
Start using accurate IP data for cybersecurity, compliance, and personalization—no limits, no cost.
Sign up for freeIran's internet has been dark, in some form, for most of 2026. Our internet measurement data reveals strikingly disparate internet coverage in Iran in the months since the country shut down access. Our week-by-week ASN analysis shows the near-total collapse in early January in response to protests, the brief and complete recovery, followed by a second collapse after the beginning of war in late February.
These collapses are not uniform across networks. While consumer access remains near-dark, state infrastructure, academic networks, and some commercial cloud provider internet access is mostly at or above pre-collapse levels.
Read our full breakdown below.
ProbeNet, our active-measurement network, runs a weekly ICMP census across global IP space as part of the standard reachability pipeline that feeds our datasets. Filtering that census to addresses geolocated to Iran for the period from November 2025 through April 2026, and reading the percentages off it, tells a clean three-act story.

Baseline (November–early January). Reachability was steady. Roughly 490 distinct ASNs visible each week, with the responding-IP count holding within a few percent of itself.
Collapse 1, week of January 5, 2026. Reachable IPs dropped to about 0.5% of the prior week's level, a roughly 99.5% week-over-week reduction. The number of ASNs visible to the census fell from 488 to 47. This coincides with the wave of nationwide protest crackdowns at the start of the year.
One detail worth flagging about Collapse 1: routes for Iranian address space stayed announced to the global routing table even while traffic to those addresses was being dropped inside the country. Different measurement approaches saw different things during that period, and academic analysis has since documented this as a BGP blind spot.
Recovery (mid-January–mid-February). By the week of January 26, reachability was back within a few percent of pre-collapse levels: 480 ASNs, IP counts essentially restored. For four weeks, Iran's measurable internet looked normal again.
Collapse 2, week of February 23, 2026. Reachability fell again, this time to about 0.6% of pre-collapse levels, a 99.4% drop on the order of Collapse 1. Visible ASNs dropped from 489 to 142.
Unlike the first collapse, the second one didn't end. From a trough around 0.45% of peak in early March, reachability has drifted slowly upward. As of our most recent snapshot, it sits at about 1.1% of peak, across 218 ASNs.
Two near-total collapses. One four-week recovery. A sustained blackout that, as of this writing, is still going.
The collapse and the partial recovery aren't uniform across networks. Looking at our weekly snapshots ASN by ASN, the networks responsible for the bulk of consumer internet access in Iran are essentially still dark, while a different category of network kept responding, and in some cases is responding more than before the second collapse.
The country's largest fixed-line ISPs and mobile carriers all show two-orders-of-magnitude drops in measurable reachability. As of mid-April:
Mobile operators are in similar territory: Mobile Communication Company of Iran (AS197207) is at about 15% of its pre-collapse footprint.
The picture flips for a different set of networks. State infrastructure, academic networks, and certain commercial cloud providers either held up through the second collapse or recovered to above pre-collapse levels, even as nearly everyone else was dropping by 95%+:
The number of distinct ASNs visible to our census tells the same story at a higher level: the count fell from 489 the week before Collapse 2 to a low of 72 in early March, and has been climbing back, reaching 218 as of mid-April. The recovery in absolute reachability has been small (roughly 0.45% → 1.1% of peak) but the recovery in network diversity has been more substantial.
That distribution lines up with a tiered-access scheme Iran's Supreme National Security Council approved in early 2026, sometimes referred to as "Internet Pro," which grants global-internet access to specific sectors (commercial cardholders, registered freelancers, academics, certain industry users) while keeping the consumer internet dark. The networks our census shows holding up (state infrastructure, academic institutions, certain commercial cloud providers) match the categories of users that scheme was designed to keep online.
A handful of public datasets cover Iran's shutdowns, each with its own data layer and cadence. Cloudflare Radar draws on user-side signals: traffic to Cloudflare-fronted services and 1.1.1.1 resolver queries. NetBlocks surfaces connectivity drops in real time on social media. IODA combines BGP, search-resolver telemetry, and active probing in periodic comparative analyses.
What our weekly ICMP census adds to that picture is granularity. A week-by-week, ASN-by-ASN view across global IP space, going back to a pre-collapse baseline, is the lens we use throughout this post: not just how much of Iran's address space is responding from week to week, but which specific networks are responding, and how the mix has shifted across the two collapses and the partial recovery.
The setup is straightforward at a high level: ProbeNet runs a weekly ICMP echo census across global IP space as part of our standard reachability pipeline. For this analysis, we filtered the responses to addresses geolocated to Iran, aggregated the results by ASN, and reported them as percentages of the pre-collapse baseline. You can see ProbeNet running live at ipinfo.io/probenet/live.
The same playbook (partial blackouts, tiered access, routes that stay announced while traffic gets dropped) has shown up in different forms across Russia, Pakistan, Myanmar, and Venezuela in recent years. The next one will too.
For companies operating across borders, the practical question is: when something inside that country needs to respond, whether that's your service, your users, or your infrastructure, is it actually responding? That's a different question from whether BGP shows the routes are there, whether DNS resolves, or whether traffic is showing up on third-party telemetry. All of those can keep working while the underlying connections are silently dropping.
In Iran's January shutdown, routing-level monitors showed the country as connected. Active reachability measurements showed it wasn't. The gap between "looks online" and "actually responds" is the gap that operators need visibility into.
Iran is still dark. We'll keep measuring, and we'll update this post as the picture changes.
As Co-CEO at IPinfo, Paul has spent more than 15 years with the tech infrastructure industry. He previously served as CRO at Puppet and VP of sales at Oracle.

Tiago is Head of Anonymizer Detection, where he fine-tunes IP data streaming processes and transforms vast data sets into actionable insights. He was previously a staff research scientist at BitSight Technologies.