Election Days Show Up in Traffic Patterns
Cloudflare's 2024 Election Insights report, published on Radar, tracks how Internet traffic and attacks shift around national votes across more than 60 countries. The data shows a common signature: traffic dips while polls are open, then recovers and often spikes when results come in. Attacks targeting election infrastructure are less consistent but continue to appear in Europe.
Below is a look at what Cloudflare observed for elections in Mexico, India, Iceland, South Africa, and parts of the European Union.
Dutch Political Sites Hit as EU Voting Opens
The 2024 European Parliament election ran from June 6 in the Netherlands through June 9 in the other 26 member states. Cloudflare detected DDoS attacks aimed at several election-related and political websites on the Dutch voting day and the day before.
On June 5, the primary attack against one site peaked at 14:13 UTC with 73,000 requests per second and lasted a few hours, ramping up slowly before stopping abruptly at 18:06. A second site was hit on June 6, peaking at 52,000 rps at 11:01 UTC.
Broader EU Targets
These attacks fit a wider pattern in Europe. In late February and March 2024, French government sites faced heavy fire, with Cloudflare blocking one attack that reached 420 million requests per hour over three hours — described by French officials as being of "unprecedented intensity."
Defense organizations, European courts, and academic institutions have also been recurring targets across the EU in 2024.
Mexico: Voting Hours Drive Traffic Down
Mexico's June 2 general election brought Claudia Sheinbaum to office, but the Internet data shows a familiar election-day shape. HTTP requests ran below normal between roughly 08:00 and 20:00 CST, dropping as much as 11% at 09:30 and 13:00. Overall daily traffic fell 3%.
After the first official results appeared around 23:00 CST, traffic jumped 8% above the previous week's baseline and climbed to 14% higher by 01:30 CST, staying elevated until 07:30.
On the DNS side, queries to election-result sites soared to almost 116 times the prior week's volume around 20:00 CST, remaining elevated until roughly 23:00.
News outlets followed a similar pattern. DNS traffic to media sites hit 1.8x by 20:00, surged to 4.8x by 23:00, and peaked at 01:00 CST with a staggering 1,057% increase over the prior week.
One Notable Mexico Attack
Mexico saw no unusual pre-election attacks, with a single exception. On May 6, a DDoS wave hit a state electoral organization at 130 million HTTP requests per hour, peaking at 113,000 rps for about 30 minutes starting at 09:12 CST.
India's 44-Day Vote: Mobile Traffic Rises
India's general election stretched from April 19 to June 1 in seven phases across 968 million eligible voters. Because each state voted on different days, the national traffic curve was mixed.
As with previous elections, the day before the first vote saw the largest increase of the year: April 18 came in 10% higher than the preceding week. Election days themselves typically cut traffic, as seen in the biggest national drop of 6% on May 7, when 11 states including the most populous were voting. May 20 and May 25 each saw smaller dips of 4% and 3%, with the worst impact usually between 15:30 and 19:30 local time.
The regional impact varied. Uttar Pradesh, India's most populous state, had a 9% drop on April 19. Across Maharashtra, home to Mumbai, May 20 traffic fell 17% for the day, bottoming out at about 20% lower around 14:30 local time.
Mobile Usage in a Mobile-First Country
Mobile devices already dominate in India, and that trend accelerated on election days. Weekday mobile traffic typically holds at 61-62%, rising to a weekend high of about 69%. Election days saw that mix climb to around 64%.
June 1, the final voting day and a Saturday, hit the year's highest weekend mobile share at 68%, standing above the usual 65-66% range.
No India Attack Spike
Cloudflare has not seen notable election-related attacks launched against India since April 2024. Instead, large assaults targeted financial services, consulting, and casino operations, with information technology, banking, and gaming the most-affected industries.
Iceland: Results Spark a Traffic Surge
When Iceland elected Halla Tómasdóttir president on June 1, the impact on Internet traffic was mild during balloting. Polls stayed open from 09:00 until 22:00 local time, which spread voter activity across the day. Traffic dipped only about 12% between 14:00 and 16:00, with a maximum drop of 20% at 15:30.
The bigger story came before and after voting, as seen in a chart illustrating trends in the country.
Daily traffic was 7% lower than the prior week on May 31, then jumped 14% on Sunday, June 2, as results were announced. That surge was eclipsed by only two days in 2024:
- May 2 (+17%), following a 9% previous-week drop caused by the national holiday marking the first day of summer.
- March 19 (+16%), tied to a volcanic eruption that forced evacuations and a state of emergency.
Election day also set new highs for mobile traffic share at 45%, trailing only the following day's 47%. Whether Icelanders checked news or chatter about politics, the shift lines up with the country's peak mobile moments, much like those seen around seismic events at the Blue Lagoon.
Iceland Attacks
No significant attacks were logged against Icelandic Internet properties during the election period since the start of April 2024. Retail and gaming were the top attacked sectors.
South Africa: Pre-election Surge, Election-Day Lull
South Africa’s general election on Wednesday, May 29, 2024, produced a clear pattern in HTTP request volumes. While polling stations were open, traffic ran below the previous week's baseline. The dip began around 05:30 local time (03:30 UTC), reached 16% below normal at 05:45, and stood at 14% lower by 11:00 (09:00 UTC). Reduced traffic persisted until roughly 18:00 (16:00 UTC).
The night before the vote told a different story. Traffic peaked at 25% above the baseline around midnight local time (22:00 UTC), suggesting significant pre-election activity. After polls closed, traffic rebounded and exceeded the prior week's levels, with a 6% increase at 23:30 local time on election day and gains of 12% and 8% at 04:00 and 09:00 local time (02:00–07:00 UTC) on May 30.
For the full day, traffic was 6% lower than the previous week. Mobile device share rose to 63% of requests, up from 57% the week before.
News Sites Under Fire
No significant threats were detected against government or election-related platforms. However, on May 7 — just over three weeks before the vote — a major news outlet came under a substantial DDoS attack. That day saw 773 million total requests, with the attack peaking at 16:06 local time (14:06 UTC) at 54,000 requests per second. The onslaught continued over the following days.
Election Effects Are Part of a Larger Geopolitical Pattern
Elections sit alongside broader geopolitical shifts as forces that shape Internet traffic and security. The Q1 2024 DDoS threat report noted a 466% surge in attacks on Sweden following its NATO accession, echoing a similar pattern seen during Finland’s NATO membership process in 2023.
Active conflicts produce comparable effects — disrupting traffic and inviting cyberattacks. During the first year of the war in Ukraine, and more recently, Cloudflare’s Cloudforce One stopped a phishing campaign from the Russia-aligned actor FlyingYeti. A Project Galileo update also detailed protection offered to Meduza, an independent Russian-focused news outlet, against online attacks in late 2023.
Following the outbreak of the Israel-Hamas war on October 7, 2023, Cloudflare separately documented Internet disruptions, traffic shifts, and an increase in cyberattacks (1, 2). For ongoing monitoring, Cloudflare Radar tracks outages and traffic anomalies, while the 2024 Elections Insights report provides a running view of how national and European elections affect the Internet throughout the year.
