Internet and Airstrikes: Tracking Iran's Extended Communication Blackout
Summary
In this post, we use Kentik’s traffic statistics to dig into the ongoing internet shutdown in Iran, which began within hours of American and Israeli airstrikes on February 28. This is the second shutdown of the year for Iran and its worst in history. Despite the shutdown, a small amount of whitelisted traffic continues to flow in and out of the country. Using our unique traffic data, we visualize changes within this residual traffic in recent days as the government cracks down on Iranians sharing access to these precious holes in the digital blindfold.
Within hours of the first American and Israeli airstrikes on February 28, Iran’s internet went dark for a second time this year. As with the nationwide outage in January, Iran’s government once again ordered an internet blackout that, at the time of writing, has persisted for more than two weeks.
This post summarizes how we observed the events affecting internet connectivity in Iran so far this year.
A difficult year
2026 has been a profoundly challenging year for the people of Iran. In response to widespread protests over deteriorating economic conditions, Iran shut off nearly all communication services — to include domestic and international internet connectivity on January 8. The shutdown coincided with a brutal crackdown that left thousands of Iranians dead.
Our traffic statistics, based on aggregate NetFlow, revealed that traffic began to slowly come back on January 18, increasing in phases until it reached a new normal of partial restoration on January 27, as depicted below. During that time, the censorship circumvention tool Psiphon reached over four million daily users.
From January 27 to February 28, Iranian connectivity was in a state of partial recovery. Many services were unreliable, and blockages were sporadic and unpredictable. On February 15, we observed a BGP leak, of all things, briefly knocking out a portion of internet connectivity across the country.
During this time, our traffic data identified evidence of disconnections as otherwise smooth traffic curves became jagged during the day (pictured below). It was similar to the phenomenon we saw when Netflix struggled to deliver the Mike Tyson Jake Paul fight in November 2024.
Ongoing internet shutdown
Shortly after airstrikes began on February 28, Iran entered into its current extended shutdown. From our perspective, we saw most traffic to Iran dry up at 07:06 UTC (9:36am local), with some remaining traffic going offline at 11:47 UTC (2:17pm local), as is depicted below.
Similar to the national blackout in January, the current outage has had minimal impact on Iran’s IPv4 BGP routes (see the green line in the IODA chart for Iran), indicating that routing remained largely unaffected. In other words, the country remains connected to the global internet even if its people are largely shut off from the world.
This is a relatively new style of internet shutdown for Iran that was first seen during the Twelve-Day War last summer. It was dubbed a “Stealth Blackout” in a lengthy report by the Iranian digital rights group Miaan Group, to which we contributed.
As we explained in our post on the January shutdown, the fact that the IPv4 routes remain globally propagated is a key attribute of these blackouts.
Had authorities withdrawn IPv4 routes, as they did with IPv6, Iran would have become completely unreachable, as Egypt was in January 2011. By keeping IPv4 routes in circulation, Iranian authorities can selectively grant full internet access to specific users while denying it to the broader population.
Outages within residual traffic
During each of this year’s shutdowns, we have observed a trickle of residual internet traffic making its way in and out of the country from people and organizations whitelisted by Iran’s new internet blocking system. Within this whitelisted traffic, there have been further outages as the country endures daily aerial bombardment and the government cracks down on Iranians sharing access to these holes in the digital blindfold.
One noticeable drop in traffic occurred on March 5. The traffic graph for TIC (AS58224) is depicted below.
To help illustrate the unique phenomenon of successive internet outages during an internet blackout, I made the following images to convey the degree to which internet connectivity has been reduced. In the graphic below, we see traffic to Iran over the entire course of 2026, capturing the first shutdown, partial restoration, and the current shutdown. Note the highlighted portion of the graph and how traffic volume continues far below even the partially restored levels seen in the previous four weeks.
After zooming in on the highlighted timeframe of the previous graph, we get the graphic below. Despite this traffic volume only accounting for less than 1% of normal traffic levels for Iran, there are clear drops in traffic volume on March 2, March 5, and March 15, the last date reportedly coinciding with a government crackdown whitelisted users and organizations.
Other developments we’ve observed include:
- Pars Oil & Gas Company (AS51554), a major Iranian state-owned oil and gas firm, was offline from February 28 to March 8. Since January 11, this network has taken itself offline every evening by withdrawing its routes in BGP around 5pm local until 8am local the next day. As is well-depicted in IODA, the routes were never reannounced for the first week of March.
- On March 1, BGP routes belonging to the network of the Iranian state-controlled media corporation Islamic Republic of Iran Broadcasting (AS42586) were completely down from 17:00 UTC to 10:00 UTC on March 2. The IRIB has been a target of airstrikes.
- On March 12, major fixed-line operator TIC (AS58224) experienced a period of routing instability, coinciding with a 40-minute restoration of internet services as reported by our friends at Cloudflare and IODA. It seemed like whatever happened may have temporarily removed the blockage for this network.
Conclusion
The current internet shutdown in Iran is the country’s longest in history, surpassing the shutdown in January, which was arguably one of the most severe communication blackouts in history. Unfortunately, the shutdown may continue as long as the current government of Iran remains in power. Even during the partial restoration, there didn’t seem to be much hope of returning to the Iranian internet as it was before January 8th without new leadership for the country.
And for the people in Iran, the inability to communicate compounds the horror they are experiencing. According to the latest Filterwatch report from Miaan Group, communication failures, coupled with physical bombardment, have made daily survival and safety coordination increasingly precarious for millions of civilians digitally stranded during a critical humanitarian crisis. Consequently, citizens have been forced into a predatory black market for data where costs are prohibitively high. Without common modes of communication, they cannot reach out to loved ones to confirm they are safe, nor tell the world what they are experiencing.
We are especially grateful to the Iranian digital rights advocates working inside the country at great risk to themselves, keeping lines of communication, albeit limited, open to the outside world and sharing the experiences of the people. We hope that this prolonged crisis is resolved soon and peacefully, allowing the people of Iran to regain access to unrestricted communication and safety.
