Internet outages reach 'shutdown season' across 125 countries in Q2 2025

Government-directed Internet shutdowns returned with significant force during the second quarter of 2025, marking what Cloudflare characterizes as "shutdown season" in its quarterly disruption summary released July 22. The analysis reveals a stark contrast to the first quarter, when no government-directed shutdowns were observed, signaling a concerning trend for digital infrastructure stability.

According to Cloudflare's network monitoring data, shutdowns occurred in Libya, Iran, Iraq, Syria, and Panama during Q2 2025. These disruptions complement ongoing power-related outages that affected Spain, Portugal, Puerto Rico, and several other nations, creating a complex landscape of connectivity challenges for businesses operating digital marketing campaigns.

The breadth of Cloudflare's network, spanning more than 330 cities across 125 countries with interconnections to over 13,000 network providers, provides comprehensive visibility into Internet resilience patterns. This positioning enables detailed observation of disruption impacts at local, national, and network levels.

Government-directed shutdowns dominate disruptions

Libya experienced Internet disruptions across multiple network providers on May 16, beginning at 13:30 UTC in response to public protests against the Government of National Unity. Traffic volumes dropped by more than 50% compared to the prior week at Libyan International Company for Technology (AS329129), Giga Communication (AS328539), Aljeel Aljadeed for Technology (AS37284), and Awal Telecom (AS328733). Awal Telecom suffered a complete outage during the disruption period.

Iran implemented multiple shutdowns throughout June following Israel's attacks on nuclear sites. The first shutdown occurred June 13 between 07:15-09:45 UTC, accompanied by an official statement from Iran's Ministry of Communications announcing temporary restrictions due to "special circumstances." The ministry stated that restrictions would be lifted "once normal conditions are restored."

A second Iranian shutdown began June 17 at 17:30 local time, reportedly implemented to "ward off cyber attacks" according to government spokespersons. This disruption affected multiple networks including FanapTelecom (AS24631), Pars Online (AS16322), MCCI (AS197207), and IranCell (AS44244), with recovery times varying significantly across providers.

The most extensive Iranian shutdown commenced June 18, lasting from 12:50 UTC through 05:00 UTC on June 25. Government officials stated this extended disruption targeted cybersecurity threats, with particular concern about drone management and cryptocurrency exchange security. During these shutdowns, users could only access Iran's domestic "National Information Network" (NIN).

Iraq continued its established pattern of exam-related shutdowns, implementing restrictions from May 20 through July 3 for middle school and preparatory school examinations. Shutdowns occurred between 03:00-05:00 UTC daily at the Ministry of Education's request. Network providers including Earthlink (AS199739), Asiacell (AS51684), Zainas (AS59588), Halasat (AS58322), and HulumTele (AS203214) participated in the main country restrictions.

In the Kurdistan region, shutdowns ran from June 1 through July 6, occurring between 03:30-04:30 UTC on Wednesdays and Sundays. Kurdistan providers including IQ Online (AS48492), KorekTel (AS59625), Newroz Telecom (AS21277), and KNET (AS206206) implemented these restrictions.

Syria modified its approach in 2025, implementing cellular-only shutdowns rather than complete Internet blackouts for exam periods. The government published statements noting the "temporary cellular communications blackout" would be implemented "exclusively within the narrowest possible geographical and timeframe." Basic Education Certificate exams occurred June 21, 24, and 29 between 05:15-06:00 UTC, with Secondary Education Certificate exams scheduled for July 12 through August 3.

Panama implemented Internet suspension in Bocas del Toro province from June 21-29 in response to protests against Social Security Fund reforms. ASEP Panamá announced the suspension via social media, noting compliance with Cabinet Decree No. 27 and formal instruction from the Ministry of Government. Cable Onda (AS18809) experienced effective traffic loss around 03:30 UTC on June 21, with recovery occurring at 06:00 UTC on June 30.

Power infrastructure failures cascade to digital networks

The second quarter's most significant power-related disruption occurred April 28, affecting Portugal and Spain with cascading impacts on Internet infrastructure. Portugal experienced immediate traffic drops of approximately 50%, falling to 90% below previous week levels within five hours. Spain saw comparable patterns with traffic dropping 60% initially, reaching 80% below normal within five hours.

Morocco's Orange Maroc (AS36925) reported secondary impacts from the Portugal-Spain outage, with traffic falling sharply 90 minutes after the power failure began. The provider posted on social media that "Internet traffic has been disrupted following a massive power outage in Spain and Portugal, which is affecting international connections."

Puerto Rico experienced an island-wide power outage on April 16 when all generating plants shut down unexpectedly. Despite the reported "massive" scope, Internet traffic initially dropped by approximately 40% rather than experiencing complete failure. Traffic returned to expected levels by April 18, aligning with Luma Energy's restoration of service to 98.8% of customers within 38 hours.

Additional power-related disruptions affected smaller regions including St. Kitts and Nevis on May 9, North Macedonia on May 18, and the Maldives on June 1. Each incident demonstrated the direct correlation between electrical grid stability and Internet connectivity infrastructure.

Fiber damage and technical failures create isolated outages

Physical infrastructure damage created complete outages for several providers during the quarter. Digicel Haiti (AS27653) experienced two separate complete outages due to fiber optic cable damage. The first occurred May 28 at 21:00 UTC, lasting until 00:45 May 29, while a second unexplained outage occurred May 30 from 14:15-17:00 UTC.

Airtel Malawi (AS37440) suffered a 90-minute outage June 24 due to ongoing fiber network vandalism. Traffic effectively disappeared between 12:30-14:00 UTC, though IPv4 address space announcements indicated partial network operation continued.

Technical problems affected major North American providers during the quarter. Bell Canada (AS577) experienced service disruption May 21 following a router update failure. Traffic dropped approximately 70% starting around 13:15 UTC, with recovery occurring within one hour after the update was rolled back.

Lumen/CenturyLink (AS209) customers across parts of the United States experienced widespread disruption June 19, with traffic volumes dropping over 50% starting around 21:45 UTC. Social media reports suggested DNS-related problems, as users switching to Cloudflare's 1.1.1.1 resolver regained Internet access.

Cyberattacks target Russian infrastructure

Russian Internet provider ASVT (AS8752) faced a major DDoS attack reaching 70.07 Gbps and 6.92 million packets per second on May 28. The attack caused traffic to drop to near zero around 05:00 UTC, with the effective outage lasting approximately 10 hours. This incident followed a similar March attack against Russian provider Nodex (AS29329).

The ASVT attack demonstrated the vulnerability of regional Internet infrastructure to targeted cyber campaigns. Query volume to Cloudflare's 1.1.1.1 DNS resolver from ASVT increased rapidly as traffic began returning, suggesting either DNS resolver problems during the attack or subscribers seeking alternatives to bypass attack effects.

Unexplained disruptions highlight monitoring challenges

Several significant outages occurred without official explanations during the quarter. SkyCable (AS23944) in the Philippines experienced a complete eight-hour outage beginning May 7 at 19:15 UTC, with no published information regarding the cause.

Thai mobile provider TrueMove H (AS132061) suffered a nationwide outage May 22, initially dropping traffic by over 80% at 03:00 UTC. Local press reports suggested technical errors on computer servers or DNS system problems, though no official explanation was provided.

Syria experienced a two-hour ADSL network outage June 10 affecting multiple provinces, with traffic dropping two-thirds below normal levels at 08:15 UTC. While no official explanation was available, elevated DNS resolver queries during the outage suggested potential government involvement, though no confirmation was provided.

Telia Finland (AS1759) acknowledged a "widespread disruption" affecting mobile network data connections and fixed broadband April 1 between 06:30-07:15 UTC. The company did not disclose the disruption's cause, though IPv4 connectivity was clearly impacted while IPv6 traffic spiked above 30% during the outage.

Marketing community implications

These disruptions create significant challenges for digital marketing campaigns operating across affected regions. Government-directed shutdowns particularly impact programmatic advertising and real-time bidding systems that depend on consistent network connectivity.

PPC Land has extensively covered how Internet traffic patterns affect marketing operations, noting that global traffic grew 17% in 2024 despite recurring disruption challenges. The platform has highlighted how government shutdowns now account for over half of major Internet disruptions globally.

Power infrastructure dependencies pose additional risks for marketing operations, as demonstrated by the Portugal-Spain outage's cascade effects. Digital advertising campaigns require stable infrastructure foundations beyond just campaign optimization, particularly when technical failures can eliminate up to 25% of media spend effectiveness.

The quarter's disruptions underscore the importance of geographic diversification in digital marketing campaigns. Providers must consider both political stability and infrastructure resilience when selecting target markets and planning campaign distribution.

Technical outages affecting major providers like Bell Canada and Lumen/CenturyLink demonstrate that even developed markets face connectivity risks. Marketing teams should develop contingency protocols for sudden traffic losses and have alternative traffic sources readily available.

Network infrastructure trends

Cloudflare's analysis reveals that electrical infrastructure interconnection across countries creates cascading failure risks, as seen in the Morocco impact from Portugal-Spain power failures. This trend suggests marketing campaigns must account for regional infrastructure dependencies beyond individual country stability.

The shift toward cellular-only shutdowns in Syria represents a potential evolution in government restriction strategies. This approach allows some Internet functionality to continue while restricting mobile-specific activities, creating complex challenges for mobile marketing campaigns.

Cyberattack patterns targeting specific regional providers indicate potential for coordinated disruption campaigns. The targeting of Russian providers ASVT and Nodex suggests geopolitical factors increasingly influence Internet infrastructure stability.

Physical infrastructure damage from vandalism and cable cuts continues affecting smaller markets, particularly in developing regions. These incidents highlight the vulnerability of fiber-dependent Internet infrastructure to targeted sabotage.

DNS resolver dependencies became apparent during several outages, with traffic to alternative resolvers spiking when provider systems failed. This pattern suggests DNS infrastructure represents a critical vulnerability point for marketing campaigns dependent on domain resolution.

The quarter's observations confirm that Internet disruption patterns are becoming more complex, with government actions, infrastructure failures, cyberattacks, and technical problems creating an increasingly challenging environment for digital marketing operations requiring consistent connectivity.

Timeline

• April 28, 2025: Major power outage impacts Portugal and Spain, affecting digital infrastructure across Iberian Peninsula
• May 16, 2025: Libya implements Internet shutdowns across multiple providers in response to protests against Government of National Unity
• May 21, 2025: Bell Canada router update failure causes 70% traffic drop for Ontario and Quebec customers
• May 28, 2025: Russian provider ASVT targeted by 70.07 Gbps DDoS attack; Digicel Haiti suffers fiber cable damage outage
• June 13, 2025: Iran begins series of Internet shutdowns following Israeli attacks on nuclear facilities
• June 17-25, 2025: Extended Iranian shutdown implemented to counter cybersecurity threats
• June 19, 2025: Lumen/CenturyLink experiences DNS-related service disruption across United States
• June 21-29, 2025: Panama suspends Internet services in Bocas del Toro province during social security protests
• May 20-July 3, 2025: Iraq implements daily exam-related shutdowns affecting multiple network providers
• July 22, 2025: Cloudflare publishes comprehensive analysis documenting Q2 disruption patterns

Key terms and concepts

Digital marketing campaigns: The strategic execution of advertising initiatives across online channels that require consistent Internet connectivity to function effectively. These campaigns encompass multiple touchpoints including search advertising, social media promotion, and programmatic display advertising. During Q2 2025's disruptions, campaigns faced sudden traffic losses and targeting difficulties when government shutdowns or infrastructure failures interrupted normal connectivity patterns. Modern digital marketing campaigns rely heavily on real-time data transmission and bidding systems that become non-functional during network outages.

Programmatic advertising: An automated system for buying and selling digital advertising space through real-time bidding platforms that connect advertisers with publishers. This technology depends entirely on stable Internet infrastructure to facilitate millisecond-level transactions between demand-side platforms and supply-side platforms. Network disruptions can completely halt programmatic operations, as bidding algorithms cannot function without consistent connectivity to advertising exchanges. The Q2 2025 shutdowns demonstrated how quickly programmatic campaigns can fail when underlying network infrastructure becomes unreliable.

Network infrastructure: The foundational technology systems including fiber optic cables, routers, servers, and data centers that enable Internet connectivity and digital communication. Marketing operations depend on this infrastructure remaining stable and accessible across target geographic regions. Infrastructure failures, whether from power outages, cable damage, or cyberattacks, directly impact the ability to deliver advertisements and measure campaign performance. The Portugal-Spain power outage exemplified how infrastructure interdependencies can create cascading failures affecting multiple countries simultaneously.

Traffic volumes: The measurement of data transmission and user activity flowing through Internet networks, typically expressed in bytes transferred or requests processed over specific time periods. Marketing professionals monitor traffic volumes to understand audience engagement patterns and optimize campaign timing. Sudden drops in traffic volumes, as observed during the Iranian shutdowns, indicate reduced audience availability and require immediate campaign adjustments. Traffic volume data serves as an early warning system for identifying network disruptions that could impact advertising effectiveness.

DNS resolver: A critical Internet service that translates human-readable domain names into IP addresses, enabling users to access websites and online services. Marketing campaigns depend on DNS resolution to direct users from advertisements to landing pages and conversion funnels. DNS failures can make marketing campaigns appear completely non-functional even when underlying websites remain operational. The Lumen/CenturyLink incident demonstrated how DNS problems can masquerade as broader Internet outages, requiring marketers to understand these technical dependencies.

Real-time bidding: The instantaneous auction process where advertising inventory is bought and sold on a per-impression basis, typically completing within 100 milliseconds of a user loading a webpage. This process requires continuous Internet connectivity between multiple systems including demand-side platforms, supply-side platforms, and data management platforms. Network disruptions immediately halt real-time bidding operations, preventing advertisements from being served to available audiences. The technology's dependence on split-second timing makes it particularly vulnerable to network latency or connectivity interruptions.

Campaign distribution: The strategic allocation of advertising spend and creative assets across different geographic markets, platforms, and audience segments to maximize reach and effectiveness. Geographic diversification becomes critical when regional Internet disruptions affect specific markets, as demonstrated by the targeted nature of government shutdowns in Q2 2025. Effective campaign distribution requires understanding both audience characteristics and infrastructure stability in target regions. Marketing teams must develop contingency protocols for rapidly reallocating budgets away from disrupted markets.

Geographic diversification: A risk management strategy where marketing investments are spread across multiple countries and regions to minimize the impact of localized disruptions or market-specific challenges. The Q2 2025 disruptions highlighted the importance of this approach, as companies with concentrated investments in affected regions faced significant campaign interruptions. Geographic diversification provides protection against government-directed shutdowns, infrastructure failures, and regional cyberattacks. This strategy requires understanding both market opportunities and political stability risks in different territories.

Infrastructure dependencies: The interconnected relationships between different technology systems that must function together to enable digital marketing operations. These dependencies include power grids, fiber networks, data centers, DNS systems, and routing infrastructure. The Morocco impact from Portugal-Spain power failures demonstrated how dependencies can create unexpected vulnerabilities in seemingly unrelated markets. Understanding infrastructure dependencies helps marketing teams identify potential failure points and develop appropriate backup systems.

Summary

Who: Multiple countries including Libya, Iran, Iraq, Syria, Panama, Spain, Portugal, and Puerto Rico, along with major network providers like Bell Canada, Lumen/CenturyLink, and Russian provider ASVT

What: A comprehensive series of Internet disruptions including government-directed shutdowns, power infrastructure failures, cyberattacks, fiber cable damage, and technical problems affecting digital marketing campaigns and network infrastructure

When: Second quarter of 2025 (April-June), with some continuing effects into July, marking what Cloudflare terms "shutdown season"

Where: Across 125 countries within Cloudflare's network coverage, with particular concentration in Middle East, North Africa, North America, and Europe regions

Why: Various causes including political protests, examination security measures, cybersecurity concerns, power grid failures, infrastructure vandalism, technical errors, and coordinated cyberattacks targeting regional Internet providers