Traffic dips and spikes across the 27 member states
The 2024 European Parliament election (June 6-9) produced a familiar pattern on the Internet: a measurable drop in HTTP request traffic during voting hours, followed by sharp increases as results and consequential national announcements emerged. Across the EU's 27 member states, the magnitude and timing of these dips varied considerably.
Traffic drops above 10% were confined to seven countries: the Czech Republic, Luxembourg, Slovakia, Cyprus, Belgium, Estonia, and Croatia. The data shows a clear regional split — Central European states (notably the Czech Republic and Slovakia) experienced the steepest falls, while Scandinavia saw minimal to no reduction. Timing also followed a geographic pattern: morning dips (06:00-10:00) were more common in Northern and Eastern Europe, late morning to early afternoon declines (10:15-14:30) dominated in Western and Central Europe, and late afternoon reductions (15:45-19:45) appeared mainly in Central and Southern Europe.
National announcements interrupt the usual curve
In Belgium, where national and regional elections coincided with the EU vote on June 9, HTTP requests peaked at 21:15 local time with 7% more traffic than the previous week. That curve was broken at roughly 22:00 local time when Prime Minister Alexander De Croo conceded defeat in a televised speech — a typical interruption pattern for major broadcast announcements.
France followed a similar trajectory on the same evening. At approximately 21:00 local time, President Emmanuel Macron announced the dissolution of the national parliament after his party's defeat in the EU vote. Requests dipped 6% during the address, then rebounded to peak at 22:15 local time with a 6% increase.
Results drive nighttime surges
Once polls closed, traffic increased considerably across the EU. The Netherlands — the first country to vote on June 6 — saw traffic run 4% higher than usual after 20:30 local time, peaking at 01:15 with a 15% increase. In Germany on June 9, requests were 8% higher at 21:45 local time, briefly dipped 2% during election speeches at 23:00, then peaked at 00:30 with an 18% rise. Other notable nighttime peaks included:
- Estonia: 35% increase at 00:00 (21:00 UTC)
- Portugal: 29% increase at 00:15 (23:15 UTC)
- Slovakia: 24% increase at 23:45 (21:45 UTC) on June 8
- Lithuania: 22% increase at 23:00 (20:00 UTC)
- Spain: 21% increase at 21:00 (19:00 UTC)
- Croatia and Slovenia: 19% increases at 23:00 (21:00 UTC) and 22:45 (20:45 UTC) respectively
- Poland: 9% increase at 01:45 (23:45 UTC)
Election-related domains see massive DNS growth
DNS traffic via the 1.1.1.1 resolver revealed sharp interest in election resources. Social media prompts directing European users to official election sites coincided with a 26x peak in DNS requests to European Union election domains at 19:00 UTC on June 9, up from an 8x surge at 17:00 UTC the previous day. European news outlet domains saw a more moderate initial 1.68x increase at 13:00 UTC on June 9, followed by a second peak at 19:00 UTC. Local election-results sites experienced the most dramatic jump: a 55x growth peak at 22:00 UTC on June 9.
Government sites under sustained attack
Cyber threats shadowed the election period. A DDoS attack on Dutch political websites on June 5 — the day before the Netherlands voted — peaked at 73,000 requests per second. In France, a government website absorbed a 420 million requests-per-hour DDoS attack on February 25 that lasted over three hours.
Between January 1 and June 9, Cloudflare mitigated 8.6 billion threats against EU government websites, with DDoS accounting for 68% of that volume. That works out to an average of 53.42 million threats mitigated per day. Belgium, France, and Germany were the primary targets in the first half of 2024, receiving 49%, 25%, and 10% of attack requests aimed at EU government sites respectively.
Limited attacks in the pre-election window
The five weeks immediately before the election saw no significant attacks on European election-related organizations, but several member state government sites did come under fire. Notably, the Bulgarian government was hit on June 6 with a wave of 122 million daily DDoS requests peaking at 110,500 requests per second at 11:29 local time. Smaller incidents targeted the French government on May 11, May 23, and June 9 — the last of which reached 42,000 requests per second at 11:57 local time. Additional attacks struck Sweden on April 29 and May 18, and Denmark on May 7.
