(David Fifield) The graph of users of the snowflake-01 bridge in January 2026 is striking: a slight relative decline starting 2026-01-08, then a threefold increase between 2026-01-21 and 2026-01-27. The bandwidth graph is equally striking: a minor increase on 2026-01-08, then a 50% increase starting 2026-01-21.
Looking at the per-country graph, we see the expected decline and recovery of the country of Iran (ir). But actually, the effect is much more pronounced for the United States (us). We don't believe it's the case that Snowflake users in the U.S. coincidentally happened to fall and rise in time with a shutdown in Iran—more likely it's some kind of error with geolocation of Snowflake client IP addresses. We've talked about the propensity for users from Iran to be misclassified as being from the U.S. here, and for this most recent event there is an issue on the Tor bug tracker. But the exact cause of the discrepancy is not known.
We'll include some additional graphs from Tor metrics showing just users from Iran, because they show the depth and duration of the shutdown.
In the graphs of directly connecting users (those not using any kind of circumvention transport) and of bridge users (those using a circumvention transport, including Snowflake), we see an obvious gulf during the shutdown, when user counts went almost to zero.
In the graph of users by transport, we see that all Tor pluggable transports were affected. The main ones for Iran are obfs4, Snowflake, and WebTunnel. All three came back, after the shutdown, to higher levels than before.
