Sudden Spike in Website Traffic from China – Possible Reasons Explained

Since early October 2025, digital professionals have been flooding forums, Google communities, and social networks with identical experiences.

On the Google Analytics Community, a post titled “Google Analytics 4 Bot Traffic Increase from China / Singapore on WordPress Sites” became the central reporting thread. Google product expert Raúl Revuelta confirmed that this traffic is inauthentic and not generated by real users.

On Reddit, hundreds of users are discussing the sudden spike in traffic from Chinese IPs. One user stated:

“My conversion rate dropped to 0.02% since this started. It makes any reporting completely useless. We went from 20,000 monthly pageviews to 400,000.”

On the Builder Society forum, users report:

“Singapore is now the top city sending traffic to my site. Shanghai is in the top 10. All of it is direct desktop traffic with extremely low engagement time.”

Bot traffic from China and Singapore shows several clear characteristics.

Geographic Data

In Google Analytics 4, websites that previously had zero traffic from China suddenly record dozens, hundreds, or even thousands of sessions per day. The city Lanzhou (Gansu, China) appears as the dominant location, often accompanied by Singapore as a secondary source.

Extremely Short Session Duration

Session duration typically ranges from 0–10 seconds. Real users spend varying amounts of time on pages — sometimes 15 seconds, sometimes 45 seconds or 2 minutes. Bot traffic shows machine-like precision: for example, exactly 11–13 seconds on every product page, something real users never do.

Near-100% Bounce Rate

Normal user behavior includes navigating multiple pages. Bot traffic usually triggers only session_start and page_view events, with no further engagement.

Desktop Devices with Outdated Windows Systems

Most of this traffic comes from desktop devices, often running Windows 7 or Windows 10, which is highly unusual for legitimate Asian users who predominantly browse on mobile devices.

“Direct” as the Traffic Source

In GA4, traffic is marked as direct when no referrer is detected. Bots frequently use VPNs, proxy servers, or direct IP requests, leaving Analytics no choice but to classify them as direct traffic.

According to industry reports, this is not a random occurrence. This wave is directly connected to the explosive growth of large language models (LLMs) and their massive need for training data.

Chinese AI Models and the Need for English Content

English-language websites are a goldmine for Chinese AI companies. October 2025 coincides with the training phase of many new AI models, explaining the intensity of scraping.

According to Akamai reports, AI scrapers account for 0.27% of total traffic across their platform — over one billion requests per day. This is a dramatic increase compared to late 2024, when AI bot traffic was virtually nonexistent.

A Brightspot survey (2025) revealed that over 40% of traffic on some large media websites is generated by bots, not real visitors.

Explosion of AI Bots in 2025

According to available data:

• Bytespider (TikTok / ByteDance bot) collects data 25x faster than OpenAI’s GPTBot

• Bytespider ignores robots.txt, meaning it does not respect your rules

• October–November marked the final training phase for many new AI models

You can spot them in:

• Google Analytics

• Cloudflare analytics (if you use Cloudflare)

• Server logs from your hosting provider

They also consume server resources.

Typical Bot Behavior

• Rapidly crawl many different pages (articles, products, categories)

• Session duration: 10–15 seconds per page (always the same)

• Bounce rate: often 80–90%

• Desktop devices (Windows)

Example:
If your blog has 100 articles, a bot may open all 100 pages in 20 minutes, spend 12 seconds on each, scrape the content, and leave.

Unlike traditional bots that actually load your pages, this new wave often falls into the category of “ghost traffic.” These bots never physically visit your website. Instead, they send fake data directly to Google servers using your unique Measurement ID.

Because they bypass your server, they often do not appear in hosting logs or Cloudflare analytics, only in GA4 reports. This explains why some website owners see massive spikes in Analytics while server logs show nothing unusual.

Your Measurement ID is visible in your website’s source code, meaning anyone can send fake hits to your GA4 property.

Typical Ghost Traffic Characteristics

• Session duration: 0–3 seconds

• Bounce rate: 98–100%

• Engagement: 0% (no clicks, scrolling, or interaction)

• Source: Direct / (none)

• Location: Lanzhou (China) or Singapore

How Ghost Traffic Works in Practice

Bots use the Google Analytics Measurement Protocol API:

1. A script extracts your Measurement ID

2. Fake session_start and page_view events are sent directly to Google servers

3. GA4 records them as legitimate sessions

4. Your reports become inflated with fake data

This means that even if you block China at the firewall level, you may still see Chinese sessions in GA4 — because bots never attempt to access your website at all.

China – The Epicenter of AI Development

China has become a global powerhouse in artificial intelligence. Companies like Alibaba, ByteDance (TikTok), Baidu, and Tencent invest billions into AI development. Training these models requires enormous amounts of text, images, and web data.

Because Western platforms are often blocked by the Great Firewall, spikes in traffic from Chinese IPs usually indicate:

• Automated content scrapers

• AI bots training language models

• Site structure scanners

Singapore – A Global Hosting Hub

Singapore is one of the world’s largest hosting and VPN hubs due to:

• Excellent internet infrastructure

• Strategic location between East and West

• Favorable business conditions

Even if the actual bot operator is not physically in Singapore, VPN exit nodes frequently are. An interesting pattern noted by site owners: when China is blocked, Singapore traffic doubles, indicating coordinated scraping using distributed infrastructure.

Bot traffic is not just a technical issue — it has serious business consequences.

Distorted KPIs and Unreliable Reporting

When bounce rate jumps from 40–50% to 75–80% and engagement drops to near zero, your data becomes unreliable. For agencies and client reporting, this can cause:

• Client confusion and panic

• Incorrect paid campaign performance evaluation

• Poor marketing budget decisions

Increased Server and Hosting Costs

While ghost traffic doesn’t load your server, real bot traffic that physically crawls pages can:

• Increase server load

• Slow down your site for real users

• Inflate cloud hosting bills (especially traffic-based pricing)

Core Web Vitals Degradation

Aggressive crawling can negatively impact:

• Largest Contentful Paint (LCP)

• First Input Delay (FID)

• Cumulative Layout Shift (CLS)

All of these directly affect SEO rankings.

E-commerce Issues and Fake Conversions

For online stores, consequences can be even more severe:

• Fake orders using stolen cards

• Abandoned carts with identical products

• Fraud alerts blocking legitimate customers

• Support teams wasting time on fake transactions

One Shopify store owner reported:

“Everything is from China — 260 visits today, every abandoned cart has the same $9 product and a blocked credit card attempt because it wasn’t a US IP.”

Quick 1-Minute Test in GA4

1. Go to Reports → Acquisition → Traffic acquisition

2. Change the primary dimension to City

3. Check the top cities

If Lanzhou and Singapore appear at the top despite never targeting those markets, you’ve likely been affected.

Additional Checks

• Compare server logs: GA4 shows thousands of sessions, but hosting logs don’t → ghost traffic

• Check Google Search Console: No organic traffic increase there → GA4 data is skewed

• Analyze bounce rate & engagement: 0s sessions + 100% bounce rate = bots

• Inspect User-Agent strings: Look for repetitive HeadlessChrome or suspicious agents

1. GA4 Bot Filtering and Segmentation

Enable GA4 bot filtering (Admin → Data Streams → Bot Filtering) to catch self-declared bots. Create GA4 Explore segments excluding China and Singapore to analyze clean data without permanent deletion.

2. Cloudflare WAF and robots.txt

If using Cloudflare, set WAF rules to block or challenge traffic from specific countries. Add bots like GPTBot, Bytespider, ClaudeBot to robots.txt, keeping in mind that many Chinese bots ignore it.

3. Google Tag Manager Filtering and Ongoing Monitoring

Use Google Tag Manager to prevent Analytics events from firing for suspicious traffic. Regularly compare GA4, Search Console, and server logs to monitor effectiveness.

4. Advanced Methods: Data Filters, Server-Side Tracking, ASN Blocking

Use GA4 Data Filters (Admin → Data Settings → Data Filters) for permanent exclusion — with caution.
Server-side tracking allows validation before data is sent to GA4.
Instead of blocking entire countries, block specific ASNs:

• China Telecom AS4134

• China Unicom AS4837

• Alibaba Cloud AS45102

This blocks bots without harming legitimate users.

Google has officially acknowledged the issue through product experts like Raúl Revuelta, stating:

“This is non-authentic traffic, not generated by humans. While self-declared bots are already filtered, this newer pattern does not yet trigger automatic exclusions.”

Google is developing a long-term spam detection solution, but there is no confirmed release date. Until then, manual filtering remains the only solution.

Does bot traffic from China hurt SEO?

Not directly. Google does not use GA4 traffic data for ranking. Indirect harm can occur if bots slow your site or distort decision-making.

Can bot traffic be completely eliminated?

No. The goal is to minimize impact and clean analytical data. Cloudflare + GA4 filters significantly reduce the issue.

Should I block all of China?

It depends on your business. If you don’t serve China, geo-blocking is reasonable. Otherwise, use managed challenges.

Why doesn’t Cloudflare blocking remove traffic from GA4?

Because much of it is ghost traffic sent directly to Google servers.

How long will this last?

This is a structural issue tied to the AI boom. As long as LLMs need data, bot traffic will grow. Continuous filtering is essential.

As AI models become more sophisticated, their demand for data will continue to rise.

As a website owner, digital marketer, or developer, you must adapt:

• Implement multi-layered protection

• Regularly cross-check analytics sources

• Be skeptical of sudden spikes

• Educate clients about this phenomenon

Bot traffic didn’t disappear with GA4 — it evolved.

At Redwood Digital, we understand how critical reliable analytics are for business decisions. If you need help implementing bot protection or optimizing your website, contact us.