{"id":5705,"date":"2026-01-05T20:42:27","date_gmt":"2026-01-05T20:42:27","guid":{"rendered":"https:\/\/filter.watch\/english\/?p=5705"},"modified":"2026-01-22T14:53:44","modified_gmt":"2026-01-22T14:53:44","slug":"network-monitorig-december-2025-internet-repression-in-times-of-protest","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2026\/01\/05\/network-monitorig-december-2025-internet-repression-in-times-of-protest\/","title":{"rendered":"Connected but Unsafe: The Model of Regional Internet Repression During the December 2025 \u2013 January 2026 Protests"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">The pattern of internet disruption observed during the recent protests marks a strategic departure from the \"nationwide shutdowns\" of the past. Instead, it resembles the approach used during the Rouhani administration: localized, phased, and controlled restrictions designed to suffocate connectivity without fully severing it.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Field reports and technical evidence indicate that internet cuts and disruptions follow a clear logic: the implementation of localized restrictions rather than a complete network shutdown. This pattern suggests an\u00a0 \u201coperational order\u201d aimed at degrading network capacity and destabilizing the user experience. Notably, this continuity in policy is consistent with the current ICT Ministry\u2019s alignment with the managerial circle of former Minister Mohammad Javad Azari Jahromi.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The following analysis provides an overview of internet connectivity issues from the onset of protests on December 28 through January 4.\u00a0<\/span><\/p>\n<h4><b>1. The Strategy: Regional Disruptions Instead of a Nationwide Shutdown<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Unlike the 12-day war in June 2025, Iran\u2019s internet has not experienced a nationwide shutdown.\u00a0 Instead, it has entered a phase of chronic instability. While physically connected, stable communication\u2014whether for circumvention tools, web browsing, or messaging applications\u2014has become difficult to maintain.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">From the outset, disruptions have been hyper-localized.\u00a0 The pattern indicates a deliberate tightening of control over communication infrastructure in sensitive areas and protest locations rather than a blanket national kill-switch.\u00a0<\/span><\/p>\n<h5><b>1.1. Field Evidence: Mobile Internet Cuts and Severe Degradation<\/b><\/h5>\n<p><span style=\"font-weight: 400;\">Beginning on Monday, December 29, field reports highlighted a targeted suppression campaign targeting specific areas:\u00a0<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Tehran\u2019s Commercial &amp; Central Hubs<\/b><span style=\"font-weight: 400;\">: In neighborhoods surrounding the Grand Bazaar, mobile internet services provided by MCI (Hamrah-e Aval), Irancell, and Rightel were either completely cut off or effectively unusable. In the Baharestan and Amirkabir areas\u2014key administrative and commercial zones\u2014fixed-line services also faced early-morning disruptions.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>The \"Weak but Connected\" Zones<\/b><span style=\"font-weight: 400;\">: User accounts from Sadeghieh (west) and Haft-Tir (central) reported connections that were technically active but extremely weak across MCI, Irancell, and Shatel networks.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>High-Friction Areas<\/b><span style=\"font-weight: 400;\">: In contrast, routes through Amirabad, Enghelab, Valiasr Square, and Fatemi\u2014areas often associated with student movements and public gatherings\u2014were described as \"practically unusable for several hours,\" particularly on the Irancell network.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>West Tehran:<\/b><span style=\"font-weight: 400;\"> A report from Boulevard Ferdows described severe slowdowns and intermittent \"on-and-off\" connectivity. Users noted that VPNs failed persistently, requiring frequent configuration changes. Notably, there was no performance difference between domestic and international websites; both loaded slowly.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>The \"Zombie\" Connection: <\/b><span style=\"font-weight: 400;\">Across these areas, users reported that while VPNs might appear to connect, traffic would not pass through. WhatsApp failed to function, and speeds dropped to a \"very, very low\" level.<\/span><\/li>\n<\/ul>\n<h5><b>1.2 Disruptions Outside Tehran<\/b><\/h5>\n<p><span style=\"font-weight: 400;\">Outside the capital, the pattern of phased and regional disruptions continued:<\/span><\/p>\n<p><b>Isfahan Province<\/b><span style=\"font-weight: 400;\">: Severe speed degradation affected MCI and TCI fiber connections in the city of Isfahan. In the industrial and satellite towns of Fooladshahr and Falavarjan, users experienced complete outages for several hours.<\/span><\/p>\n<p><b>Southern &amp; Western Iran:<\/b><span style=\"font-weight: 400;\"> In Bushehr, disruptions in protest-affected areas were described as \"close to a full outage.\" In cities experiencing intense protest activity\u2014including Sanandaj, Ilam, Shiraz, Marvdasht, and Fasa, as well as Mashhad in the northeast\u2014users reported severe slowdowns and a total loss of international connectivity, limiting access strictly to domestic services.<\/span><\/p>\n<h4><b>2. Why Are Disruptions Regional?<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">User reports note,\u00a0 \u201cIt works a few kilometers away,\u201d or \u201cIt gets worse during specific time windows,\u201d or \u201cit\u2019s more severe on a particular operator or in a specific neighborhood.\u201d<\/span><\/p>\n<p><span style=\"font-weight: 400;\">From a network perspective, this heterogeneity results from enforcement at granular levels: the ISP Point of Presence ( PoP), provincial or city\u00a0 level, or even specific cell towers. \u00a0 Policy enforcement at the network edge varies\u00a0 by operator and by province.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Regional and phased\u00a0 disruptions allow authorities to calibrate pressure and disrupt coordination and effective communication among protesters without triggering the media shock associated with a full shutdown. This internet remains ostensibly online, rendering the network fragile and unreliable but not off.\u00a0\u00a0<\/span><\/p>\n<h4><b>3. The Blind Spots of Technical Charts\u00a0<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Why do macro-level data from\u00a0 Internet monitoring platforms like IODA show no nationwide flatline? \u00a0 Analysis of <\/span><a href=\"https:\/\/ioda.inetintel.cc.gatech.edu\/asn\/197207-1829?from=1766968354&amp;until=1767141154\"><span style=\"font-weight: 400;\">AS197207<\/span><\/a><span style=\"font-weight: 400;\"> (MCCI \u2013 Hamrah-e Aval) and <\/span><a href=\"https:\/\/ioda.inetintel.cc.gatech.edu\/asn\/44244-1829?from=1767034168&amp;until=1767206968&amp;view=view1\"><span style=\"font-weight: 400;\">AS44244<\/span><\/a><span style=\"font-weight: 400;\"> (IranCell) does not reveal a broad or significant traffic drop. However, this does not tell the full story.\u00a0<\/span><\/p>\n<p><b>Localized Tactics:<\/b><span style=\"font-weight: 400;\"> Experts explain that mobile disruptions are now \"tactical\"\u2014involving cell tower interference or centralized shutdowns limited to specific neighborhoods.\u00a0<\/span><\/p>\n<p><b>Measurement Limitations:<\/b><span style=\"font-weight: 400;\"> Due to CGNAT (Carrier-Grade NAT) architecture, measurement tools based on IODA or Cloudflare models cannot easily detect regional throttling or jamming. In short, mobile outages affecting a single neighborhood or a few streets are invisible in aggregate nationwide datasets.<\/span><\/p>\n<h4><b>4. Impact on Circumvention Tools<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Technical reports shared by circumvention tool developers with Filterwatch indicate a sophisticated escalation in anti-censorship tactics since late December.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Infrastructure Attacks: There has been a mass blocking of IP addresses and foreign servers used for tunneling. Even long-standing, stable servers have been flagged and blocked.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The \"No-Ping\" Phenomenon: According to user reports, during peak traffic hours (approx. 4:00 PM to 10:00 PM), VPNs may show a \"connected\" status but suffer such severe latency and packet loss that they effectively have \"no ping.\"\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Inconsistency: Users reported to Filterwatch that access to blocked apps is erratic. For example, at certain times, Instagram may be inaccessible while Telegram functions on the same VPN.<\/span><\/p>\n<h4><b>5. Traffic Analysis: \"Traffic Reduction\" vs. User Demand\u00a0<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Since December 31, <\/span><a href=\"https:\/\/radar.cloudflare.com\/traffic\/ir?dateRange=7d\"><span style=\"font-weight: 400;\">Cloudflare data shows<\/span><\/a><span style=\"font-weight: 400;\"> an approximate 35% reduction in internet traffic compared to the baseline.\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5.png\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-5713\" src=\"https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5.png\" alt=\"\" width=\"1600\" height=\"636\" srcset=\"https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5.png 1600w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5-300x119.png 300w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5-1024x407.png 1024w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5-768x305.png 768w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5-1536x611.png 1536w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-volume-29-to-5-1568x623.png 1568w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5.png\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-5712\" src=\"https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5.png\" alt=\"\" width=\"1600\" height=\"876\" srcset=\"https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5.png 1600w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5-300x164.png 300w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5-1024x561.png 1024w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5-768x420.png 768w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5-1536x841.png 1536w, https:\/\/filter.watch\/wp-content\/uploads\/sites\/2\/2026\/01\/traffic-trends-29-to-5-1568x858.png 1568w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/p>\n<p><span style=\"font-weight: 400;\">Notably, this drop does not indicate a decline in user demand.\u00a0 During periods of protest, demand generally increases. The traffic decline is a direct result of network interference - users attempt to connect, but timeouts, resets, and severe slowdowns block successful communication.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As a result, the observed traffic decline in recent days reflects the impact of network disruption rather than a decrease in user activity.<\/span><\/p>\n<h4><b>6. Protocol-Level Interference<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">On Saturday, January 2, the OONI Observatory<\/span><a href=\"https:\/\/x.com\/OpenObservatory\/status\/2007508011812892743?s=20\"><span style=\"font-weight: 400;\"> reported<\/span><\/a><span style=\"font-weight: 400;\"> \u201cprotocol-level anomalies\u201d affecting QUIC on MCI (Hamrah-e Aval) and IranCell networks.\u00a0 OONI noted a delay of several days in these effects appearing across\u00a0 operators suggesting a phased deployment.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">A large portion of the modern internet relies on a communication protocol known as QUIC for sending and receiving data\u2014whether when loading websites in a browser, sending messages within apps, or streaming video.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\"><strong>The Impact:<\/strong> Disruption of this protocol degrades the performance of modern apps and renders many VPNs (which mimic web traffic for obfuscation) unstable.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\"><strong>The Result:<\/strong> The network is technically \"connected\" at the IP layer, but disruption is shifted to higher layers. The user experience is: \"The internet appears connected, but nothing actually loads.\"<\/span><\/p>\n<h4><b>Calculated Network Interference to Suppress Ongoing Protests\u00a0<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Taken together, these observations indicate that the prevailing strategy for digitally suppressing the ongoing protests is to reduce the internet\u2019s effective capacity and undermine the user experience.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">What has been observed since the start of the protests is not a \u201cnationwide internet shutdown,\u201d but a pattern of regional disruptions, severe speed degradation, complete outages in some areas or a shift to \u201cdomestic-only\u201d connectivity, targeted blocking of VPNs, and intensified control over circumvention tools. This approach allows authorities to suppress information flows in key locations and protest areas without incurring the political cost of a full blackout.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The pattern of internet disruption observed during the recent protests marks a strategic departure from the \"nationwide shutdowns\" of the past. Instead, it resembles the approach used during the Rouhani administration: localized, phased, and controlled restrictions designed to suffocate connectivity without fully severing it.\u00a0 Field reports and technical evidence indicate that internet cuts and disruptions<a class=\"more-link\" href=\"https:\/\/filter.watch\/english\/2026\/01\/05\/network-monitorig-december-2025-internet-repression-in-times-of-protest\/\">Continue reading <span class=\"screen-reader-text\">\"Connected but Unsafe: The Model of Regional Internet Repression During the December 2025 \u2013 January 2026 Protests\"<\/span><\/a><\/p>\n","protected":false},"author":44,"featured_media":5777,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4],"tags":[261,306,200,349],"class_list":["post-5705","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network-monitor","tag-impact-of-censorship-on-internet","tag-internet-censorship-in-iran","tag-internet-disruption","tag-iran-protests-2026","entry"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/posts\/5705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/comments?post=5705"}],"version-history":[{"count":8,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/posts\/5705\/revisions"}],"predecessor-version":[{"id":5716,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/posts\/5705\/revisions\/5716"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/media\/5777"}],"wp:attachment":[{"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/media?parent=5705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/categories?post=5705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/filter.watch\/english\/wp-json\/wp\/v2\/tags?post=5705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}