 World Cup demonstrated how a rare shared global event can reshape Internet behavior across countries. Cloudflare used traffic data from its global network to show that match timing, teams, and major storylines significantly affected online activity. Overnight matches often doubled traffic, while games during normal active hours could reduce browsing as people focused on watching. ## Measuring “Normal” Internet Activity - Cloudflare established a baseline using the median traffic from the previous four weeks. - Traffic changes were expressed as a log₂ ratio: - `0` means normal activity. - `+1` means traffic doubled. - `−1` means traffic fell to half its normal level. - This approach made traffic changes comparable between high-volume and low-volume countries. ## Kickoff Time Shaped Online Behavior - The largest traffic changes occurred during matches played between midnight and 8 a.m. local time. - Fans staying awake or waking early caused traffic to rise well above normal, sometimes by more than 2x. - Daytime matches had little effect because viewers were likely already online. - Evening matches produced a smaller increase on weekdays, but could also cause traffic to fall when people stopped browsing to watch. - In Bosnia and Herzegovina: - A 2 a.m. match caused traffic to more than double. - An evening match reduced traffic to roughly 70% of normal. - Brazil and Japan showed opposite patterns during the same match: - Japan’s overnight viewing produced traffic around twice its usual level. - Brazil’s daytime match coincided with traffic about 40% below normal. ## Matches With the Greatest Global Impact - Cloudflare measured traffic during the two hours after kickoff. - For each match, it calculated the absolute deviation from normal across countries and then used the median result. - Simultaneous matches were excluded because their effects could not be reliably separated. - The most impactful match was Argentina vs. Switzerland, with traffic changing by a factor of about 1.26. - France vs. Spain followed at 1.21. - The highest-impact games included quarterfinals, knockout matches, and some round-of-32 games—not only the final or semifinals. ## Argentina Led the Teams Drawing Global Attention - Argentina produced the largest average worldwide traffic impact, at 1.17x normal activity. - France, Brazil, Portugal, Morocco, Spain, and Norway also ranked highly. - Argentina’s appeal was linked to its status as defending champion and the possibility that the tournament could be Lionel Messi’s final World Cup. - Haiti and Iraq appeared as outliers because matches involving major teams caused especially large changes relative to their usual traffic levels. ## More Traffic to Sports Betting Websites - Requests to gambling-related websites increased after the tournament began compared with the preceding month. - Before the World Cup, betting traffic followed a regular weekly cycle. - Once matches began nearly every day, that weekly pattern flattened into a more consistent level of activity. Overall, the data shows that the World Cup affected Internet use in two distinct ways: inconvenient kickoff times brought previously offline fans online, while matches during normal usage hours often diverted people away from their usual browsing. For analyzing global events, normalized, country-by-country traffic measurements provide a clearer picture than raw request volumes alone.

cloudflare-radardnsdata-analysishttp-traffic+2

cloudflareMay 27, 2026

Iran's Internet is partially restored, Cloudflare Radar data shows (opens in new tab)

Cloudflare Radar data indicates that Iran’s Internet access began a partial restoration on May 26, after nearly three months of near-total shutdown following the February 28 military strikes. Traffic and DNS activity increased significantly, but remained far below normal levels, and the recovery could still be temporary. IPv6 connectivity remains effectively absent. ## Iran’s Two Internet Shutdowns - The first nationwide shutdown began on January 8, with traffic falling nearly to zero. - Limited connectivity briefly returned on January 21 and January 25 before recovering more substantially on January 27. - A second shutdown began on February 28 as military strikes escalated. - Traffic dropped to less than 1% of previous levels and stayed there for nearly three months. ## Signs of Partial Restoration - Around 11:00 UTC on May 26, Cloudflare observed sharp increases in traffic and DNS queries. - Transferred data briefly spiked at 11:45 UTC and then rose steadily from 12:00 UTC. - Traffic reached roughly 15 times the levels recorded during the previous week. - Activity followed expected daily patterns, declining around 21:00 UTC before rising again the following morning. - Increased DNS queries suggested that more users were successfully attempting to access websites and online services. ## Tehran and Major Providers Lead the Recovery - Tehran accounted for 91.6% of HTTP requests during the increase. - Other regions experienced only modest gains. - Traffic increased across several major providers, including: - TCI - IranCell - RighTel - MCCI ## Connectivity Remains Well Below Normal - Peak traffic on May 26 reached only about 40% of the maximum activity recorded in 2026 before the disruptions. - Future measurements will determine whether connectivity returns to pre-shutdown levels. - The January shutdown demonstrated that temporary restorations can quickly disappear. ## IPv6 Is Still Unavailable - Announced IPv6 address space from Iran remains effectively at zero. - IPv4 announcements have stayed relatively stable throughout both shutdowns. - This contrast suggests the disruptions were likely implemented through mechanisms such as application filtering or whitelisting rather than by withdrawing IPv4 routes from global networks. The data supports cautious optimism: Iranian users are regaining some Internet access, particularly in Tehran and through major providers, but service remains incomplete and potentially unstable. Continued monitoring is necessary to determine whether this is a lasting restoration.

cloudflare-radardnsipv6ipv4+3

cloudflareJan 13, 2026

What we know about Iran’s Internet shutdown (opens in new tab)

Iran’s government effectively disconnected the country from the global Internet on January 8, 2026, amid escalating nationwide protests. Cloudflare observed a near-total loss of traffic after major Iranian networks withdrew most announced IPv6 address space and then lost connectivity almost entirely. Brief access windows on January 9 quickly ended, and the shutdown remained in place through January 10. ## Background and Earlier Shutdowns - Iran has previously restricted Internet access during protests: - More than five days of disruption followed fuel-price protests in November 2019. - Connectivity was disrupted across multiple providers during protests after Mahsa/Zhina Amini’s death in September 2022. - Internet traffic had already been below normal at the beginning of 2026, suggesting connectivity problems preceded the complete shutdown. ## Connectivity Collapsed on January 8 - At 11:50 UTC, Iranian networks reduced announced IPv6 address space by 98.5%, from over 48 million `/48` blocks to roughly 737,000. - This caused IPv6’s share of human-generated traffic to fall from about 12% to 2%, before IPv6 traffic nearly disappeared later that afternoon. - Between 16:30 and 17:00 UTC, overall traffic dropped by nearly 90%. - Major providers affected included: - MCCI (AS197207) - IranCell (AS44244) - TCI (AS58224) - By approximately 18:45 UTC, traffic from Iran had fallen effectively to zero, indicating a nationwide disconnection from the global Internet. ## Brief Connectivity on January 9 - Internal traffic remained below 0.01% of pre-shutdown peaks. - Access to Cloudflare’s `1.1.1.1` DNS resolver briefly returned around 10:00 UTC, producing a short-lived spike in requests. - Several universities also regained connectivity temporarily, including the University of Tehran, Sharif University of Technology, Tehran University of Medical Science, and Tarbiat Modares University. - Traffic from these networks disappeared again by roughly 15:00 UTC. ## Filtering Changes Before the Shutdown - HTTP/3 and QUIC usage declined sharply before the full outage. - On IranCell, HTTP/3 usage fell from as high as 40% to 5% by December 31 and continued declining. - On TCI, HTTP/3 dropped below 5% around January 3. - These changes may indicate increasingly severe filtering and upgraded whitelisting, according to MahsaNet. ## Ongoing Disconnection - Since January 10, Iran’s Internet traffic has shown no significant recovery. - Traffic remains at only a fraction of one percent of previous levels. - Cloudflare continues monitoring the situation through Radar’s traffic and routing data. The available measurements strongly indicate a deliberate, nationwide Internet shutdown rather than an ordinary network failure. Cloudflare Radar’s traffic and routing pages provide the most practical way to follow any restoration or further changes.

cloudflare-radardnsbgpipv6+4

cloudflareJan 6, 2026

A closer look at a BGP anomaly in Venezuela (opens in new tab)

The post examines a January 2 BGP anomaly involving Venezuela’s CANTV network (AS8048). Although the event prompted speculation about government-directed surveillance, the broader pattern—eleven leaks since December—more strongly suggests inadequate BGP import and export filtering. The affected routes, provider-customer relationships, and heavy AS-path prepending are consistent with a configuration or operational error rather than clear malicious activity. ## Background: How BGP Route Leaks Work - BGP directs traffic between autonomous systems (ASes) according to business relationships: - **Customer-provider:** Providers advertise broad Internet routes to customers; customers advertise their own and downstream routes. - **Peer-peer:** Networks exchange their own and customer routes without payment. - These rules produce “valley-free” paths, where traffic generally moves from customers toward providers and then back down toward customers. - A **route leak**, formally defined in RFC 7908, occurs when routing announcements are propagated beyond their intended scope. - A typical leak happens when a customer receives routes from one provider and incorrectly advertises them to another provider, causing traffic to take an inefficient or overloaded path. ## The AS8048 Route Leak - Cloudflare Radar identified AS8048, operated by Venezuelan ISP CANTV, as the leaking network. - CANTV learned routes from AS6762, Italian telecom Sparkle, and redistributed them to AS52320, Colombia’s V.tal GlobeNet. - The leaked prefixes were originated by AS21980, Dayco Telecom, and belonged to the same `200.74.224.0/20` subnet. - Since AS8048 appears to be a provider for AS21980, the leak may reflect incorrect route export policies involving a customer’s prefixes. - The post emphasizes that route leaks are common and are usually caused by mistakes or weak routing controls rather than deliberate attacks. ## Evidence from Routing Relationships - Cloudflare Radar, bgp.tools, and BGPKIT data all indicate a provider-customer relationship between AS8048 and AS21980. - BGPKIT’s relationship analysis showed: - AS8048 was identified as the upstream provider in 9.4% of observations. - AS21980 was almost never identified as upstream. - Although only 9.9% of route collectors saw the two ASes as directly adjacent, the available paths strongly supported AS8048 being AS21980’s provider. ## Significance of AS-Path Prepending - Many leaked routes included repeated instances of AS8048 in their paths. - AS-path prepending is normally used to make a route less attractive and shift traffic away from a particular connection. - A path such as `52320,8048,8048,8048,...,21980` does not mean traffic physically traversed AS8048 repeatedly; the repeated entries are routing-policy padding. - The heavy prepending would have made the leaked routes less preferred, which weakens the case that AS8048 was intentionally trying to attract large volumes of traffic for interception. - The available evidence therefore points more toward poor routing configuration or operational practice than a purposeful man-in-the-middle operation. CANTV’s repeated route leaks and apparent lack of effective routing policies should still be treated as a serious reliability and security concern. However, the post’s evidence supports interpreting this incident as an example of recurring BGP misconfiguration unless further data demonstrates intentional manipulation.

cloudflare-radarbgpautonomous-systemsinternet-routing+4