Skip to content

CLOUDFLARE 2026-05-27 Tier 1

Read original ↗

Cloudflare — Iran's Internet is partially restored, Cloudflare Radar data shows

Summary

A short Cloudflare Radar update post published 2026-05-27 reporting that Iran's nationwide Internet shutdown — which began February 28, 2026 as military strikes on Iran escalated — has begun a partial restoration as of May 26, 2026, 87 days into the shutdown. The restoration was announced by Iran's vice president on Tuesday May 26 and confirmed within hours on Cloudflare Radar telemetry. Three properties of the recovery are architecturally informative: (1) it is heavily Tehran-localised (~91.6% of post-restoration HTTP requests originate from the capital, the rest of the country shows only minor increases) — consistent with the whitelist / filtering shutdown architecture being walked back selectively by region rather than turned off uniformly; (2) it re-establishes a normal diurnal traffic pattern within hours (decline ~21:00 UTC, return ~03:00 UTC at 06:30 local), confirming organic user behaviour rather than synthetic test traffic; (3) IPv6 announced address space remains effectively zero ~5 months after the January 8 IPv6 withdrawal — disconnected from the IPv4 traffic recovery and indicating that Iran's pre-shutdown IPv6 posture has not returned even partially. Traffic at its May 26 peak reached only ~40% of the maximum 2026 levels observed prior to the disruptions, and Cloudflare warns the recovery could be temporary in the same way that brief restorations on January 21 and January 25 reversed before the more durable January 27 recovery began. Sibling to and direct continuation of sources/2026-04-28-cloudflare-q1-2026-internet-disruption-summary, which catalogued the February 28 shutdown when it had been ongoing two months — this post is the duration update + first-recovery snapshot.

Key takeaways

  1. 87-day shutdown ends in partial restoration, not full restoration. "Starting at around 11:00 UTC on May 26, 87 days after the second shutdown started, Cloudflare Radar observed a marked increase in both traffic and DNS queries." Iran's vice president announced on X on Tuesday May 26 that "Internet access had started to be restored in the country after being cut off almost three months ago, following the launch of U.S. and Israeli attacks on February 28." Recovery was therefore politically announced before being technically observable — the announce- and-execute order matches the pattern documented in concepts/partial-restoration-pattern (Uganda 2026 was the prior canonical instance).
  2. Recovery is overwhelmingly Tehran-localised — 91.6% of HTTP requests originate from the capital. "Cloudflare Radar's regional breakdowns ... indicate that the vast majority of this new traffic is localized to Tehran, with 91.6% of HTTP requests originating from the capital city. While other regions show minor increases, they are not nearly as significant." This is a characteristic signature of a filtering / whitelist-based shutdown being walked back selectively: in a BGP withdrawal shutdown, recovery would propagate uniformly across all in-country ASes within minutes; in a filtering architecture, the state can choose which carrier edges to loosen first. New canonical instance of concepts/capital-localized-internet-restoration.
  3. Restoration spans four named Iranian operators — TCI, IranCell, RighTel, MCCI. "Following an initial burst at 11:45 UTC, Internet providers TCI, IranCell, RighTel and MCCI each saw increases in traffic. Cloudflare Radar measures this traffic by ASN, the unique identifier assigned to an individual network or group of networks." Per-network attribution is via ASN — so the recovery is visible at AS-granularity, not just country-aggregate.
  4. DNS queries to 1.1.1.1 spiked alongside HTTP traffic, confirming user-driven access. "Queries to Cloudflare's public DNS resolver (1.1.1.1) have also spiked. Because an increase in DNS traffic indicates that more users are requesting websites and services, this upward trend serves as a strong indicator that online access is returning." The systems/cloudflare-1-1-1-1-resolver therefore serves a second observability role beyond DNS service delivery: per-country DNS query rate is a leading indicator of human user activity, since a stub resolver issuing a query implies an end user typed or clicked a URL.
  5. Diurnal pattern returns within hours of restoration. "Following expected diurnal patterns, the traffic starts declining around 21:00 UTC, followed by an increase starting at May 27 3:00 UTC (6:30 local time)." The reappearance of the day/night curve is a high-quality signal that the traffic is genuinely organic user activity — synthetic / test / government-only traffic typically lacks the consumer-bedtime shape. See concepts/diurnal-traffic-pattern.
  6. Traffic peaked at only ~40% of 2026 maximum. "At its peak on May 26, traffic had only returned to 40% of the maximum amount of activity observed so far in 2026." Even the partial restoration is well below the pre-disruption baseline — consistent with the whitelist architecture continuing to gate the majority of users + sites even as Tehran's restrictions loosen.
  7. 15× the prior-week traffic level was the immediate surge magnitude. "This surge in activity is roughly 15x than the levels observed during the prior week." Useful as the numerical envelope for the order-of-magnitude shift that an external observer should expect to see at the moment a filtering-based shutdown begins to lift.
  8. IPv6 announced address space remains effectively zero ~5 months later. "In January, we reported a near-complete loss of announced IPv6 address space that began several hours before the January 8 traffic drop. While a partial restoration of the country's networks appears to be underway, the volume of announced IPv6 address space — and thus IPv6 traffic from Iran — remains effectively zero." The IPv6 withdrawal (canonical instance of concepts/ipv6-withdrawal-as-shutdown-signal) was a leading indicator of the January 8 shutdown; its continued absence ~5 months later is now a structural fact about Iran's Internet posture, not just a transient shutdown-staging signal. IPv4 recovery and IPv6 posture have decoupled. Asiatech (AS43754) and RASANA (AS31549) continue to carry the bulk of the missing IPv6 announcements.
  9. IPv4 announcements stable throughout both shutdowns confirms the mechanism: filtering, not route withdrawal. "This is noteworthy because in contrast with IPv6, address space announcements for IPv4 have remained fairly consistent and stable throughout both major 2026 shutdowns in Iran. The fact that IPv4 addresses were not removed from global routing tables, combined with the complete loss of actual traffic, suggests that Iran's shutdown was achieved through other technical means such as application filtering or whitelisting." Reaffirms the filtering-based shutdown diagnosis already established in the Q1 review and excludes route withdrawal as the mechanism — the per-region selectivity of the restoration is consistent only with filtering, since BGP-withdrawal restoration is all-or-nothing per prefix.
  10. Recovery may not be monotonic — January precedent. "Network activity over the coming days will reveal whether traffic levels will successfully return to their pre-shutdown baselines. It should also be noted, however, that these changes could be temporary; as demonstrated in January, brief periods of recovery can quickly reverse." The January 8 shutdown's recovery curve was non-monotone: brief recoveries on January 21 and January 25 both reversed before the aggressive January 27 recovery. Whether the May 26 recovery holds is not yet known at publication time.

Operational numbers

  • Shutdown start: 2026-02-28, ~10:30 local (07:00 UTC).
  • Shutdown duration to first recovery: 87 days to May 26.
  • Restoration onset: 2026-05-26, ~11:00 UTC (initial burst).
  • Initial spike: 11:45 UTC (bytes-transferred).
  • Steady increase: starting 12:00 UTC.
  • Surge magnitude: ~15× prior-week levels.
  • First diurnal trough: ~21:00 UTC May 26.
  • Diurnal recovery: 03:00 UTC May 27 (06:30 local Tehran).
  • Tehran share of restored HTTP requests: 91.6%.
  • Peak traffic vs 2026 maximum: ~40%.
  • IPv6 announced space: effectively zero (unchanged from January 8 collapse; Asiatech 9.4% + RASANA 8.8% withdrawals still outstanding).
  • IPv4 announced space: fairly consistent and stable across both 2026 shutdowns — mechanism evidence.
  • Operators with observed recovery: TCI, IranCell, RighTel, MCCI.

Diagnostic framework: how Cloudflare confirmed restoration

Cloudflare Radar's observability stack joined four signals to distinguish "genuine partial restoration of the country's Internet" from "transient blip / measurement artifact":

  1. Bytes transferred over Cloudflare's network — the coarsest aggregate measure; a 15× rise vs prior week against a quiet 87-day baseline cannot be measurement noise.
  2. DNS queries to 1.1.1.1 — independent measurement plane; confirms users are actively requesting hostnames, not just that data is moving (which could be machine-to-machine).
  3. Per-ASN breakdown via ASN — TCI, IranCell, RighTel, MCCI all rose, ruling out a single-network artefact.
  4. Per-region breakdown via geolocation — 91.6% Tehran concentration is itself diagnostic; a network-layer restoration mechanism would not produce this geographic concentration.

The combination is the structural recipe for any external observatory that wants to confirm an Internet-shutdown restoration: multi-plane (bytes + DNS) × multi-axis (per-AS + per-region) × baseline-relative (vs prior week) × mechanism- consistent (filtering implies per-region selectivity is possible).

Why per-region restoration is mechanism evidence

This is the key architectural point of the post that's worth making explicit:

  • A BGP-withdrawal shutdown is released by re-advertising prefixes. Once a prefix is back in the global routing table, every router on every path starts forwarding to it. The recovery is therefore approximately uniform across all in-country ASes within minutes — there is no tooling primitive to "re-advertise this prefix only for users in Tehran."
  • A filtering-based shutdown is released by loosening filter rules at carrier edges or DPI boxes. The state can therefore choose to lift restrictions selectively — by region, by SIM cohort, by service / domain, by hour of day. Per-region selective restoration is only possible in a filtering architecture.

The 91.6% Tehran concentration is therefore not just a demographic curiosity; it is per-region selectivity in action, which is diagnostic of the filtering mechanism in addition to confirming it. This is the same diagnostic shape the Q1 review used in reverse: "the routes stay up and the traffic drops" implied filtering then; "the traffic returns asymmetrically by region" implies filtering now. Both directions of the diagnostic work.

Caveats

  • Snapshot post, not durability assessment. The post is a ~24-hour snapshot of the first restoration day; whether the recovery holds is explicitly flagged as not yet known ("Network activity over the coming days will reveal whether traffic levels will successfully return to their pre-shutdown baselines"). The January 8 shutdown's two reversed restorations (January 21, January 25) are cited as precedent.
  • Cloudflare-vantage-point bias. Traffic and DNS metrics reflect what Cloudflare's edge + 1.1.1.1 saw; in-country traffic that doesn't egress to Cloudflare endpoints is not measured. The 91.6% Tehran share may overstate or understate the true population share depending on regional patterns of Cloudflare-resolved-domain access.
  • No identification of which sites / services recovered. The post provides aggregate traffic and DNS recovery figures; it does not name the domains or services that were on the whitelist before May 26 vs after. The selectivity of the whitelist relaxation is therefore not externally characterised.
  • No SIM / user-cohort data. The white-SIM mechanism (concepts/whitelist-internet-access) was operating before the partial restoration; the post does not say whether the white-SIM allowlist itself was widened, whether new SIM cohorts were added, or whether the whole filter was just loosened uniformly within Tehran.
  • Political signalling vs technical recovery. The vice-presidential announcement and the technical recovery occurred on the same day (announce ~early May 26, observe ~11:00 UTC May 26). Causation between the announcement and the operator-side filter relaxation is not characterised.
  • No new architectural deep-dive. This is a short observational update post by Cloudflare Radar standards, not a deep-dive into the Iranian shutdown architecture. Its contribution is the data point (87 days; first recovery; Tehran-localised; IPv6 still gone), not new architecture.

Source

Last updated · 542 distilled / 1,571 read