THE
BLACKOUT
90 million people. 447 hours. One nation erased from the internet.BGP restored Jan 27 — Severe filtering continues
JOINT STATEMENT FROM INTERNET ARCHITECTS & LEADERS
"By severing the digital lifelines of over 90 million people, the authorities are inflicting profound harm on their own citizens."
Global Routing Visibility
BGP PATH COUNT • TELECOMMUNICATION COMPANY OF IRAN (AS58224)
CLICK CHART FOR DETAILED ANALYSIS
ACT I — THE CALM
A Nation Connected
December 2025. The Rial has collapsed. Inflation hits 42%. Protests erupt in the Grand Bazaar and spread to 31 provinces.
But the internet still works. TCI, the national backbone, hums along at 1.2 million routing updates daily—the steady heartbeat of a connected nation.
ACT II — THE SCREAM
January 8th, 03:00 UTC
Then came the order. Not a shutdown—something worse. The routers didn't go silent. They screamed.
BGP announcements exploded from 1.2 million to 5.6 million in hours. Filtering rules conflicted. Routes flapped. The network began eating itself alive.
System-Wide Instability
BGP UPDATE VOLUME (% CHANGE FROM BASELINE) • 10 NETWORKS MONITORED
CLICK LEGEND ITEMS FOR DETAILED ASN ANALYSIS
ACT III — THE CONTAGION
Everyone Falls Together
It wasn't just the backbone. Watch the chart: every major network in Iran spiked in exact unison.
Irancell. MCI. Rightel. Shatel. Afranet. Ten networks. Ten simultaneous failures. This wasn't a cascade—it was coordinated demolition.
"In over 20 years of research, I've never seen anything like it."
— Amir Rashidi, Director of Internet Security at Miaan Group
SourceKEY FINDINGS
What the Data Proves
Evidence A: Synchronization
10 out of 10 networks destabilized in the exact same 3-hour window. Mobile carriers. Fixed lines. Hosting providers. All at once. This is not congestion—it's a command.
Evidence B: Intranet Isolation
Afranet hosts Iran's domestic services—banks, taxis, food delivery. Its 341% spike proves this wasn't just about blocking the outside world. It was a reconfiguration of the entire National Information Network.
January 8th was a stress-test for total disconnection. BGP withdrawals reveal route leaks from a "Filter-First, Route-Second" policy being forced onto core gateways.
THE HUMAN COST
Behind the Numbers
While routers screamed and protocols collapsed, real people were being silenced. The blackout wasn't just technical—it was a cover for violence.
Per Sunday Times report. Largest massacre in modern Iranian history.
Per Sunday Times via Iran International, Jan 14.
IHRNGO documented killings as of Jan 14.
Including 12 children. 147 security forces also killed.
Including 165 minors, 46 university students. 96 forced confessions.
State executions during protests (Jan 5-14).
187 cities. All 31 provinces.
First official acknowledgment (Jan 21). 2,427 "civilians and security forces."
$37.5M daily economic damage to Iran's economy.
SOURCES — VERIFY YOURSELF
Updated Jan 23, 2026
Prefix Visibility by Protocol
IPv4 and IPv6 prefix counts from RIPE RIS routing data
Data source: RIPE NCC Routing Information Service (RIS) routing-history API. Counts show unique prefix announcements visible to RIPE route collectors for tracked Iranian ASNs.
ACT IV — PREFIX VISIBILITY
Routing Visibility Changes
RIPE NCC route collectors track which IP prefixes are visible globally. This chart shows the number of unique IPv4 and IPv6 prefixes announced by monitored Iranian ASNs during the blackout period.
The data comes from RIPE's routing-history API, which records prefix announcements seen by full-feed BGP peers across the global routing table.
DATA SOURCE
RIPE NCC Routing Information Service
Prefix visibility data is derived from RIPE RIS routing-history records for 11 major Iranian networks. Each data point represents the count of unique prefixes observed by RIPE route collectors during that time window.
Note: This data reflects global routing visibility, not internal network connectivity. A prefix remaining visible internationally does not guarantee domestic reachability.
DIGITAL KILL CHAIN
ANATOMY OF A SHUTDOWN
Middleboxes scan for specific footprints. OONI detected 'Malformed ctrl_headers' for Psiphon traffic.
The gateway injects fake responses. Session Messenger's 'getsession.org' resolved to incorrect IPs.
When inspection fails or specific protocols are used, traffic is blackholed. Signal reported 'generic_timeout_error'.
ACT V — THE HUNT
Hunting the Workarounds
Citizens didn't give up. They turned to VPNs. Encrypted messengers. Tor.The regime was ready.
OONI probes captured a three-stage "Kill Chain": Inspect. Inject. Silence.Every privacy tool was being actively hunted.
CONFIRMED TARGETS
Session & Psiphon Blocked
OONI probes confirmed DNS Injection targeting Session Messenger and Middlebox Interference against Psiphon VPN.
- > GET session.org -> [DNS SPOOF LOGGED]
- > CONNECT psiphon -> [HTTP HEADER MANIPULATED]
"This blanket internet shutdown not only hides human rights violations but amounts to a serious human rights violation in itself."
— Rebecca White, Iran Researcher at Amnesty International
SourceTHE GREAT DECOUPLING
FOREIGN TRANSIT PROVIDERS → IRANIAN NETWORKS
COMPARED TO BASELINE: No significant changes detected.
ACT VI — THE GREAT DECOUPLING
When the World Cuts the Wires
Before the blackout, Iran received connectivity from 38 foreign carriers. After: 44. But the numbers hide the real story.
9 upstream providers vanished—a 33% reduction in international connectivity. The mass disconnection occurred in a single 8-hour window between January 8th 16:00 and January 9th 00:00 UTC.
THE RUSSIAN SEVERANCE
Even Allies Cut the Connection
ROSTELECOM (AS12389)—Russia's state telecommunications company— had provided ~0.1K BGP paths to Iranian infrastructure.
Between January 8th 16:00 UTC and January 9th 00:00 UTC, that number dropped to zero. Not a gradual decline. A clean cut.
The disconnection has persisted to date with no recovery.
THE AZERBAIJAN LIFELINE
One Cable, 90 Million People
As providers fled, Delta Telecom (AS29049, Azerbaijan) increased its traffic by +92%.
From 2K paths to 4K. A nation of 90 million, now dangerously dependent on a single cable crossing the border.
IRANIAN NETWORK TOPOLOGY
INTERNAL ASN INTERCONNECTIONS — 600 NETWORKS, 849 LINKS
Drag nodes to explore • Click for details • Scroll/pinch to zoom • Drag background to pan
THE INTERNAL REWIRING
Power Shifts Inside Iran
Inside Iran, the network reorganized. 64 internal links disappeared—an 7.5% reduction in the internal network fabric. The baseline of 849 links dropped to 786.
The interactive graph shows how Iranian ASNs interconnect. Gold nodes are major hubs. Use the timeline slider to explore network changes across 30 snapshots from January 7-16, 2026.
Drag nodes to explore • Click for details • Scroll to zoom
NETWORK CONSOLIDATION
Winners and Losers
The blackout wasn't just destruction—it was redistribution. Some networks gained power as others lost it.
The state backbone weakened. Private carriers consolidated. This wasn't just a blackout—it was a restructuring of power.
THE POWER SHIFT
INTERNAL HUB CONNECTIONS — VS BASELINE (JAN 7)
"Connections" = number of other Iranian ASNs reachable through this hub in the internal topology. Losing connections means fewer networks route through this hub.
Loading hub comparison data...
KEY INSIGHT: Network power didn't just disappear—it redistributed..
THE POWER SHIFT
Hub ASN Comparison
This chart compares hub connection counts at any point against the baseline (Jan 7). Use the timeline slider to explore how Iran's major network hubs changed over time.
The changes reveal which networks consolidated power and which lost influence during the blackout period.
KEY INSIGHT
Infrastructure as Weapon
The blackout wasn't just about cutting off civilians. It was about reshaping the network topology itself.
Fewer foreign providers. Fewer internal links. More dependence on a single border crossing. Iran's internet is becoming easier to control with each crisis.
Iranian Address Space
Prefixes grouped by ASN
ACT VII — THE ADDRESS SPACE
65,000 Blocks of Digital Territory
Every Iranian IP prefix, grouped by origin ASN. Use the timeline slider to see how visibility changed across 30 snapshots from January 7-16, 2026.
Each colored block represents address space. Larger ASNs get proportionally larger areas. Hover to explore which networks control Iran's digital territory.
NETWORK CONCENTRATION
A Few Control the Many
The visualization reveals Iran's heavily concentrated address space. A handful of major ASNs—TCI, Irancell, MCI—control the majority of routable prefixes.
This concentration makes Iran's internet uniquely vulnerable to state control. Pressure a few key nodes, and the entire nation goes dark.
The Shadow Network
Behind every lost connection lies a story. Sanctioned companies, submarine cables, shell corporations, and geopolitical betrayals.
ArvanCloud
AS57568🇦🇪 UAE
THE CENSORSHIP ARCHITECT
US/UK SANCTIONED for building Iran's National Information Network
Gulf Bridge International
AS200612🇩🇪 Germany
THE SEVERED CABLE
Physical submarine cable to Iran's state backbone went dark
GEANT
AS20965🇳🇱 Netherlands
EUROPE'S BETRAYAL
Cut off Iran's FIRST internet provider (1993) and .ir domain registry
KARDOX
AS60542🇬🇧 UK
THE PERSIAN SHELL COMPANY
Iranian-named operator ran UK company as sole lifeline for Iranian hosting
THE SHADOW NETWORK
Behind Every Lost Connection
These aren't just lost BGP routes. Each severed connection tells a story of sanctions, shell companies, and geopolitical betrayal.
A US-sanctioned censorship architect. A $445M submarine cable. A Persian-named operator running a UK shell company. Click each dossier to reveal the story.
ARVANCLOUD
The Censorship Architect
US Treasury designated June 2, 2023 for building Iran's "National Information Network" - the regime's censorship infrastructure.
Co-founders personally sanctioned. Created a Dubai shell company to evade sanctions. Close ties to Iran's Ministry of Intelligence (MOIS).
KARDOX / NEXT
The Persian Shell Company
UK-registered company operated by "Mohsen Nikkhah trading as Kardox" - a Persian name. Exclusively served 3 MIHAN ASNs.
Classic sanctions evasion pattern: Iranian operator, UK company, exclusive Iranian customers. When KARDOX disappeared, all 3 MIHAN networks lost ALL foreign transit.
TRANSIT PROVIDER CHANGES
Provider | ASN | Country | Paths | IR Customers | Status |
|---|---|---|---|---|---|
ROSTELECOM-ASRUSSIAN | AS12389 | 🇷🇺 Russia | 58 | 1 | LOST |
VOXILITY | AS3223 | 🇬🇧 UK | 12 | 1 | LOST |
IQWEB | AS59692 | 🇦🇪 UAE | 4 | 1 | LOST |
NEXTSHELL CO | AS60542 | 🇬🇧 UK | 2 | 2 | LOST |
SOLLUTIUM-NL | AS43641 | 🇵🇱 Poland | 2 | 1 | LOST |
AS401753 | AS401753 | 🇻🇬 British Virgin Islands | 1 | 1 | LOST |
THE EVIDENCE
Drill Down Into the Data
Every lost provider. Every gained connection. Searchable, sortable, verifiable.
Click any provider for details. External links to BGP.HE.net for independent verification. This is forensic evidence of digital isolation.
SUMMARY — ACT VI (Data: Jan 7-16, 2026)
9 Providers Lost
33% reduction (66→44)
~0.1K ROSTELECOM Paths
Clean cut to zero
64 Internal Links Lost
7.5% network shrinkage
+92% Delta Telecom
Azerbaijan lifeline surge
INTERNATIONAL RESPONSE
"Thousands of people, including children, have been killed in Iran's brutal repression."
— Volker Türk, UN High Commissioner for Human Rights
50+ countries backed emergency session. Vote on extending fact-finding mission mandate for 2 additional years to document abuses for future legal proceedings.
Session Details →"Iranian women, men, and children deserve to live safely, with dignity, and with full respect for their rights, including the right to peacefully protest."
Initial statement documented 40+ deaths including 5+ children. Called for immediate internet restoration, end to violent crackdowns, and release of detained protesters.
Read Full Statement →Trump to speak with Musk about restoring Starlink. 25% tariff on Iran's trading partners.
Live Updates →New sanctions targeting finance, energy, transport and nuclear sectors.
Full Coverage →Shutdown "hides human rights violations" and is itself a serious violation.
Read Report →