TSUBAME sensors log Iran traffic drop amid conflict
JPCERT's TSUBAME sensor network observed a sharp drop in Iranian source IP addresses during the June 2025 Israel-Iran conflict, likely due to internet restrictions after cyberattacks on Iranian banks and media.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
JPCERT's Q2 2025 TSUBAME Report Overflow covers global sensor monitoring trends from April to June 2025, with a focus on packet fluctuations from Iran coinciding with the Israel-Iran military conflict. Between June 13 and 27, the daily count of unique source IP addresses from Iran dropped significantly from a typical baseline of 170-200 to as low as 20-100, while Israeli source IP counts remained stable. Media reports cited in the article indicate cyberattacks targeted Iran's state broadcaster, banks, and cryptocurrency exchanges around June 18, and the Iranian government reportedly restricted internet connectivity in response, which JPCERT suggests explains the observed decline in scanning traffic.
The report also provides routine comparative monitoring data, noting that both domestic (Japan) and overseas sensors peaked in packet volume in April with a gradual decline through June. Across nearly all sensors, ports 22/TCP, 23/TCP, 80/TCP, 443/TCP, and 8080/TCP remained the most frequently scanned, indicating widespread opportunistic scanning of these common services. No specific vulnerabilities, malware, or named threat actors were identified in this reporting period; the piece is primarily an informational/trend-monitoring update rather than an active threat disclosure.
Source reporting: https://blogs.jpcert.or.jp/en/2025/10/tsubame_overflow_2025-04-06.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs