Digital Impact Lab

Intelligence on Iran's digital operations. Cyber, influence, sanctions evasion, network infrastructure. Washington, D.C.

[Digital Impact Lab @DigImpactLab]

When Iran's internet came back on May 26, Cloudflare's data showed something unexpected: Iranian users were appearing to the global internet as Azerbaijani.
Not a glitch. Not a VPN. Infrastructure.
https://t.co/vM9LxZE51V

[Digital Impact Lab @DigImpactLab]

@markpash Most of our sources are inside Iran, so we redact all individual social media users by default regardless of location. It's a protective measure. On the citation: the source for that section was your tweets directly, not the article.

[Digital Impact Lab @DigImpactLab]

Iran’s internet blackout has a structural gap. The state blocked most of the international internet. It left Google’s infrastructure accessible. Within weeks, the Iranian technical community had built an entire circumvention ecosystem out of that exemption, on GitHub, distributed free.

[Digital Impact Lab @DigImpactLab]

@markpash @AminSabeti Thanks for the note. @mahsanet's analysis is cited and linked in the full piece; it's one of our primary sources. The thread format doesn't carry footnotes, but the article does. MahsaNet also shared our report on their own account, which we appreciated.

[Digital Impact Lab @DigImpactLab]

When Iran's internet came back on May 26, Cloudflare's data showed something unexpected: Iranian users were appearing to the global internet as Azerbaijani.
Not a glitch. Not a VPN. Infrastructure.
https://t.co/vM9LxZE51V

[Digital Impact Lab @DigImpactLab]

The Cloudflare Radar spike is timestamped to May 26, the exact day Iran's internet was partially restored.
It doesn't look like infrastructure assembled after the restoration. It looks like infrastructure waiting to be switched on.
Full analysis:
https://t.co/vM9LxZE51V

[Digital Impact Lab @DigImpactLab]

This isn't improvised. Iran's state backbone operator (TIC) signed a formal strategic agreement with Delta Telecom CEO Ramazan Valiyev in April 2025. The routing is consistent across ISPs because it happens at the backbone level.

[Digital Impact Lab @DigImpactLab]

The government did not liberalize. It abandoned a monetization scheme (Internet Pro) that failed to achieve public adoption, restored the filternet that existed before January 8, and claimed credit for the restoration. The laws and infrastructure that made 88 days possible are unchanged.
Full analysis: https://t.co/O6JHC2hyPh

[Digital Impact Lab @DigImpactLab]

Iran’s internet is back. Sort of. After 88 days of near-total blackout, Cloudflare Radar confirmed traffic restored to 40% of pre-shutdown levels on May 26, with 91.6% of that concentrated in Tehran. Provinces outside the capital remain near blackout conditions. A thread.

[Digital Impact Lab @DigImpactLab]

Data centers tell the same story. An operator who tested Pishgaman, Afranet, and Sefroyek the day after restoration: “Most data centers still have no connectivity… Our servers still have no ping to foreign servers.” Infrastructure for circumvention remains under pressure by design.

[Iran International English @IranIntl_En]

Iran may be moving beyond temporary internet blackouts toward something more durable: a Chinese-style system of digital control.
https://t.co/T5wLuUadcT

[Digital Impact Lab @DigImpactLab]

The Internet Filtering Committee updates its filters. The developers release a new version. Each iteration: an institution with significant resources and enforcement power vs. individuals working in their spare time, in public, for free.

Full analysis: https://t.co/O2gc8mZSPK

[Digital Impact Lab @DigImpactLab]

Iran has over 70 million internet users. The vast majority have no technical background and no means to pay for commercial access. A handful of engineers, in public repositories, are maintaining the primary non-commercial pathway to the open internet for a country the size of France and Germany combined.