Following the joint US–Israeli military strikes on February 28, 2026, Iranian authorities immediately imposed a near-total international internet blackout. While the National Information Network remains active to preserve domestic services, global connectivity has been systematically dismantled. This latest analysis—a collaborative effort between Miaan, ASL19, Kentik, IODA, Cloudflare, Holistic Resilience, and DeltaChat—analyzes the technical nature of this wartime shutdown and the strategic utility of the state's digital whitelisting model.
The technical patterns observed by international network researchers directly align with a shift toward service and user-level whitelisting policies. Domestic news agencies have published lists of essential websites accessible via the national network, while select individuals and entities retain access through "white-sim cards." Furthermore, global access has been transformed into a vetted, high-priced privilege through initiatives like the "Pro Internet" plan, which requires special SIM cards priced at over 2 million tomans and formal identity verification. By implementing tiered pricing for international traffic, the state is effectively monetizing censorship while ensuring those with connectivity remain fully traceable.
To enforce this isolation, authorities have used direct SMS alerts from a sender ID labeled 'POLICE' to threaten users. These messages, received by a subset of the population, warn that repeated attempts to connect to the international internet will lead to phone lines being blocked and judicial prosecution. By sending these alerts directly to personal devices, the state is effectively criminalizing the act of trying to access the global web.
Technical indicators provided by the contributing network monitors document the transition of Iran's network from a standard open architecture to a fragmented, whitelisted environment. Data shows the blackout occurred in two stages on February 28, eventually falling to nearly zero traffic across the country’s three main operators. While the initial shutdown followed a clear policy-driven pattern, subsequent disruptions after March 1 across disparate providers suggest the possibility of physical damage to shared infrastructure resulting from the ongoing conflict.
Amidst these restrictions, resilient communication tools have become essential. DeltaChat remains one of the main functional tools, with servers inside the country allowing users to communicate securely within Iran. Similarly, Starlink has waived subscription fees for users inside the country, and the rise of home-made Starlink VPNs has helped users share these connections with their trusted networks over the domestic infrastructure.
We are publishing this analysis as a live Google doc to allow for real-time updates as the situation evolves and new data becomes available. The full version of the report, including detailed technical analysis and supporting network metrics, is available here:
Additionally, we are now sharing our comprehensive report on the January 2026 internet shutdown. Although its publication was delayed by the recent escalation of conflict, the report provides critical analysis of the state's landmark transition to a structural "blocked-by-default" architecture and the resilient domestic "Helper Communities" that emerged to challenge it.You can view the full January report here:
