Attack Traffic Surges Alongside US Protests
Online protest activity tends to spike alongside physical demonstrations. In the wake of George Floyd's murder on May 25, and the nationwide protests that followed over the weekend of May 30-31, Cloudflare observed a significant increase in cyberattacks—particularly against advocacy organizations focused on racial justice.
Cloudflare's network blocks tens of billions of attack requests daily. Even at that scale, the uptick was clearly visible: the volume of HTTP requests associated with DDoS attempts or intrusion efforts climbed through the week and spiked over the weekend.
For a baseline, Cloudflare blocked 116,317,347,341 attack requests during the weekend of April 25-26. That works out to more than 670,000 blocked requests per second—over ten times Google's reported rate of roughly 63,000 search queries per second. By comparison, the weekend of May 30-31 saw 135,535,554,303 attack requests blocked. That is a month-over-month increase of 17%, or an extra 19 billion requests—approximately 110,000 additional blocked requests per second.
Sunday, May 31 showed the largest single-day jump, with attacks up 26% compared to the corresponding Sunday a month earlier.
Broken down by targeted industry, the differences between April and May weekends are stark. The category with the most dramatic growth was Advocacy Groups, which saw attacks increase by 1,120x.
These organizations went from receiving almost no attack traffic in April to sustaining bursts of up to 20 thousand requests per second on a single site. One attacker, likely using a compromised server in France, sustained a continuous campaign against an advocacy group for more than a day. The malicious requests were blocked and the target site remained online.
Other categories also saw meaningful increases. Attacks on Government websites—including police and fire department sites—rose 1.8x month over month, while attacks on Military sites were up 3.8x. Attacks targeting US government web properties have climbed sharply since May 25.
Protecting the Voices at Risk
Cloudflare launched Project Galileo nearly six years ago in response to a pattern of disproportionate cyberattacks against organizations and individuals advocating for marginalized communities. The program offers threat protection to groups that are vulnerable to attack, including artistic organizations, humanitarian efforts, and political dissidents. During that time, Cloudflare has repeatedly observed online attacks paired with physical threats and violence.
Many of the organizations fighting racism are part of Project Galileo, and they have seen a dramatic surge in attack traffic over the past week. Cloudflare's position is that these attacks are an attempt to silence voices that are already being met with force in the streets. The company says it remains committed to keeping those organizations online, regardless of the size of the assault or the resources of the target. Groups involved in the fight against racism that need protection are encouraged to reach out through the Project Galileo program.
