The Paris 2024 Olympics, Through the Lens of DNS and Email Trends

From July 26 through August 11, Paris hosts the 2024 Summer Olympics, an event featuring 329 events across 32 sports. Notably, this year welcomes breakdancing as an Olympic debut, while skateboarding, sport climbing, and surfing return for their second appearance following their introduction in 2020. Later this year, we will publish a detailed analysis of traffic trends during the event itself, which we will host as a dedicated report on Cloudflare Radar. For now, we examine the data leading up to the opening ceremony, looking at which countries show the most interest in Olympic web properties and how cybercriminals are exploiting the games.

Pre-Games DNS Traffic: The Host Nation Leads

Data taken from the 1.1.1.1 resolver service reveals that DNS requests for official Olympic-related domains are heavily concentrated in the host country. France accounts for a full 24% of all 1.1.1.1 traffic to Olympic websites, followed closely by the United Kingdom at 20% and the United States at 17%. The remaining countries with at least 1% of the traffic are Brazil (5%), Germany (4%), Russia (3%), Australia (2%), Japan (2%), India (2%), Spain (1%), Ireland (1%), Canada (1%), South Africa (1%), the Netherlands (1%), and Italy (1%).

While France has led overall since late January, the sharpest uptick in this traffic came largely from other countries later in the year. Those in the UK, France, Russia, Germany, and elsewhere have made the top five days with the highest DNS traffic to official Olympic sites increasingly recent.

  • January 31: In the lead-up to the 2024 Winter Youth Olympics closing ceremony in Gangwon, South Korea.
  • April 17: Over 250,000 new tickets for Paris 2024 were put up for sale.
  • January 19: The opening ceremony of the Winter Youth Olympics held in South Korea.
  • June 26: With exactly one month until the event, the Main Operations Center began full operations. Concurrently, street closures began in Paris, and US fans could secure IMAX theater tickets to watch the opening ceremony broadcast.
  • July 1: As Paris prepared its infrastructure, signposts were added to designate fast-track routes for Olympic vehicle drivers.

The Prize Money Effect

An examination of specific spikes on a single day shows a clear sector-specific interest share. On April 10, 2024, global DNS traffic to Olympic domains surged, with the highest increases observed in Germany, Russia, the US, the UK, France, Brazil, and Australia, in that order. This particular day featured major press conferences, including a globally covered announcement that track and field events would be the first in Olympics history to offer prize money, with gold medalists taking home $50,000.

Home Turf: French Ticket Sales

Within France, ticket releases have been the primary traffic driver. The largest spike came on February 8 with the start of the "Paris 2024 official ticketing website surprise releases," offering the first phase of 2024 tickets. That day saw daily DNS traffic double compared to the previous week's average. Additional concentrated surges around ticket campaigns include:

  • March 4: The launch of "Athletics Special" ticket sales for events at the Stade de France, which coincided with the unveiling of the official Olympic poster. This caused a 45% rise in daily DNS traffic compared to the prior week.
  • The week of May 12: The arrival of the Olympic torch in France marked a prolonged increase in traffic.
  • April 14: A final call for the sale of 250,000 tickets for major Games attractions.

These spikes often matched the clock, with volume peaking sharply at the daily 10:00 time slot when tickets went live. On February 8, for instance, the start of the ticket rollout caused a 398% increase in hourly DNS traffic versus the prior week.

Email Security Themes

As is standard for major global events, the Olympics are a fertile topic for spam and phishing campaigns. From January through late July, Cloudflare's Cloud Email Security service processed well over half a million emails with "Olympics" or "Paris 2024" in the subject line. The peak volume was observed during the week of July 15, a 694% increase over the busiest week in January.

Not all of that mail was wanted. Out of those examined in the analysis, spam contents occurred at a rate of 1.5%, and fully malicious emails made up a further 0.2% of the total. That represents about 15 spam and 2 malicious messages per 1,000. Week by week, the middle of the year saw a noticeable lift in abusive messages:

  • The week of May 6 boasted the year's highest ratio of malicious emails to date, at 0.6%.
  • After that, the risk factor dipped slightly before the most recent count. The week of July 8 saw a rebound to 0.4%.
  • The week of June 24 featured the most spam on record, hitting 7% of messages concerning the Olympic keywords.

Given the number of events that were still to take place over the latter half of July, the expectation is that both mail volume and the share of phishing attempts and spam on Olympic topics will trend upward at least into the event's first week. The delivery of both good and bad mail should keep pace with the global audience, suggesting that France's lead in the DNS traffic is only going to keep expanding.