On 8 January 2026 monitoring organisations recorded a near‑total national internet outage across Iran as broad connectivity collapsed across mobile networks and many internet service providers. The sudden shutdown coincided with nationwide protests that had intensified in the preceding days, and technical measurements from multiple firms pointed to an intentional, highly targeted action rather than a spontaneous failure.
Networks and rights groups warned the blackout severely restricted independent reporting and the public’s ability to document events in real time. Journalists and analysts immediately highlighted the outage’s technical profile and its human cost: alongside mass interruptions in communications, rights monitors reported arrests, casualties and an uncertain toll that was hard to verify while the country remained largely cut off.
The blackout begins: timing, scope and immediate signals
Outage monitors recorded abrupt drops in traffic on 8 January 2026 (UTC mid‑day) with major traffic elimination through the afternoon and evening. NetBlocks reported Iran was “now in the midst of a nationwide internet blackout,” documenting national connectivity ‘‘flatlining at ~1% of ordinary levels’’ during the outage. Multiple groups said the shutdown persisted through at least 12 to 24+ hours as authorities maintained broad restrictions.
Cloudflare’s technical data showed a striking fall in the country’s announced IPv6 address space , roughly a 98.5% reduction , and a fall in IPv6 traffic share from about 12% to approximately 1.8% on 8 January. That pattern signalled a surgical cut to mobile/IPv6 paths that crippled mobile internet for many users.
The geographic scope was wide: mobile operators including MCI, IranCell and Rightel were affected, and reports indicated telephone lines and international calling were also disrupted in many areas. Although some fixed‑line or desktop services were less affected in the first hours, national connectivity to the global internet fell to single‑digit percentages overall.
How the shutdown was carried out: route withdrawals and protocol targeting
Internet‑measurement analysts , including Cloudflare, Oracle researchers and independent experts , characterised the incident as a coordinated manipulation of network routes and address announcements rather than an ordinary outage. The dominant technical signature involved route withdrawals and IPv6 withdrawals, effectively removing reachability for many mobile users.
Analysts reported selective protocol blocking and mobile‑stack targeting, a method that differs from blunt filtering. Because routes and address announcements were removed rather than simply filtered, many conventional VPNs and common circumvention tools stopped working: with no announced routes to reach destinations, tunnelling tools could not establish sessions even when encryption was allowed.
Observers noted that the approach reflected a state‑level shutdown strategy tailored to deny connectivity where most Iranians access the internet: on mobile devices and IPv6 paths. That technique also complicates partial workarounds and reduces the window for real‑time documentation by protesters and independent media.
Impact on people, services and information flows
Civilians reported being cut off from family, emergency services and critical updates. The blackout affected mobile messaging apps, social media access and many emergency communications, heightening panic and confusion in areas of intense unrest. Some fixed‑line connections and certain desktop services temporarily persisted, but the overall collapse in mobile reachability left large parts of the population isolated.
Beyond personal communications, businesses and banks, logistics providers and newsrooms faced disruption. Payments, market reporting and e‑commerce suffered interruptions during a period of severe economic strain that had partly fuelled the protests. Observers noted that restricting information flows can also have a chilling effect on independent verification and the international community’s ability to monitor unfolding events.
Information‑flows and verification were particularly harmed: monitoring groups and journalists stressed the blackout severely hampered independent reporting, verification of events, and victims’ ability to document abuses in real time. That degradation is a common pattern analysts have seen in prior crackdowns, complicating efforts to reconcile differing casualty and arrest tallies.
Protests: triggers, timeline and national spread
The demonstrations began on 28 December 2025 amid a sharp collapse of the rial and soaring food prices. Reports quoted the rial plunging to roughly 1.42 million per US$ in late December 2025 and recorded very high year‑on‑year food inflation, grievances that helped drive street unrest from dozens to more than 100 cities and provinces by early January.
Calls for mass action on 8 and 9 January preceded the blackout; exiled opposition figures such as Reza Pahlavi urged public demonstrations and appealed for international solidarity, while activists coordinated locally despite increasing pressure. Domestic organisers used mobile messaging and social networks to mobilise , channels that the blackout later targeted.
The nationwide spread of demonstrations and the timing of the communications blackout together suggested a strategic intent to restrict organisers’ abilities to coordinate across cities, a tactic observed in earlier episodes of unrest in Iran during 2019, 2022 and intermittent cutbacks in 2025.
Casualties, arrests and the problem of verification
Rights groups and local monitors reported varying tallies of detainees and deaths, with clear discrepancies between sources. Iran‑based monitors and the Human Rights Activists News Agency (HRANA) reported thousands detained , with figures cited around 2,000 to 2,300+ arrests , and dozens of deaths, with some local monitors giving numbers in the 30s to 60s range.
Amnesty International documented killings as well and reported that at least 28 people were killed between 31 December 2025 and 3 January 2026, warning that the blackout “hides violations” and may enable further abuses. Time magazine cited a Tehran‑based hospital source who said more than 200 deaths had been recorded across six Tehran hospitals; the magazine noted that figure came from a hospital source and was not an official tally.
The divergent accounts underscore the difficulty of independent verification while connectivity is limited. Amnesty and other organisations urged caution in accepting single figures and called for access to victims, families and hospitals to clarify the scale of casualties and detentions once communications are restored.
Rights groups, government rhetoric and security‑force tactics
Amnesty International publicly called for urgent diplomatic action and the restoration of full internet access. In its statement Amnesty said: “With reports of a rising death toll in Iran, Amnesty International reiterates its calls for urgent global diplomatic action… Iranian authorities must immediately restore full internet access.” Rights groups warned that the blackout could facilitate further abuses by reducing outside scrutiny.
State media and leaders took a hard line. Supreme Leader Ayatollah Ali Khamenei delivered a televised address denouncing protesters and describing actions as “terrorist actions,” with state outlets blaming “terrorist agents” and alleged foreign interference from the United States and Israel, according to reporting by Reuters and other outlets. That rhetoric accompanied intensified security operations in many cities.
Local sources and rights monitors reported intensified tactics after the blackout, including the use of live ammunition, widespread deployment of tear gas, mass arrests, targeted raids and alleged pressure on hospitals and families. Many of these claims remain under investigation and tallies vary by source, a divergence made worse by the communications squeeze.
Circumvention, satellites and strategic limits
Technical commentators noted that low‑Earth‑orbit satellite systems (LEO) such as Starlink can in principle undermine total blackouts by providing alternate transit paths. However, most Iranians lack access to Starlink hardware, and authorities can target ground gateways, block transit points and employ jamming or legal measures to limit any practical use of such services.
Because the shutdown techniques involved withdrawing announced network routes and IPv6 address space, some remote workarounds that depend on ordinary routing and DNS remained ineffective. Experts warned that even with ingenuity from tech‑savvy users, the combination of route manipulation and enforcement on the ground makes comprehensive circumvention difficult for the majority of the population.
Observers urged monitoring groups and journalists to follow technical feeds , such as NetBlocks and Cloudflare Radar , alongside human‑rights reporting from Amnesty, HRANA and Iran Human Rights to build a fuller picture when access allows. These hybrid data streams help interpret disruptions and guide verification efforts once connectivity improves.
Historical context and longer‑term implications
Iran has used large‑scale internet restrictions previously during major unrest in 2019 and 2022, and intermittent cutbacks occurred in 2025. Analysts observed that the January 2026 action follows that pattern but employed more IPv6‑specific and route‑withdrawal techniques, reflecting evolving state capabilities and an increasingly sophisticated digital containment playbook.
The tactical shift raises questions about the future of digital resilience and the international community’s ability to respond. Technical researchers argue that documenting and publicising these methods helps providers and policymakers develop mitigations, but immediate relief for affected populations remains challenging while on‑the‑ground coercion and information suppression continue.
For governments, tech firms and rights organisations, the incident underscores the need to combine real‑time technical monitoring with on‑the‑ground human rights work. Restoring connectivity and ensuring accountability for reported abuses will be essential to re‑establishing public trust and allowing independent verification of events.
The Iran internet blackout on 8 January 2026 therefore represents both an acute human‑rights crisis and a case study in how states increasingly use targeted, route‑level strategies to control information during unrest.
As the situation evolves, continued reporting by NetBlocks, Cloudflare, Amnesty International, HRANA and major news outlets (Reuters, AP, The Guardian, Time) will be central to understanding both the technical contours of the shutdown and the human consequences that followed.
