Partial Connectivity Returns to Iran After 87-Day Blackout
Iran’s vice president announced on Tuesday, May 26, that internet access was beginning to be restored in the country, nearly three months after the second nationwide shutdown began on February 28. Cloudflare Radar measurements confirm that traffic is indeed flowing again, though at levels still far below the pre-shutdown baseline.
Two Shutdowns in 2026
Iranian users have faced two major national internet disruptions this year. The first began January 8, around 16:30 UTC, when traffic dropped sharply and remained near zero until January 21. Brief restorations occurred on January 21 and January 25, but each lasted barely over a day before connectivity vanished again. Traffic only recovered more fully starting January 27.
The second shutdown began February 28, around 10:30 local time (07:00 UTC), coinciding with escalating military strikes. Traffic fell to well under 1% of previous levels, with only small amounts of web and DNS traffic leaving the country for the next 87 days.
Signs of Life on May 26
Cloudflare Radar first observed a marked increase in both traffic and DNS queries starting around 11:00 UTC on May 26. A brief spike in bytes transferred across Cloudflare’s network appeared at 11:45 UTC, followed by a steady climb beginning at 12:00 UTC. That surge reached roughly 15 times the traffic levels seen during the prior week. Following normal diurnal patterns, traffic began declining around 21:00 UTC before rising again at 3:00 UTC on May 27 (6:30 local time).
Regional data shows the recovery is heavily concentrated: 91.6% of HTTP requests originated from Tehran. Other regions saw only minor increases. On the network side, internet providers TCI, IranCell, RighTel and MCCI each recorded traffic gains after the initial burst, as measured by their respective ASNs.
Queries to Cloudflare’s public DNS resolver (1.1.1.1) also spiked during this period. Since DNS traffic indicates users are actively requesting websites and services, the upward trend is a strong signal that online access is returning.
Despite the improvement, the numbers remain well below pre-disruption activity. At its peak on May 26, traffic reached only 40% of the maximum levels observed so far in 2026.
IPv6 Still Missing
The restoration is not uniform across protocols. In January, Cloudflare reported a near-complete loss of announced IPv6 address space that began several hours before the January 8 traffic drop. While IPv4-based traffic appears to be recovering, announced IPv6 address space — and consequently IPv6 traffic from Iran — remains effectively zero.
The contrast is telling. IPv4 address announcements remained fairly consistent and stable throughout both 2026 shutdowns, even as actual traffic vanished. The fact that IPv4 prefixes were never removed from global routing tables, combined with the total loss of traffic, suggests Iran’s shutdown was implemented through application-layer filtering or whitelisting rather than by withdrawing routes.
What to Watch
The coming days will show whether traffic returns to pre-shutdown baselines or whether this recovery proves temporary. As January demonstrated, brief periods of restored connectivity can quickly reverse. Cloudflare Radar will continue tracking Iran’s connectivity as the situation develops.
