On February 28, 2026, Iran’s internet connectivity sharply deteriorated during a combined US and Israeli assault on Iranian targets. Multiple public monitoring sources and major news coverage tied the near-total loss of access to the same day the strikes began.
What the Measurements Showed
Independent monitoring group NetBlocks reported that Iran’s national connectivity fell to about 4% of normal levels, a signal consistent with a near-countrywide interruption of access. Cloudflare traffic telemetry also showed extremely low traffic levels across Iran during the same time window, supporting the assessment that the disruption was a widespread and sustained outage.
Public telemetry cannot confirm the cause by itself – it can only show the measurable result: widespread loss of normal access. Note that there is more than one possible reason for a loss of normal access. For example, during the recent protests in Iran, the regime – facing one of its largest protest movements in years – shut down internet and telephone communications as the demonstrations grew more violent. Given Iran’s documented pattern of imposing nationwide shutdowns during crises and protests, the most defensible interpretation is that the blackout is at least partly the result of internal restrictions, even if external activity is also occurring. Or it may be a combination of factors, with hackers playing a part.
Why a Connectivity Collapse Matters
Loss of connectivity limits coordination, reduces the flow of information, constrains public communications, and complicates incident response across government and critical services. It also restricts what outside observers can verify in real time, which increases confusion and fuels speculation during a crisis.
What People Reported Experiencing
Alongside the traffic drop, accounts described difficulty accessing common online services used for communication and transactions. When national connectivity falls this low, it becomes hard to distinguish between different failure modes, including external disruption, internal restrictions, or a combination of both.
The strongest, most defensible statement is based on the measurable outcome: large portions of the country appeared unable to access the internet normally for a period of time.
The Security Takeaway for Defenders
Availability is now a primary target in modern conflict. Disruption delivers immediate impact, and it can be achieved through several paths, such as high-volume and application-layer DDoS attacks that overload systems.
This matters beyond Iran. When cyber disruption is timed in conjunction with military operations, it increases the likelihood of retaliatory or copycat activity against related parties and perceived allies. US, Israel and Israel-linked organizations should assume elevated DDoS risk particularly during this period of heightened tension.
To learn more about reducing the risk of damaging DDoS attacks, speak with an expert.
Skim Summary
- On February 28, 2026, Iran experienced a sharp nationwide drop in internet availability during a combined US and Israeli assault on Iranian targets.
- NetBlocks reported national connectivity fell to about 4% of normal levels, consistent with a near-total disruption.
- Cloudflare traffic telemetry showed extremely low traffic levels across Iran during the same time window, supporting the assessment of a widespread, sustained outage.
- The incident highlights how availability has become a primary target in modern conflict, including through high-volume and application-layer DDoS pressure.
- It also signals elevated risk of retaliatory or copycat attacks that can extend to US, Israel, and Israel-linked organizations during heightened tension.
FAQ
What happened to Iran’s internet on February 28, 2026?
Iran experienced a sharp nationwide connectivity disruption during the same window as a combined US and Israeli assault on Iranian targets.
Did Iran’s internet really drop to 4% of normal?
NetBlocks reported Iran’s national connectivity at about 4% of typical levels, which is consistent with a near-total outage.
Was the Iran outage caused by a cyberattack, an internal shutdown, or both?
Public telemetry cannot confirm the cause by itself. It can only show the measurable result: widespread loss of normal access.
Why is internet connectivity a target during modern military operations?
Because it limits communication, coordination, public messaging, and incident response, and it also makes independent verification harder.
What does this mean for DDoS risk for US, Israel, and Israel-linked organizations?
Geopolitical escalation often increases retaliatory and copycat DDoS activity, including application-layer attacks against logins, portals, and critical APIs.
What is a “national internet blackout” and what does it mean for people on the ground?
It means most users cannot access the global internet normally, which disrupts messaging, news, payments, and online services, and makes it harder to confirm what is happening in real time.
