{"id":17221,"date":"2025-07-24T00:05:22","date_gmt":"2025-07-24T00:05:22","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/17221\/"},"modified":"2025-07-24T00:05:22","modified_gmt":"2025-07-24T00:05:22","slug":"the-q2-2025-internet-disruption-summary","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/17221\/","title":{"rendered":"the Q2 2025 Internet disruption summary"},"content":{"rendered":"

Cloudflare\u2019s network<\/a> currently spans more than 330 cities in over 125 countries, and we interconnect with over 13,000 network providers in order to provide a broad range of services to millions of customers. The breadth of both our network and our customer base provides us with a unique perspective on Internet resilience, enabling us to observe the impact of Internet disruptions at both a local and national level, as well as at a network level.<\/p>\n

As we have noted in the past, this post is intended as a summary overview of observed and confirmed disruptions, and is not an exhaustive or complete list of issues that have occurred during the quarter. A larger list of detected traffic anomalies is available in the Cloudflare Radar Outage Center<\/a>. Note that both bytes-based and request-based traffic graphs are used within the post to illustrate the impact of the observed disruptions \u2014 the choice of metric was generally made based on which better illustrated the impact of the disruption.<\/p>\n

In our Q1 2025 summary post<\/a>, we noted that we had not observed any government-directed Internet shutdowns during the quarter. Unfortunately, that forward progress was short-lived \u2014 in the second quarter of 2025, we observed shutdowns<\/a> in Libya, Iran, Iraq, Syria, and Panama. The Internet\u2019s reliance on a stable electric grid was made abundantly clear during the quarter, with a massive power outage<\/a> impacting Spain and Portugal disrupting connectivity within those countries. Fiber optic cable cuts<\/a> impacted providers in Haiti and Malawi, major North American providers saw technical problems<\/a> disrupt Internet traffic, and a Russian provider was once again targeted by a significant cyberattack<\/a>, knocking the network offline. Unfortunately, official attribution of an Internet outage\u2019s root cause isn\u2019t always available \u2014 and we observed several significant, yet unexplained<\/a>, Internet outages during the quarter.<\/p>\n

Government-directed shutdowns
\n <\/p>\n

<\/a><\/p>\n

On May 16, Internet disruptions were observed across multiple Libyan<\/a> network providers, with connectivity reportedly shut down in response to public protests<\/a> against the Government of National Unity. Starting at 13:30 UTC (15:30 local time), traffic dropped by more than 50% as compared to the prior week at Libyan International Company for Technology (AS329129)<\/a>, Giga Communication (AS328539)<\/a>, Aljeel Aljadeed for Technology (AS37284)<\/a>, and Awal Telecom (AS328733)<\/a>, with the latter experiencing a complete outage. Lower traffic volumes were observed until around 00:00 UTC (02:00 local time), with traffic restoration occurring within an hour or so on either side. Giga Communication (AS328539) experienced a second disruption on May 17 between 02:00 – 11:30 UTC (04:00 – 13:30 local time).<\/p>\n

Multiple Internet shutdowns occurred in Iran<\/a> in June following Israel\u2019s initial attacks on the country\u2019s nuclear sites<\/a>. The first, on June 13, occurred between 07:15 – 09:45 UTC (10:45 – 13:15 local time). Iran\u2019s Ministry of Communications issued a statement<\/a> that announced the shutdown: \u201cIn light of the country’s special circumstances and based on the measures taken by the competent authorities, temporary restrictions have been imposed on the country’s Internet. It is obvious that these restrictions will be lifted once normal conditions are restored.\u201d This shutdown order impacted network providers including FanapTelecom (AS24631)<\/a>, Rasana (AS205647<\/a> and AS31549<\/a>), MCCI (AS197207)<\/a>, and TCI (AS58224)<\/a>, as well as others.<\/p>\n

On June 17, Internet connectivity was again restricted, this time reportedly in an effort to \u201cward off cyber attacks\u201d<\/a>, according to a government spokesperson. This second round of shutdowns began at 17:30 local time (14:00 UTC), impacting multiple networks. Traffic recovered at 15:30 UTC (19:00 local time) on FanapTelecom (AS24631)<\/a> and Pars Online (AS16322)<\/a>, at 20:00 UTC (23:30 local time) on MCCI (AS197207)<\/a> and IranCell (AS44244)<\/a>, at 22:00 UTC on June 17 (01:30 on June 18 local time) on RighTel (AS57218)<\/a>, and at 06:00 UTC on June 18 (09:30 local time) on Rasana (AS31549<\/a> and AS205647<\/a>).<\/p>\n

During these initial Internet shutdowns, incoming Internet traffic was reportedly<\/a> also blocked, and user access was limited to Iran\u2019s domestic \u201cNational Information Network\u201d (NIN)<\/a>.<\/p>\n

Just a day later, on June 18, an extended third shutdown was put into place, this one lasting from 12:50 UTC (16:20 local time) through 05:00 UTC (08:30 local time) on June 25. Once again, the shutdown was reportedly implemented as a means of protecting against cyberattacks<\/a>, with a government spokesperson commenting \u201cWe have previously stated that if necessary, we will certainly switch to a national internet and restrict global internet access. Security is our main concern, and we are witnessing cyberattacks on the country\u2019s critical infrastructure and disruptions in the functioning of banks. Many of the enemy\u2019s drones are managed and controlled via the internet, and a large amount of information is exchanged this way. A cryptocurrency exchange was also hacked, and considering all these issues, we have decided to impose Internet restrictions.\u201d This shutdown resulted in a near-complete loss of traffic through 02:00 UTC (05:30 local time) on June 21, when some traffic recovery was observed, though at levels remaining well-below pre-shutdown volumes. Traffic from this partial recovery settled into a consistent cycle for several days, until returning to expected levels on June 25. The same network providers impacted by the previous shutdowns were affected by this one as well.<\/p>\n

Consistent with measures taken over the past several years (2024<\/a>, 2023<\/a>, 2022<\/a>), governments in Iraq<\/a> again implemented regular Internet shutdowns in an effort to prevent cheating on national exams. (We say \u201cgovernments\u201d here because the shutdowns took place both in the main part of the country and in the Iraqi Kurdistan region in the northern part of the country.)<\/p>\n

Occurring between 03:00 – 05:00 UTC (06:00 – 08:00 local time<\/a>) at the request of the Ministry of Education, the shutdowns in the main part of the country started on May 20 and ran through June 4 for middle school exams, and from June 14 until July 3 for preparatory school exams<\/a>. Network providers that implemented the shutdowns included Earthlink (AS199739)<\/a>, Asiacell (AS51684)<\/a>, Zainas (AS59588)<\/a>, Halasat (AS58322)<\/a>, and HulumTele (AS203214)<\/a>.<\/p>\n

In the Kurdistan region, the shutdowns began June 1, and ran through July 6, taking place between 03:30 – 04:30 UTC (06:30 – 07:30 local time)<\/a> on Wednesdays and Sundays. Network providers that implemented the shutdowns included IQ Online (AS48492)<\/a>, KorekTel (AS59625)<\/a>, Newroz Telecom (AS21277)<\/a>, and KNET (AS206206)<\/a>.<\/p>\n

As Iraq does, Syria<\/a> also implements nationwide Internet shutdowns to prevent cheating on exams, and has been doing so for several years (2021<\/a>, 2022<\/a>, 2023<\/a>, 2024<\/a>). However, in contrast to previous years, in 2025, the government only ordered the cutoff of cellular connectivity, with a published statement<\/a> noting (translated) \u201cAs part of our commitment to ensuring the integrity of public examinations and safeguarding the future of our dear students, and based on our national responsibility to secure a fair and transparent examination environment, a temporary cellular communications blackout will be implemented in areas near examination centers across the Syrian Arab Republic. \u2026 The cellular communications blackout will be implemented exclusively within the narrowest possible geographical and timeframe, during the time students are in exam halls.\u201d<\/p>\n

During the second quarter, the shutdowns associated with the \u201cBasic Education Certificate\u201d took place on June 21, 24, and 29 between 05:15 – 06:00 UTC (08:15 – 09:00 local time). Exams and associated shutdowns for the \u201cSecondary Education Certificate\u201d are scheduled to take place between July 12 and August 3.<\/p>\n

Because these shutdowns only impacted mobile connectivity, they only resulted in a partial drop in announced IP address space, as opposed to a more complete loss as seen in previous years<\/a>.<\/p>\n

On June 21, an X post<\/a> from ASEP Panam\u00e1<\/a> (the telecommunications regulating agency) announced that (translated) \u201c…in compliance with Cabinet Decree No. 27 of June 20, 2025, and by formal instruction from the Ministry of Government, the temporary suspension of mobile telephony and residential internet services in the province of Bocas del Toro has been coordinated.\u201d The suspension, according to the post, was supposed to be in place until June 25, however a subsequent X post<\/a> noted that it would be extended until Sunday, June 29, 2025.<\/p>\n

The suspension of Internet connectivity was implemented in response to<\/a> protests and demonstrations against reforms to the Social Security Fund, retirement, and pensions, specifically in the province of Bocas del Toro.<\/p>\n

The graph below shows an effective loss of traffic from Cable Onda (AS18809)<\/a> in Bocas Del Toro, Panama<\/a> around 03:30 UTC on June 21 (22:30 local time on June 20), recovering around 06:00 UTC (01:00 local time) on June 30. The recovery is in line with the final related X post<\/a> from ASEP, which noted (translated) \u201c… Internet and cellular telephone services in the province of Bocas del Toro have been restored as of 12:01 a.m. on Monday, June 30\u2026\u201d.<\/p>\n

Power outages lead to Internet outages
\n <\/p>\n

<\/a><\/p>\n

The big power outage story during the second quarter was the massive outage across much of Portugal<\/a> and Spain<\/a> on April 28. The impact of the event was covered in detail in the How the April 28, 2025, power outage in Portugal and Spain impacted Internet traffic and connectivity blog post<\/a>, which explored shifts in traffic at a country\/network\/regional level, as well as how the power outage impacted network quality and announced IP address space.<\/p>\n

In Portugal, Internet traffic dropped as the power grid failed \u2014 when compared with the previous week, traffic fell ~50\u202f%\u202fimmediately and within five hours it was ~90% below the week before.<\/p>\n

In Spain, Internet traffic dropped as the power grid failed, with traffic immediately dropping by around 60% as compared to the previous week, falling to approximately 80% below the previous week within the next five hours.<\/p>\n

In both countries, traffic returned to expected levels around 01:00 local time (midnight UTC) on April 29. More details about the outage can be found in the blog post linked above.<\/p>\n

It appears that Morocco<\/a> may have also been impacted in some fashion by the Portugal\/Spain power outage, or at least Orange Maroc was. In a post on X<\/a>, the provider stated (translated) \u201cInternet traffic has been disrupted following a massive power outage in Spain and Portugal, which is affecting international connections.\u201d Traffic from the network (AS36925)<\/a> fell sharply around 12:00 UTC (13:00 local time), 90 minutes after the power outage began, with a full outage beginning around 15:00 UTC (16:00 local time). Traffic returned to expected levels around 23:30 UTC on April 28 (00:30 local time on April 29).<\/p>\n

Genera PR<\/a>, a power company in Puerto Rico<\/a>, posted on X<\/a> on April 16 that they had (translated) \u201c…experienced a massive power outage across the island due to the unexpected shutdown of all generating plants, including those of Genera PR and other private generators. This situation has caused a significant disruption to electrical service\u2026\u201d Luma Energy<\/a>, the private power company that is responsible for power distribution and power transmission in Puerto Rico, published their own X post<\/a> that stated (translated) \u201cApproximately at 12:40pm, an event was recorded that affects the service island-wide.\u201d<\/p>\n

Although the reported power outage was \u201cmassive\u201d and \u201cisland-wide\u201d, it did not have an outsized impact on Puerto Rico\u2019s Internet traffic<\/a>, which initially dropped by about 40%<\/a>. Over the next several days, both companies published multiple updates to their X accounts detailing the progress being made in restoring service. By 15:00 UTC (11:00 local time) on April 18, traffic had returned to expected levels, in line with a post from Luma Energy that noted (translated) \u201cAs of 10:00 a.m. on April 18, and thanks to LUMA\u2019s extraordinary response and the tireless efforts of the island\u2019s workforce\u2014in coordination with the Puerto Rico government and generating companies\u2014LUMA has restored electric service to 1,450,367 customers, representing 98.8% of total customers, in less than 38 hours since the island-wide outage began.\u201d<\/p>\n

As seen in the graphs below, the power outage not only impacted end-user connectivity, driving the observed drop in traffic, but also had some impact on local Internet infrastructure, with some disturbance visible to announced IP address space<\/a>.<\/p>\n

A Facebook post<\/a> from SKELEC (The St. Kitts Electricity Company)<\/a> on May 9 alerted customers on St. Kitts and Nevis<\/a> that \u201c…a fault developed at our Needsmust Power Plant resulting in an island wide outage. Restoration has begun, and complete restoration will be in two hours.\u201d The post was published at 17:31 UTC (13:31 local time), approximately 30 minutes after the island\u2019s Internet traffic initially dropped. Traffic recovery initially began around 17:45 UTC (13:45 local time), well within the two-hour estimate for complete power restoration. However, Internet traffic did not fully return to expected levels until 20:15 UTC (16:15 local time).<\/p>\n

On May 18, it was reported<\/a> that \u201cHigh voltages in the regional 400 kV network amid low consumption caused a short-term outage in North Macedonia<\/a>‘s 110 kV transmission network\u2026\u201d, according to state-owned power company MEPSO<\/a>. While the outage reportedly impacted most of the country, MEPSO also noted that the country\u2019s power supply was normalized within an hour after the outage began. Although brief, the power outage caused the country\u2019s Internet traffic to drop by nearly 60% as compared to the previous week during the disruption, which occurred between 03:00 – 04:45 UTC (05:00 – 06:45 local time).<\/p>\n

On June 1, Internet traffic in the Maldives<\/a> dropped by nearly half as compared to the previous week when a widespread power outage<\/a> affected the Greater Mal\u00e9 region. Local Internet service providers including Ooredoo<\/a> and Dhiraagu<\/a> took to social media to warn subscribers of potential interruptions to both fixed and mobile broadband connections. At a country level, Internet traffic was disrupted between 07:30 – 13:00 UTC (12:30 – 18:00 local time).<\/p>\n

The power outage also had a nominal impact on Internet infrastructure, as announced IPv4 address space<\/a> saw a nominal drop (from 355 to 350 \/24s) that began shortly after the initial drop in traffic was observed, but returned to normal as the disruption ended.<\/p>\n

A near-complete Internet outage at provider Flow Cura\u00e7ao (AS52233)<\/a> on June 14-15 sparked outrage<\/a> and demands for answers<\/a> by the country\u2019s telecommunications regulator. Flow\u2019s Internet traffic dropped significantly at 18:00 UTC (14:00 local time) on June 14, falling further in the following hours. Signs of recovery became visible around 11:00 UTC (07:00 local time) on June 15, with more complete recovery occurring at 14:00 UTC (10:00 local time). A Facebook post from Flow Barbados<\/a>, posted on June 18, referenced a local disruption that began on June 14, but pointed at a commercial power outage at one of their key regional network facilities in Cura\u00e7ao, which was likely the driver of this Internet outage.<\/p>\n

Two instances of damage to its fiber optic infrastructure caused a complete Internet outage at Digicel Haiti (AS27653)<\/a> as of 21:00 UTC (17:00 local time) on May 28, according to a (translated) X post<\/a> from the company\u2019s Director General. The cable damage took the network completely off the Internet, as announced IPv4 and IPv6 address space<\/a> also dropped to zero. Digicel Haiti remained offline until 00:45 on May 29 (20:45 local time on May 28), when both traffic and announced IP address space returned to expected levels.<\/p>\n

Airtel Malawi (AS37440)<\/a> experienced a 90-minute Internet outage on June 24, caused by ongoing vandalism on their fiber network<\/a>. Although traffic effectively disappeared between 12:30 – 14:00 UTC (14:30 – 16:00 local time), the network remained at least partially online as at least some of the network\u2019s IPv4 address space<\/a> continued to be announced to the Internet.\u00a0 Announced IPv6 address space, however, fell to zero during the duration of the outage.<\/p>\n

A router update<\/a> gone awry disrupted Internet service for Bell Canada (AS577)<\/a> customers in Ontario and Quebec on May 21. An initial X post from the provider<\/a>, posted at 13:52 UTC (09:52 local time), alerted customers to the service interruption. The post trailed the start of the disruption by approximately a half hour, as traffic dropped around 13:15 UTC (09:15 local time), falling by as much as 70% as compared to the same time a week prior. Request traffic to Cloudflare\u2019s 1.1.1.1 DNS Resolver<\/a> also saw a significant drop. A negligible decline in announced IPv4 address space<\/a> was also observed.<\/p>\n

The disruption was fairly short-lived, with traffic returning to expected levels just an hour later. A subsequent X post<\/a> confirmed that services had been fully restored by 15:00 UTC (11:00 local time), with another post<\/a> noting that the initial update had been rolled back quickly to restore service.\u00a0<\/p>\n

Across parts of the United States<\/a>, Lumen\/CenturyLink (AS209)<\/a> customers experienced a widespread Internet service disruption on June 19. Traffic volumes dropped by over 50% as compared to the prior week starting around 21:45 UTC. The disruption only lasted a couple of hours, with traffic returning to normal by 00:00 UTC on June 20.<\/p>\n

Social media posts from affected subscribers suggested that the problem might have been DNS related, as those that switched their DNS resolver to Cloudflare\u2019s 1.1.1.1<\/a> were once again able to access the Internet. The graph below shows that traffic to 1.1.1.1 from Lumen\/CenturyLink<\/a> exceeded levels seen the previous week as the disruption began, and remained elevated through June 20. Problems with an Internet service provider\u2019s DNS resolver can appear to subscribers like an Internet outage, as they become unable to access anything requiring a DNS lookup (effectively, all Internet resources), ultimately resulting in a drop in traffic to those resources (from the affected user base), as seen in the graph above.<\/p>\n

Russian<\/a> Internet provider ASVT (AS8752)<\/a> was reportedly<\/a> targeted by a major DDoS attack that resulted in a multi-day complete Internet outage. This attack followed one targeting Russian provider Nodex<\/a> (AS29329<\/a>) in March, which also caused a complete service outage. Reaching<\/a> 70.07 Gbps\/6.92 million packets\/second, the attack caused traffic to drop to near zero around 05:00 UTC on May 28 (08:00 Moscow time), with the effective outage lasting for approximately 10 hours. Although traffic began to return around 15:00 UTC (18:00 Moscow time), it remained below expected levels throughout the following week.<\/p>\n

Interestingly, query volume to Cloudflare\u2019s 1.1.1.1 DNS Resolver from ASVT<\/a> saw a rapid increase as traffic began to return after the initial outage, and remained elevated throughout the duration of the disruption. It isn\u2019t clear whether the increase could be related to problems with ASVT\u2019s native DNS resolver during the attack, forcing users to seek alternative resolvers, or if it could be related to ASVT subscribers seeking ways around damage from the attack.<\/p>\n

According to a (now unavailable) \u201cDisturbance bulletin\u201d<\/a> and an associated X post<\/a> from Telia Finland (AS1759)<\/a>, the company acknowledged that \u201cA widespread disruption has been detected in the operation of mobile network data connections and fixed broadband.\u201d The widespread disruption resulted in a brief near-complete outage for subscribers between 06:30 – 07:15 UTC (09:30 – 10:15 local time).<\/p>\n

Telia Finland did not disclose the cause of the disruption, but it is clear that it impacted IPv4 connectivity, as seen in the graph below showing announced IPv4 address space<\/a>. (Announced IPv6 address space<\/a> did not see any change.) This loss of IPv4 connectivity resulted in a concurrent spike in the share of traffic from Telia Finland over IPv6 \u2014 normally below 5%, it spiked above 30% during the disruption. Request traffic to Cloudflare\u2019s 1.1.1.1 resolver from Telia Finland<\/a> also spiked at that time.<\/p>\n

Around 19:15 UTC on May 7 (03:15 local time on May 8), subscribers of SkyCable (AS23944)<\/a> in the Philippines<\/a> experienced a complete Internet outage. Internet traffic from the network dropped to zero, as did announced IPv4 address space<\/a>. The disruption lasted until 03:00 UTC on May 8 (11:00 local time), and SkyCable did not publish any information regarding the cause of the eight-hour service outage.<\/p>\n

On May 22, Thai<\/a> mobile provider TrueMove H (AS132061)<\/a> suffered a nationwide outage<\/a>, impacting connectivity for subscribers. The provider acknowledged and apologized<\/a> for the disruption, but did not provide an official reason for the outage. (An article<\/a> in the local press reported \u201cthat the outage was caused by technical errors on True\u2019s computer servers\u201d and also stated that others suggested that \u201cthe problem might have been caused by an error on True\u2019s DNS servers\u201d.)<\/p>\n

At 03:00 UTC (10:00 local time), traffic initially dropped by over 80% as compared to the prior week. Almost immediately, traffic began to slowly recover, and returned to expected levels around 08:00 UTC (15:00 local time). A brief partial drop in announced IPv4 address space was also observed<\/a> during the first hour of the disruption.<\/p>\n

Two days after experiencing an outage due to cable damage<\/a>, Digicel Haiti (AS27653)<\/a> experienced another complete outage on May 30. In contrast to the previous outage, no additional information about this one was published on social media by Digicel Haiti<\/a> or its Director General<\/a>. The network effectively disappeared from the Internet at 14:15 UTC (10:15 local time), with both traffic and announced IP address space<\/a> (IPv4 & IPv6) dropping to zero. The outage lasted nearly three hours, with traffic and announced IP space all returning around 17:00 UTC (13:00 local time).<\/p>\n

On June 10, an Internet outage in Syria<\/a> reportedly<\/a> affected the ADSL landline network across multiple provinces. Traffic dropped by as much as two-thirds below the same time the previous week at 08:15 UTC (11:15 local time), with the disruption lasting two hours. Announced IPv4 address space<\/a> also fell during the course of the outage, indicating a potential infrastructure issue. However, as seen below, request volume from Syria to Cloudflare\u2019s 1.1.1.1 DNS resolver<\/a> was also elevated during the outage. This behavior has been observed in the past during government-directed shutdowns of Internet connectivity in Syria, when traffic can leave the country, but not return. There was no other indication that this outage was due to an intentional shutdown, but no official explanation for the disruption was available.<\/p>\n

Government-directed Internet shutdowns returned with a vengeance in the second quarter, and that trend continues into the third quarter, though the latest ones have been exam-related, and not driven by protests. And while power-outage related Internet disruptions have frequently been observed in the past, often in smaller countries with less stable infrastructure, the massive outage in Spain and Portugal on April 28 reminds us that much like the Internet, electrical infrastructure is often interconnected across countries, meaning that problems in one can potentially cause significant problems in others.<\/p>\n

The Cloudflare Radar team is constantly monitoring for Internet disruptions, sharing our observations on the Cloudflare Radar Outage Center<\/a>, via social media, and in posts on blog.cloudflare.com<\/a>. Follow us on social media at @CloudflareRadar<\/a> (X), noc.social\/@cloudflareradar<\/a> (Mastodon), and radar.cloudflare.com<\/a> (Bluesky), or contact us via email.<\/p>\n