Offline by order: Iran’s internet blackout

Since Jan. 8, 2026, Iran has been in the grip of a sweeping internet blackout, coinciding with a fresh wave of nationwide protests. These demonstrations, driven by a collapsing currency, surging costs of living, and mounting economic hardship, have spread across a growing number of cities.

Numerous reports have linked the digital blackout to the intensifying unrest, interpreting it as a calculated measure to suppress the flow of information and obstruct communication during politically volatile periods. The disruption appears to have followed calls for mass mobilization—an increasingly familiar maneuver aimed at disrupting the protesters’ coordination efforts and obstructing the transmission of images and video beyond Iran’s borders.

Is Starlink a viable alternative?

As Iranian authorities sever access to the internet and mobile networks, many citizens have been searching for alternate pathways to circumvent digital isolation. At the center of this search stands Starlink.

Starlink, the satellite-based internet system developed by Elon Musk’s SpaceX, was built to deliver high-speed connectivity to regions where conventional infrastructure is weak or nonexistent—rural hinterlands, disaster zones, and theaters of conflict.

Yet in the Iranian context, Starlink is proving to be more of a lifeline under siege than a ready solution.

Users report widespread interference, particularly GPS jamming that disrupts the Starlink terminals’ ability to lock onto satellites. In some regions, data loss has exceeded 80%, rendering connections unstable—especially during peak usage hours.

Starlink terminals do not reach Iran via official means. Instead, they enter covertly, through channels established by diaspora activists who procure and fund the equipment abroad. The devices are then smuggled across borders via neighboring countries, creating a subterranean supply chain. With demand on the rise, a black market has taken shape, with some users sharing terminals to distribute operational costs and mitigate exposure.

Sanctions and restrictions on formal payment channels further complicate access. Many subscribers resort to cryptocurrencies or prepaid cards to maintain service, while others devise collective arrangements to share monthly fees. In the end, Starlink offers not a public-scale solution but a narrow aperture—expensive, precarious, and easily targeted by authorities.

Echoes of past blackouts

This latest blackout is not without precedent. During the June 2025 Israeli attack, Iran experienced another significant disruption to its internet infrastructure. At the time, an Al Manassa report drew on data from two prominent international monitoring platforms to reconstruct the digital collapse.

The first, Internet Outage Detection and Analysis (IODA), is a research initiative hosted by Georgia Tech. It monitors internet disruptions by analyzing IP availability and active probing, with particular strength in detecting outages from outside repressive national networks—offering a rare window into opaque environments.

The second, Cloudflare Radar, is an analytics suite provided by the global internet firm Cloudflare. It measures traffic volume, shifts in protocol use, and user-versus-bot activity, offering insight at the level of countries and regions.

Together, these tools provide a detailed chronology of Thursday’s blackout, allowing analysts to pinpoint its onset, map its trajectory, and assess its scale. In what follows, we examine visual data from Cloudflare Radar and IODA to trace the contours of the disruption.

Tracing the disconnection

Data from both sources confirm that the nationwide outage began in the afternoon of Thursday, Jan. 8. By evening (UTC), traffic had plunged. 

Cloudflare Radar flagged an anomaly at 16:30 UTC—a sharp, anomalous decline in traffic volume. Immediately afterward, three core indicators (overall data transfer, web traffic, and request rates) plummeted to near-zero and remained suppressed throughout the observation window.

This suggests not a decline, but a near-total collapse in internet service. 

IODA’s active probing corroborates this. Beginning around 4 pm, connectivity tests showed severe degradation, followed by a fall to critically low levels that persisted into the night. Simultaneously, user behavior indicators—such as browsing and search activity—fell precipitously.

The combined data tells two stories—one visible from the outside, and one lived on the ground. In such blackouts, networks may still appear active globally, while within the country, access becomes nearly impossible due to targeted blocking or internal sabotage of connectivity paths. That is exactly what Thursday’s figures indicate: networks visible from abroad, but all but unusable within.

Tehran at the center

Cloudflare Radar’s geographic breakdown shows that Tehran accounted for nearly 49.1% of all recorded internet activity during the blackout. It was followed by Fars (10.4%), Isfahan (9.6%), Razavi Khorasan (8.5%), and East Azerbaijan (8.0%).

Smaller proportions came from Alborz (3.8%), Khuzestan (3.2%), Mazandaran (2.8%), and Qom (0.7%).

Another Cloudflare chart tracking top provinces over time reveals a synchronized collapse in web requests beginning precisely at 16:30 UTC. The sharp, simultaneous drop across key regions signals not a technical failure, but a centrally administered intervention.

Repression in the code

Taken together, the indicators point overwhelmingly to a deliberate and comprehensive network disruption. Cloudflare issued an automated alert at the exact moment traffic plummeted. All major activity metrics fell dramatically and did not recover for the duration of the monitoring period.

Time-series comparisons further clarify the anomaly. In charts contrasting traffic patterns with the same day one week prior, the previous Thursday shows routine usage. The current data, by contrast, illustrates a two-phase breakdown: first a sudden dip, then a collapse. This temporal pattern aligns more with an engineered shutdown than with random outages or congestion.

IODA’s external testing provides additional confirmation. Active probing began to fail around 4:30 pm, while indicators for user behavior bottomed out. The near-perfect alignment between Cloudflare and IODA data strengthens the conclusion. Iran’s internet was not disrupted by accident. It was taken offline by design.

The result is near-total digital isolation.

As Iranians continue to mobilize, their remaining channels of communication are being systematically choked off by authorities. Satellite alternatives like Starlink may offer flickers of connectivity, but for now, they are out of reach for most.