Afghanistan Goes Fully Offline After Nationwide Shutdown Order
On Monday, September 29, 2025, Afghanistan experienced a nationwide Internet shutdown that took the country completely offline. The disruption began just after 11:30 UTC (16:00 local time) with a brief interruption to wired Internet providers, lasting roughly half an hour. During this initial phase, traffic data for AS38472 (Afghan Wireless) and AS131284 (Etisalat) showed that mobile connectivity remained available.
However, just after 12:30 UTC (17:00 local time), the Internet was completely shut down across the country. Afghan news outlet TOLOnews reported that fiber-optic Internet would be shut down nationwide, citing confirmed sources. This action appears to be an extension of regional shutdowns of fiber optic connections that occurred earlier in September, and reports indicate it will remain in force "until further notice."
At a national level, both web traffic and DNS query volume dropped to zero during the second shutdown event. Cloudflare stopped receiving client traffic from its services, including HTTP requests, bytes transferred, and DNS lookups to the 1.1.1.1 resolver.
Regional Patterns in the Shutdown
At a regional level, traffic from Kabul fell slightly later than traffic from other regions, trailing by approximately half an hour. This delay may be linked to a more gradual loss of traffic at AS38742 (Afghan Wireless), which saw traffic approach zero just after 13:00 UTC (17:30 local time). Reports from Kabul noted that fiber-optic services were no longer available, with only limited mobile data functioning briefly before signal towers stopped working altogether.
Interestingly, a very small amount of traffic from Afghan Wireless continued to be visible as of 00:00 UTC (04:30 local time) on September 30, in contrast to other networks whose traffic disappeared around 12:30 UTC.
Routing Impact
Network providers announce IP address space to enable routing of traffic. When these announcements are withdrawn, resources in that address space can no longer reach or be reached from the rest of the Internet. In Afghanistan, announced IPv4 address space dropped rapidly during the shutdown, falling by two-thirds from 604 to 197 announced /24s in the first 20 minutes, then dropping further over the next 90 minutes.
By the end of the day, several networks continued to announce small amounts of IPv4 address space:
- Four /24s from AS38742 (Afghan Wireless)
- Two from AS149024 (Afghan Bawar ICT Services)
- One each from AS138322 (Afghan Wireless) and AS136479 (Cyber Telecom)
Afghan Wireless is a mobile connectivity provider, while Afghan Bawar and Cyber Telecom also appear to offer wireless or mobile services. The prefixes still visible from Afghan Wireless appear to be routed through AS17557 (Pakistan Telecom), while prefixes from Afghan Bawar and Cyber Telecom are routed through AS40676 (Psychz Networks), a US-based solutions provider.
Announced IPv6 address space also fell, though less catastrophically, dropping by three-fourths almost immediately from 262,407 /48s to 65,542.
Earlier Regional Shutdowns
In mid-September, the Taliban ordered the shutdown of fiber optic Internet connectivity in multiple provinces as part of a drive to "prevent immorality." This was the first such ban issued since the Taliban took full control of the country in August 2021. As many as 15 provinces experienced shutdowns, which blocked students from online classes, impacted commerce and banking, and limited access to government agencies and institutions such as passport and customs offices.
Balkh appeared to be one of the earliest targeted provinces, with traffic dropping midday (UTC) on September 15. While some nominal recovery occurred on September 23, traffic remained well below pre-shutdown levels.
Takhar saw traffic fall on September 16 after several days of peak traffic levels double those seen in previous weeks. Traffic remained near zero until September 21, when a small amount of connectivity was apparently restored.
In Kandahar, lower peak traffic volumes were visible between September 17 and September 21. The partial restoration of traffic coincided with reports that services were restored, though limited to point-to-point connections for key government offices including banks, customs offices, and the Directorate for National ID Cards.
Baghlan experienced an anomalous spike in traffic on September 16, with total traffic spiking 3x higher than peaks from previous weeks. However, on September 17, traffic dropped to a fraction of pre-shutdown levels. Except for a return to near-normal levels on September 21 and 22, the disruption remained in place through the end of the month.
Traffic in Nangarhar was disrupted between September 19-22, but quickly recovered to pre-shutdown levels once restored.
After experiencing an issue at the start of the month, Internet traffic in Oruzgan fell again on September 19. After an apparent complete shutdown, a small amount of traffic was visible again on September 23.
In Herat, the disruption took a different form. From September 22-25, partial Internet outages were implemented between 16:30-03:30 UTC (21:00-08:00 local time), with traffic volumes dropping to approximately half of those seen at the same time in prior weeks. Residents noted that these "Internet curfew" shutdowns severely disrupted their business and educational activities, though the intent of the measure remains unclear.
Broader Consequences
The nationwide shutdown threatens to paralyze critical services including banking, customs operations, and emergency communications. Television and radio networks are also expected to face disruptions. Unlike most Internet shutdowns, which are comparatively short-lived and typically tied to a local event such as exams, unrest, or elections, analysts state that this action could deepen Afghanistan's digital isolation, further damage its struggling economy, and drive more Afghans out of work at a time when humanitarian needs are already severe.
