Chicago traffic: quiet convention, later nights

Cloudflare’s observations of Internet traffic during the Democratic National Convention, held August 19-22 in Chicago, show no dramatic disruption in the host city. As with the Republican National Convention in Milwaukee earlier in the summer, overall patterns remained stable. The one notable shift appeared after midnight: from August 15 through the first three days of the convention, traffic in Chicago ran 10% to 20% higher than the prior week during overnight hours.

More pronounced effects appeared in DNS resolution data from Cloudflare’s 1.1.1.1 resolver, particularly around domains tied to the new Democratic ticket.

Kamala Harris’s official website only became an independent property after July 21, when President Biden withdrew from the race and endorsed her. Before that date, the domain redirected to Biden’s site. Since late June, aggregated daily DNS traffic to Harris-related domains has climbed steadily, with a sharp jump on August 6 — the day she selected Minnesota Governor Tim Walz as running mate — when traffic rose 99% over the prior week.

Campaign appearances with Walz drove further peaks on August 8-9, with DNS traffic up 896% and 845%, respectively. A sustained increase began August 15 and continued through the convention, peaking on August 23 with a 21% week-over-week gain in DNS traffic to Harris-related domains.

Hourly data shows evening spikes aligned with the convention program:

  • Day 1, August 19: Peak at 23:00 EDT, up 313% over the prior week, around President Biden’s appearance.
  • Day 2, August 20: Peak at 00:00 EDT (August 21), up 466%, after former President Barack Obama’s closing speech.
  • Day 3, August 21: Peak at 22:00 EDT, up 70%, just before Governor Walz took the stage. The baseline was higher due to heavier traffic the prior week.
  • Day 4, August 22: Peak at 23:00 EDT, up 71%, around Harris’s speech.

Fundraising and news sites catch convention momentum

DNS traffic to Harris and Democratic fundraising domains peaked on day 4 of the convention around 21:00 EDT, up 493% from the previous week. Daily traffic that day rose 92% week-over-week.

US news organizations also saw increased DNS traffic during the convention, typically in the hour after each evening’s final speaker. Compared with the prior week: day 1 traffic rose 11% at 23:00 EDT (Biden), day 2 rose 10% (Obama), day 3 rose 21% at 23:00 EDT (Walz), and day 4 rose 28% at 23:00 EDT (Harris).

DDoS attacks against politically-linked sites persist

Distributed denial-of-service activity targeting US political organizations continued in the weeks before the DNC. Since July 21, Cloudflare has blocked attacks against three such organizations:

  • A site associated with one major party was hit on July 23 and again shortly before the convention.
  • The largest recorded attack of the period struck another politically-related website on July 26, peaking at 180,000 requests per second (rps) and lasting about 10 minutes. Smaller attacks occurred earlier that day and on July 28.
  • A political fundraising site saw a smaller attack on August 1, also lasting 10 minutes, peaking at 103,000 rps.
  • Most recently, attacks on August 17-18 targeted two politically-related websites, peaking at 62,000 rps and 24,000 rps, respectively.

The pattern is consistent with Cloudflare’s Q2 DDoS report: most such attacks are brief, and 81% peak under 50,000 rps. Attacks in the 100,000-250,000 rps range account for only 7% of HTTP DDoS traffic. Still, an attack at even 24,000 rps can be damaging for sites without adequate mitigation capacity.

Email: candidate names in spam and malicious traffic

Cloudflare’s Cloud Email Security service processed roughly 14 million emails from June 1 through August 21 that mentioned “Donald Trump,” “Joe Biden,” or “Kamala Harris” in the subject line. Trump appeared in 7.4 million of those messages.

Volumes shifted with the campaign calendar. Emails mentioning Trump surged in mid-July. Biden-related email traffic saw brief upticks on July 22-23 after his withdrawal and on August 20 following his DNC speech. Since July 21, over 3.2 million emails mentioned Trump, roughly 2 million mentioned Harris, and about 1.2 million mentioned Biden.

Spam and malicious email ratios diverged sharply by candidate. Of emails naming Trump, 34% were spam and 3% malicious. Harris-related emails were 0.8% spam and 0.2% malicious; Biden’s figures were 1.1% and 0.1%, respectively. The high Trump numbers are tied to the post-July 15 spike in all Trump-mentioning email, which included a disproportionate share of spam.

Running mates also generated mail volume. Since their respective announcements — JD Vance on July 15 and Tim Walz on August 6 — emails mentioning Walz (over 530,000) outpaced those naming Vance (over 241,000). Spam accounted for 1% of Vance-related messages and 0.1% were malicious; Walz-related spam was 0.7% with 0.03% malicious.

The DNC period shows the familiar interplay of public interest and abuse: DNS traffic follows speakers, fundraising surges with momentum, and politically relevant names attract both attention and attacks. Cloudflare continues to track these dynamics in its 2024 Elections Insights report, which will be updated as further election-related events occur.