RNC Week Traffic: Attacks Hit Campaigns, News Sites Spike After Rally Shooting
Major political events reliably leave a mark on Internet traffic patterns—and the 2024 U.S. election cycle is no exception. Cloudflare's data from June through mid-July 2024 reveals how real-world events, from debates to an assassination attempt to the Republican National Convention, shaped both traffic volumes and cyberattack activity.
DDoS Campaigns Against Political Targets
Distributed Denial of Service (DDoS) attacks against political websites are not new. Similar attacks preceded the June 2024 European elections in the Netherlands, where a peak of 73,000 requests per second (rps) was recorded on June 5, the day before the vote. In the U.S., Cloudflare has tracked attacks on federal and state government sites, as well as political organizations, since April 2024.
In early July, two U.S.-based political targets came under direct attack:
- A website tied to a political campaign was hit on July 2 with a DDoS attack peaking at 56,000 rps for roughly 10 minutes. A follow-up attack on July 14 reached 34,000 rps and lasted four minutes.
- A policy advocacy think tank focused on presidential politics also faced repeated attacks. Its main event on July 11 peaked at 137,000 rps for a few minutes, with a slightly weaker repeat attack a few hours later on July 12.
The short duration of these attacks is consistent with broader DDoS trends. Most attacks end within minutes, underscoring the need for automated detection and mitigation systems—there is rarely enough time for manual response after an alert fires.
Traffic Surge Following the Alabama Rally Shooting
The attempted assassination of former President Trump at a Pennsylvania rally on July 13 triggered an immediate, measurable uptick in U.S. Internet activity. Total bytes transmitted in the U.S. rose 10–12% during the 22:30–23:00 UTC window (18:30–19:00 EST) as news broke.
Nationally, HTTP request volume on July 13 was up to 8% higher than the previous week. DNS queries via Cloudflare's 1.1.1.1 resolver showed a more pronounced shift toward news: TV news sites saw a 215% surge in DNS traffic, while general news sites rose 141%.
That pattern carried into the following week, with elevated traffic to news and media outlets persisting from July 13 onward.
A Quieter Week in Milwaukee
The Republican National Convention, held July 15–18 in Milwaukee, Wisconsin, did not produce any notable local traffic spikes. Cloudflare observed no unusual increases in Internet activity from Milwaukee or Wisconsin as a whole during the four-day event.
Nationally, DNS traffic to Republican Party and fundraising websites did climb relative to the prior week. The most significant hourly peaks came on the convention's final day, July 18, with increases of 268% at 14:00 EDT and 266% at 23:00 EDT. Aggregated daily traffic to those sites rose 90.48% compared to the previous week.
TV news site traffic remained stable through the convention, with its highest peaks occurring just before the event on July 14 and again late on July 15. Traffic to political news sites covering the RNC showed a gradual decline as the week progressed.
The Washington, D.C. think tank targeted earlier in the month was attacked once more on July 18. The attack ran from 13:18 to 13:22 EDT, with Cloudflare mitigating 3.12 million DDoS requests, peaking near 30.33k rps.
An Event-Driven Internet
The data from this period indicates that major political events don't always dramatically shift aggregate Internet traffic—except during acute news moments like the rally shooting. When traffic does rise, it leans heavily toward news and media consumption. Cyberattack activity, meanwhile, remains concentrated on political campaigns and policy organizations.
