Iran throttles mobile networks as protests spread
Days of anti-government demonstrations across Iran, set off by the death of 22-year-old Mahsa Amini while in police custody, have prompted authorities to disrupt Internet connectivity nationwide. Amini was arrested in Tehran on September 13 by Iran’s “morality police,” which enforces strict dress codes for women. She died on September 16; published reports say at least eight people have died in the resulting unrest.
Iran has a history of turning to connectivity restrictions during periods of civil strife, with similar measures taken in May 2022, February 2021, and November 2019. The current episode has involved disrupting Internet traffic, blocking social media platforms, and blocking DNS, according to data and reports reviewed from Cloudflare and other sources.
Mobile traffic drops to near zero
The first localized disruption visible in Cloudflare’s traffic data occurred in Sanandij, in Kurdistan Province, where several days of protests followed Amini’s death. On September 19, traffic on TCI (AS58224), Iran’s fixed-line incumbent operator, dropped to zero between 1630 and 1925 UTC, with only a brief spike between 1715 and 1725 UTC.
By September 21, the disruption became nationwide, hitting mobile networks hardest. Iran is a mobile-centric country, with roughly 85% of requests coming from mobile devices, per Cloudflare Radar. Traffic from Iran Mobile Communications Company (AS197207) declined around 1530 UTC and stayed near zero until recovering at 2200 UTC. RighTel (AS57218) traffic started sliding around 1630 UTC and returned at 0510 UTC after an outage of more than 12 hours. MTN Irancell (AS44244) traffic dipped just before 1700 UTC and recovered at 0450 UTC, also after about a 12-hour gap.
The effects are visible at regional and national scale. HTTP request volume in Tehran Province fell by roughly 70% around 1600 UTC, with only a modest recovery at 2200 UTC, likely tied to the return of traffic on AS197207. Countrywide traffic dropped about 40% just after 1600 UTC, showed the same nominal recovery at 2200 UTC, then climbed more aggressively starting around 0500 UTC as the two remaining mobile providers reconnected.
Social platforms and DNS targeted
In addition to network-level shutdowns, authorities reportedly blocked access to Instagram and to DNS-over-HTTPS services from open resolvers including Quad9, Google’s 8.8.8.8, and Cloudflare’s 1.1.1.1. Analysis of requests to Cloudflare’s resolver originating in Iran shows the effect.
Requests for instagram.com hostnames fell sharply at 1310 UTC and stayed low for the rest of the day, aside from an unexplained spike between 1540 and 1610 UTC. Other leading social platforms did not show a similar pattern. Separate blocking of WhatsApp is visible in queries for whatsapp.com hostnames, which dove to near zero at 1910 UTC.
The Open Observatory for Network Interference (OONI) reported on September 20 that the cloudflare-dns.com domain, used for DNS-over-HTTPS and DNS-over-TLS connections to Cloudflare’s resolver, was blocked in Iran. Resolution volume over DoH and DoT dropped to zero at 1940 UTC, according to Cloudflare data. OONI also noted that the 1.1.1.1 IP address remained blocked on most networks, though the trend line over TCP/UDP port 53 indicates the address is not universally blocked, since some resolution requests still reached Cloudflare.
Those tracking such events can monitor current conditions on Cloudflare Radar, where disruption patterns are visible as they unfold.
