Instagram and TikTok blocked in AzerbaijanHow the October 2026 block works

At a glance

• What: Instagram and TikTok stopped loading across Azerbaijan on the morning of 12 October 2026. Users could reach them only through a VPN.
• How: the name lookup (DNS) returns the right addresses and the TCP connection opens. The connection then goes silent as soon as the phone sends the TLS ClientHello, the first message of the encrypted handshake, which carries the site’s name in plain text (the Server Name Indication, SNI). That is the signature of deep packet inspection (DPI) filtering by name, the same method OONI documented in Azerbaijan for TikTok in 2022 and 2023 and for X in 2024.
• Who: blocking appears on all eight networks with OONI measurements on those days, including Aztelekom, Azercell and Delta Telecom. On one network, AG Telekom, TikTok mostly still worked.
• Why: nobody has said. The block started while videos of protests against a new school dress code, seen by many as a hijab ban, were spreading; 37 people were arrested in Baku the same day. The authorities, Meta and TikTok have not commented.

What happened

On 21 September 2026 Azerbaijan’s Cabinet of Ministers approved new uniform rules for state schools; rules for teachers followed on 6 October. They forbid clothing that conflicts with the uniform or with the secular principles of education. They do not mention the hijab, but videos showed girls in headscarves being turned away at school gates, and pupils began to protest outside schools and to boycott lessons. Similar rules led to protests in 2010–2012.

On the morning of Monday 12 October, reports spread that Instagram feeds would not refresh, profiles would not open, TikTok videos would not load and uploads and logins failed. Some users said both apps worked through a VPN. The same day the Interior Ministry told the APA news agency that 37 people had been arrested over the school incidents, and a criminal case was opened under Article 233 of the Criminal Code (organising or taking part in actions that disrupt public order).

Early press coverage was cautious: outage trackers saw complaints from Azerbaijan but no global incident, and on 12 October several outlets wrote that OONI and NetBlocks data did not yet confirm a block. That was a question of timing. The OONI measurements uploaded through the day, which we read below, show the block clearly.

What the measurements show

OONI (Open Observatory of Network Interference) is a volunteer project: people run the OONI Probe app on their own phones and computers, and it regularly tries to open a list of websites, records every step and compares the result with a control connection outside the country. All results are public. Colitu Lab has no probe in Azerbaijan, so this study relies entirely on OONI’s data, which anyone can check.

For two weeks before the event, measurements of www.instagram.com and www.tiktok.com from Azerbaijan were clean: 1 anomaly in 159 Instagram measurements and none in 158 for TikTok. On 12 October the picture flips: 31 of 33 Instagram and 26 of 32 TikTok measurements were anomalous. The early hours of 13 October look the same (6 of 9 each). Measurement volume also jumped on 12 October, to more than twice the usual daily count, which is what happens when people notice a problem and start testing.

When it started. The last normal Instagram measurement before the event was on 11 October at 12:26 UTC; the first anomalous one on 12 October at 06:48 UTC (10:48 in Baku), on Aztelekom. Within the next three hours anomalies appeared on Delta Telecom, Artkom, AG Telekom and Azercell. User reports put the start before 09:00 Baku time, which fits the gap in the data: there were simply no measurements overnight.

OONI confirms a block automatically only when it recognises a block page or a known censorship DNS answer. A silent drop leaves no such fingerprint, so none of these measurements is marked “confirmed”. That is normal for Azerbaijan: OONI’s own reports on the country rely on the pattern of failures, as we do here.

How the block works

Opening https://www.instagram.com takes three steps, and OONI records each of them separately. That lets us see exactly where the connection breaks. We read the full records of 83 measurements from 12–13 October (42 Instagram, 41 TikTok).

1. 1 · DNSThe phone asks for the address of www.instagram.com. Answers were correct: Meta’s own addresses (AS32934) for Instagram; Akamai addresses or caches inside the operator’s own network for TikTok. No forged answers, no “domain not found”.
2. 2 · TCPThe phone opens a TCP connection to port 443 on that address. It succeeded. The address itself is not blocked. (The only TCP failures were IPv6 attempts on probes without IPv6, which says nothing about censorship.)
3. 3 · TLSThe phone sends the ClientHello, which carries the SNI www.instagram.com in clear text. No reply arrives. After OONI’s 10-second limit the handshake is abandoned (generic_timeout_error). This happened in 37 of 42 Instagram and 29 of 41 TikTok measurements.

The order matters. If the authorities had blocked the addresses, the TCP connection in step 2 would already fail. If they had tampered with DNS, step 1 would return wrong answers, as Armenia did for TikTok in 2022. Here the first two steps pass and the connection dies the moment the site’s name appears on the wire. A device in the path reads the ClientHello, matches the name against a list and drops the rest of the flow. This is SNI-based filtering with deep packet inspection.

One network behaves differently. On Delta Telecom’s business network (AS215148), TikTok connections were not silently dropped but cut with a TCP reset (connection_reset) on all three addresses tried; Instagram on the same network timed out. A reset is an injected packet that tells the phone “this connection is closed”. Qurium described the same reaction from Azerbaijani DPI in 2018, “storms” of up to ten reset packets per attempt. Two different reactions on two networks suggest the filtering is not one central box with one setting, a point OONI also made in 2023 when it found different TikTok endpoint lists on different networks.

Network by network

Anomalous / tested measurements, 12 October 00:00 UTC to 13 October 03:18 UTC. Some networks had only one or two measurements; a single measurement is a hint, not proof.

The exception is AG Telekom, a fixed broadband provider. There Instagram was blocked like everywhere else, but 8 of 10 TikTok measurements succeeded. On that network TikTok’s name resolved to caches inside AG Telekom’s own address space (149.255.152.0/24), and the handshake to them completed. OONI saw the same thing in September 2023: AS57293 was the one network where TikTok was not blocked.

Why Facebook still works

Facebook and Instagram belong to the same company and are served from the same Meta network. Yet Facebook stayed reachable (2 anomalies in 41 measurements) while Instagram failed. YouTube and X also worked normally. The block is not a general slowdown or a cut of Meta’s network: it is a list of names.

Azerbaijan has filtered by name with this precision before. When X was blocked on 8–10 October 2024, OONI found that handshakes for x.com timed out while twitter.com, the old name for the same service on the same servers, mostly still worked. Only one of the two names was on the list.

Name-based blocking has a practical advantage for a censor: it is cheap, it can be switched on and off in minutes and it leaves the rest of the internet untouched, so banks, government services and other apps keep working. It is also why users see the apps as “broken” rather than “blocked”: the app shows endless loading, not an error page.

A short history of blocking in Azerbaijan

The October 2026 block fits a pattern that has been building for a decade. Each step reused and refined the tools of the one before.

1. Dec 2015Mobile operator Bakcell buys a Sandvine Policy Traffic Switch, a DPI platform, through the Baku integrator Bestcomp Group (Qurium).
2. 2017Article 13-3 is added to the Law on Information: the ministry may block a website without a court order “in urgent cases” and go to court within five days. In May, Meydan TV, Azadliq Radiosu (RFE/RL), the Azadliq newspaper, Turan TV and Azerbaijan Hour are blocked. From March, DPI from Israel’s Allot Communications is used for website blocking (Qurium).
3. Apr 2018After the Allot inspection was bypassed, a new “active” method appears: storms of TCP resets, after a Sandvine support ticket about blocking azadliq.info (Qurium).
4. 27 Sep 2020Start of the 44-day war. The ministry throttles the internet nationwide; Facebook, Instagram, WhatsApp, Telegram, Twitter, YouTube and TikTok are blocked. Bloomberg reports that Sandvine DPI on Delta Telecom’s backbone was used to block live streams on YouTube, Facebook and Instagram. Restrictions are lifted on 12 November, except in the newly controlled territories; Freedom House counts 46 days.
5. 14 Sep 2022Border clashes with Armenia. The State Security Service announces a “temporary” TikTok suspension, citing military secrets and misinformation. OONI: packets dropped after a disallowed SNI, with different endpoint lists per network. Lifted on 5–6 November (about 7½ weeks).
6. 19 Sep 2023“Anti-terrorist operation” in Karabakh. TikTok blocked again, and Google Play for a week (19–25 September). Timeouts after the ClientHello. Not blocked on AG Telekom. Lifted by 31 October.
7. Jun 2024The European Court of Human Rights rules that the 2017 website blocks violated freedom of expression. Most of the sites remain blocked.
8. 8 Oct 2024X blocked for two days by SNI, only under the name x.com.
9. 30 Jun 2026Parliament adopts Law No. 431-VIIQD: platforms must register or open a local office, verify ages and answer state requests within five working days; under-16s may not open accounts. Sanctions escalate from fines to an advertising ban, “phased” traffic throttling and finally blocking. Implementing decree signed 5 August.
10. 12 Oct 2026Instagram and TikTok blocked by SNI on most networks, during the school dress code protests. Not announced.

The OONI series shows how the earlier TikTok blocks looked in the same data. In 2022 the block was almost total: from 15 September to 5 November nearly every TikTok measurement failed, then from 6 November almost none did. In 2023 it was patchier, typically half to three quarters of measurements, because some networks did not apply it. In both years Instagram measurements stayed clean, which makes 12 October 2026 the first time Instagram itself has been blocked in OONI’s Azerbaijani data since the 2020 war.

The equipment behind it

Blocking by name needs equipment that reads every new connection at line speed. Azerbaijan has bought such equipment from at least two vendors, according to investigative reporting.

• Allot Communications (Israel). Qurium, a Swedish digital-security foundation that hosts several blocked Azerbaijani outlets, found Allot DPI used for website blocking from March 2017; other reporting puts the deal at about 3 million US dollars.
• Sandvine / Procera (Canada; owned by Francisco Partners since 2017). Bakcell bought a Sandvine Policy Traffic Switch in 2015 through Bestcomp Group. Qurium traced Sandvine support staff testing the block of azadliq.info in 2018. In 2020 Bloomberg reported that Delta Telecom, the state-owned backbone operator through which much of the country’s international traffic passes, used Sandvine equipment to block live video during the war.

Azerbaijan’s network structure makes this kind of control easy. Much of the traffic to the rest of the world passes through a small number of state-linked gateways, Delta Telecom’s above all. A filter at that point reaches almost every subscriber at once; filters inside individual operators can add to it, which would explain why reactions differ from network to network.

The legal toolkit

Blocking a website in Azerbaijan has a legal basis; blocking a platform for a whole population, without announcement, is less clear.

• Article 13-3 of the Law on Information (2017) lets the ministry, today the Ministry of Digital Development and Transport, block an internet resource without a court order where there is a threat to “the legally protected interests of the state and society”, and seek a court decision within five days.
• 2025 amendments added content that “insults public morality” to the prohibited categories. The 2026 package widened the grounds for blocking without a court order to drugs, pornography, gambling, suicide, insult and defamation, privacy violations, films and games without age ratings, and “false information” threatening public safety.
• Law No. 431-VIIQD (adopted 30 June 2026, decree 5 August) adds platform duties: local registration or representation, age verification, a ban on accounts for under-16s, answers to state requests within five working days. Sanctions climb from fines (15,000 to 50,000 manats for companies in the adopted text according to Azerbaijan Internet Watch; earlier reports of the draft named up to 300,000) to an advertising ban, phased throttling of the platform’s traffic (the draft named steps of 20 %, 50 % and up to 90 %) and finally blocking.

The October block does not look like that new ladder. The law describes gradual throttling after warnings and fines; what the measurements show is a complete drop from one morning to the next, on two platforms only, without a word of explanation. It looks much more like the emergency practice of 2022 and 2023, carried out with the same filtering method.

What it means for users

A filter that reads the SNI only sees names sent in clear text. That is why VPNs worked: inside an encrypted tunnel, the ClientHello for www.instagram.com is invisible, and the filter only sees a connection to the VPN server. It is also why the apps did not show an error but loaded forever: from the app’s point of view the server simply never answered.

Earlier events show the limits of that picture.

• VPN sites are blocked too. OONI found the websites of the Tor Project, Psiphon and TunnelBear blocked in 2022–2023, inconsistently across networks. During the 2020 war, a state news agency warned against free VPNs, and employees were reportedly asked to delete VPN apps.
• Free VPNs carry their own risks. An unknown free VPN sees all of your traffic. Choosing one that publishes how it handles data matters more during a block, not less.
• The same equipment can block VPN protocols. DPI that reads names can also recognise the shape of common VPN protocols. In Azerbaijan we have seen no public evidence of protocol-level VPN blocking in this event; in Russia and Iran it is routine.

For anyone who wants to document the block: the OONI Probe app is free, and each run adds a public measurement. Measurements from more networks, especially mobile ones, are what would answer the open questions below.

Open questions

• Why? The timing points at the protests, but no authority has said so. Some Azerbaijani media and NGOs speak of foreign interference behind the protests; there is no public evidence either way.
• Which names exactly? OONI tests the websites, not the apps’ API and image servers. Reports that feeds would not refresh suggest the app endpoints (such as Instagram’s API and Meta’s content servers) were also filtered, but the data here does not show which ones.
• How long? The 2022 and 2023 TikTok blocks lasted six to eight weeks. A block tied to a protest could end sooner, or turn into the throttling regime the new law describes.
• Mobile networks. We have only one measurement each from Azercell and none from Bakcell or Nar in these two days. Most Azerbaijanis use Instagram and TikTok on mobile.

Limitations

• All data comes from OONI volunteers. Volume is low: 83 measurements of Instagram and TikTok over about 21 hours, unevenly spread across eight networks. Several networks have one or two measurements.
• OONI tests the website (www.instagram.com, www.tiktok.com), not the mobile apps. The apps may use other names that are blocked differently.
• A TLS timeout after the ClientHello is strong evidence of DPI filtering, but on its own it cannot exclude a filter that combines the address with the first data packet. The contrast with Facebook on the same Meta network, and the x.com/twitter.com precedent, is what points to the name.
• The explanation of the AG Telekom exception is an interpretation. The vendor and location of the filtering equipment are not known.
• Colitu Lab has no probe in Azerbaijan; we did not measure anything ourselves. The data ends at 13 October 2026, 03:18 UTC.

Sources and data

The numbers in this study, with the DNS, TCP and TLS results of every measurement we read and a link to each one on OONI Explorer, are available as JSON: ooni-instagram-tiktok.json. They come from the public OONI Explorer and its API.

• OONI, OONI measurements show ongoing internet censorship in Azerbaijan (2023): TikTok 2022, TLS-level interference, blocked news and circumvention sites.
• OONI Explorer finding, Azerbaijan blocked TikTok and Google Play Store amid military offensive in Nagorno-Karabakh (2023).
• OONI Explorer finding, Azerbaijan blocked Twitter/X (2024).
• NetBlocks, TikTok restricted in Azerbaijan and Armenia amid clashes over Nagorno-Karabakh (14 September 2022).
• Qurium, Sandvine and internet blocking in Azerbaijan (January 2019).
• OBC Transeuropa, Azerbaijan, the Internet in times of war (November 2020), including Bloomberg’s report on Sandvine and Delta Telecom.
• Freedom House, Freedom on the Net: Azerbaijan 2021 and 2025.
• Meydan TV, The evolution of digital regulation in Azerbaijan (5 August 2026).
• Azerbaijan Internet Watch, Meta, TikTok and other platforms to face mandatory registration (2026).
• OC Media, Azerbaijan reportedly blocks social media access as hijab protests continue (12 October 2026); Arab News, Azerbaijani users report social media disruptions amid hijab protests (12 October 2026).

Have measurements from Azerbaijan, or see something that contradicts this study? Write to hello@colitu.com.