On Tuesday, May 26, Iran’s vice president confirmed that Internet access was being gradually restored nationwide after nearly three months offline, following the start of U.S. and Israeli military strikes on February 28.
Cloudflare Radar data corroborates increased network activity, pointing to a gradual reinstatement of connectivity across Iran. In this article, we’ll walk through key data insights that shed light on this extended blackout — and the encouraging signs that Iranians are slowly regaining online access. As developments continue, Radar will provide up-to-date tracking of Iran’s Internet connectivity status.
Iranians have endured two nationwide Internet blackouts this year so far. The first started on January 8 at roughly 16:30 UTC (20:00 local time), and we analyzed the effects visible in the initial days in our earlier blog post. Traffic originating from Iran stayed near zero until January 21, when a small trickle returned — only to vanish again just over 24 hours later. A similar short-lived restoration happened on January 25, before connectivity more steadily resumed starting January 27.
In late February, as military attacks on Iran intensified, a second nationwide Internet blackout was imposed. That extensive shutdown persisted for close to three months.
The second shutdown began on February 28. On that day, Cloudflare Radar detected a steep decline in traffic from Iran starting around 10:30 local time (07:00 UTC). Traffic volumes dropped to well below 1% of pre-shutdown levels, with only trace amounts of Web and DNS requests exiting the country.
Our data now shows that traffic is finally beginning to flow again. Starting at approximately 11:00 UTC on May 26 — 87 days after the second shutdown began — Cloudflare Radar recorded a noticeable uptick in both traffic volume and DNS queries.
Metrics for data transferred over Cloudflare’s network reveal a brief surge at 11:45 UTC, followed by a sustained climb beginning at 12:00 UTC. This rise in activity is approximately 15 times higher than the levels seen throughout the previous week. Following the expected daily cycle, traffic tapered off around 21:00 UTC, before picking up again starting at 3:00 UTC on May 27 (6:30 local time).
The growth in data transfer volumes means that significantly more information is moving through Cloudflare’s infrastructure — a positive sign that a partial Internet restoration is underway.
Cloudflare Radar’s regional analysis, shown below, reveals that the overwhelming majority of this renewed traffic is concentrated in Tehran, with 91.6% of HTTP requests coming from the capital. Other provinces are showing slight increases, but none are nearly as notable.
Traffic volume by network
Following an initial surge at 11:45 UTC, the Internet providers TCI, IranCell, RighTel, and MCCI each experienced rises in traffic. Cloudflare Radar tracks this traffic by ASN — the unique identifier assigned to each individual network or group of networks.
As the graph below illustrates, queries to Cloudflare’s public DNS resolver (1.1.1.1) have also spiked. Since a rise in DNS traffic indicates that more people are requesting access to websites and online services, this upward trend is a strong signal that Internet availability is returning.
Traffic has recovered to 40% of prior levels
These traffic increases confirm that a partial restoration of Iran’s Internet has indeed taken place. However, while the growth in DNS queries and overall traffic is meaningful, volumes still fall well short of what was recorded before either disruption. As the chart below illustrates, at its peak on May 26, traffic had recovered to just 40% of the maximum activity level observed so far this year.
Network activity in the days ahead will show whether traffic levels can continue to recover and ultimately
Here’s the rewritten HTML content with improved readability:
Traffic levels have not rebounded to what they were before the shutdowns began. Furthermore, these improvements might not last—as seen in January, short-lived recoveries can just as quickly fall back to previous low levels.
Back in January, we documented a dramatic decline in published IPv6 address space that started several hours prior to the January 8 decline in traffic. Although Iran’s networks appear to be experiencing some restoration, the amount of announced IPv6 address space — along with the associated IPv6 traffic originating from Iran — is still essentially nonexistent.
This is particularly significant because IPv4 address announcements have held steady and shown little fluctuation across both major 2026 internet shutdowns in Iran. The combination of IPv4 addresses remaining visible in global routing tables alongside the total absence of real traffic indicates that Iran’s internet blackout was accomplished through alternative technical methods, such as application-level filtering or access whitelisting.
IPv6 address space experienced a sharp decline in January and has yet to recover to typical levels.
IPv4 address space has remained largely stable throughout both 2026 shutdown periods in Iran.
With most of 2026 spent disconnected, Iranian residents have endured profound disruptions to their everyday routines—making these initial indicators of traffic rebuilding a crucial moment to watch. We’ll keep tracking internet connectivity across Iran and provide updates as circumstances change.
For a closer look at internet availability in Iran and across the globe, visit Cloudflare Radar. You can also catch our newest insights on X, Mastodon, and Bluesky.
