Connection at a cost: The high-risk world of Iran’s underground VPN market after internet blackout

Less than 2% of Iran’s population remains online amid the blackout, and VPN/config prices have surged to 500,000–1,000,000 tomans per GB (~£7–£15). Demand has driven sophisticated multi-path connection tools (DNS tunnelling, QUIC-over-DNS, NaiveProxy, SSH chains) but also a spike in scams and service cut-offs, while purchases via official banking risk deanonymizing users. Technical surveillance (DPI and traffic fingerprinting) makes VPN detection plausible, increasing operational and legal risk for users and any businesses with Iran exposure.

Analysis

The blackout has created a bifurcated market: highly technical, trust-minimized operators on one side and cash-extracting intermediaries on the other. That bifurcation increases margins for suppliers who can deliver reliable obfuscation and payment anonymity, while raising second-order risks (brand, legal, compliance) for any supplier with on‑ramps tied to regulated payments or identifiable infrastructure.

From a product-cycle perspective, demand is pulsed and event-driven — spikes during unrest with rapid attrition once either supply is disrupted or users are compromised. That makes near-term monetization lumpy (days-to-weeks spikes) but creates durable secular upside for vendors that embed resilient, multi-path tunneling and managed DNS/DoH capabilities into mainstream cloud/CDN/security stacks (measurable ARR upside over 3–12 months if uptake scales outside the immediate crisis).

Tail risks skew to the downside: improved DPI/fingerprinting, forced vendor collaboration with state actors, or an acceleration of export controls would rapidly compress addressable markets and force large write‑downs for exposed vendors and hardware suppliers. Conversely, a sustained period of restricted national connectivity raises structural demand for satellite and out-of-country managed connectivity, creating a narrow but high-ARPU channel for satellite-capable equipment and cloud-routing services over the medium term.

Key Decisions for Investors

• Long Cloudflare (NET) — buy 6-month call options ~10–15% OTM (~small size). Thesis: Cloudflare's DNS/DoH, CDN and Argo-style routing are direct demand beneficiaries if multi-path obfuscation scales; reward >2x if adoption outside Iran accelerates. Risk: 30–60% premium decay if geopolitical heat backs off or volatility collapses.
• Long CrowdStrike (CRWD) or Zscaler (ZS) — accumulate shares over 3–12 months. Thesis: Enterprises and platforms will accelerate adoption of managed obfuscation/detection services; pure-cloud security captures faster spend than legacy hardware. Hedge with a 3–6 month 10% OTM put to limit downside from a rapid détente scenario.
• Tactical satellite/comms exposure — small-long Iridium (IRDM) or Viasat (VSAT) over 3–12 months. Thesis: constrained terrestrial options create premium demand for satellite-enabled messaging/equipment; upside concentrated if hardware flows increase. Size small due to sanction and supply-chain execution risk; consider buying call spreads to cap cost.
• Risk hedge / pair trade — long NET or CRWD vs short a legacy DPI/hardware vendor (e.g., CSCO) for 6–12 months. Thesis: Cloud-native security gains share at the expense of device-centric vendors if obfuscation and managed services become standard. Watch for countervailing enterprise capex cycles and M&A that could compress spreads.