Aggregated Network Service Activity in Iran - June 2025

This dataset provides an aggregated view of active network services in Iran for the month of June 2025. It is derived from raw data collected by a commercial cyberspace search engine, which continuously scans the internet from globally distributed vantage points. This dataset is particularly valuable for analyzing the techniques, evolution, and impact of the nationwide network shutdown that occurred in Iran between June 13 and June 25, 2025. Data Source and Collection:The original dataset comprised 8,650,874 records of active network services discovered in Iran during June 2025. This raw data covered 490 distinct Iranian Autonomous Systems (ASes). The data spans 192 different network protocols (e.g., HTTP(S), SSH, DNS, SNMP, IKEv2) across 6,130 unique ports, offering a comprehensive snapshot of the country's network service landscape. Anonymization and Aggregation Process:To protect the privacy of individual IP address owners while preserving the data's scientific value, we performed an aggregation process. The raw data, with IP addresses, was grouped into 10-minute intervals based on common service attributes. Specifically, we counted the number of unique network services for each combination of `port`, `protocol`, and `asn`. The timestamp of the aggregated data has been converted to UTC for standardization. Dataset Structure:The dataset consists of CSV files, where each row represents the total count of active services (network_activity) for a given service type within a 10-minute window in a specific AS. The columns are as follows:- `time`: The start of the 10-minute UTC time window (format: YYYY-MM-DD HH:MM:SS).- `asn`: Autonomous System Number.- `asn_name`: The registered name of the Autonomous System.- `port`: The port number of the service.- `protocol`: The application-layer protocol or service name identified.- `network_activity`: The number of active network services detected for this group in the time window.