Why is my website getting traffic from China?

Most of it is automated bot traffic, not real visitors. Since mid-September 2025, websites worldwide have seen a wave of sessions from Lanzhou, China and Singapore that arrive as direct visits with no referrer and no engagement. The timing lines up with Chinese AI companies scaling up, and training AI models takes enormous amounts of web data.

Why does the traffic come from Lanzhou and Singapore?

Lanzhou is where much of the traffic originates. Singapore appears because it is a major data center hub and VPN exit point, with fast connections to both Asian and Western networks, which makes it a convenient place to run automated operations from. Smaller volumes also come from data center hubs such as Ashburn, Virginia.

How can I tell if the traffic from China is bots?

Look for a consistent pattern: sessions lasting 0 to 1 second, a single page view, a 99 to 100% bounce rate, a direct or (not set) source with no referrer, and zero scrolls, clicks, or conversions. Visits often arrive at regular intervals, and device profiles such as Windows 7 with uncommon screen resolutions are another giveaway.

What are ghost sessions?

Ghost sessions are visits that appear in your analytics but never reached your website. The bot sends tracking calls straight to your analytics platform without loading a page, so the session shows up in your dashboard while your server logs show nothing. Comparing analytics data against your server or CDN logs is how you confirm them.

Is my website being hacked?

The pattern points to data collection rather than a break-in. Many of these sessions never touch your server at all, because the bot reports a visit directly to your analytics platform. The real damage is to your data: inflated sessions, a collapsing conversion rate, and reports you can no longer trust.

How do I remove China bot traffic from Google Analytics?

Create a segment or filter that excludes the pattern: sessions from China and Singapore with engagement time under 10 seconds and a bounce rate near 100%. Apply it whenever you analyze performance so your reports reflect real visitors. Filtering cleans your reporting, but it does not stop the traffic reaching your ad platforms.

Does this bot traffic affect my Google Ads and Meta campaigns?

Yes. When bot sessions pollute your conversion data, bidding algorithms learn from the wrong signals and look for more traffic like it, which drains budget. Attribution breaks down too, so budget flows to the wrong channels. Check the geographic breakdown in Google Ads and Meta Ads Manager for impression or click spikes from regions you do not target.

Should I block traffic from China and Singapore?

If you don't sell to those markets, firewall rules at your hosting or CDN layer that target China, Singapore, and the specific networks this traffic comes from will stop the bots that load your pages. They won't catch ghost sessions, which never reach your server, so pair them with analytics filters and a check of your ad platform data.

Why Your Site Is Getting Flooded with Bot Traffic from China

If you've checked your analytics recently, whether that's Google Analytics, Adobe Analytics, or your ad platform dashboards, you may have noticed something strange. Traffic from China and Singapore has exploded. Sessions are up. Pageviews are climbing. At first glance, it looks like you've cracked the Asian market without even trying.

Then you look closer: 100% bounce rates. Zero-second sessions. No conversions. No form fills. No purchases. Nothing.

These aren't customers. They're bots. And since September 2025, they've been hitting websites worldwide at an unprecedented scale. This isn't just an analytics annoyance. It's polluting marketing data across every platform, distorting ad performance metrics, and causing real business damage.

What Is Actually Happening?

Starting in mid-September 2025, a massive wave of automated traffic began flooding websites globally. Security researchers and analytics users worldwide have confirmed this highly specific pattern. The traffic originates primarily from Lanzhou (China) and Singapore, shows up as "direct" visits with no referrer, and exhibits zero meaningful engagement.

What makes this wave different from typical bot traffic is its sophistication. These aren't clumsy scrapers that trip security filters. Many of these bots send measurement calls directly to analytics platforms without fully loading web pages, creating "ghost sessions" that appear in your dashboards but never actually touched your server. Others execute JavaScript, trigger pixels, and mimic human browsing patterns just enough to slip through standard detection.

The result is that this traffic shows up everywhere: in your web analytics, in your ad platform reports, in your CRM attribution data.

What Are the Telltale Signs?

This bot traffic follows a consistent, identifiable pattern:

Geographic origin. Primarily Lanzhou (China) and Singapore, with secondary traffic from Ashburn, Virginia and other data center hubs.
Session behavior. 0-1 second duration, single page views, 99-100% bounce rate.
Traffic source. Appears as "direct" or "(not set)" with no referrer information.
Device fingerprint. Often Windows 7 with screen resolutions of 1280x1200 or 3840x2160, device profiles that are statistically uncommon for real users.
Engagement. Zero scroll depth, zero clicks, zero conversions.
Timing pattern. Often arrives in regular intervals: pairs of sessions every hour, or bursts at predictable times.

Why Is This Happening Now?

The timing coincides with the rapid expansion of Chinese AI companies and their large language models. Companies like Alibaba (Qwen), DeepSeek, and others are scaling up aggressively, and training competitive AI models requires massive amounts of web data.

Singapore appears prominently because it's a major data center hub and VPN exit point. Its infrastructure is fast, its connectivity to both Asian and Western networks is excellent, and it provides a convenient proxy location for operations that might face restrictions if run directly from mainland China.

What Is the Real Damage to Your Marketing?

"It's just noise in my analytics" is the common dismissal. But the downstream effects are more serious than most marketers realize.

Your KPIs become unreliable. Your conversion rate craters, not because your marketing stopped working, but because the denominator is stuffed with fake sessions.
Ad platform algorithms get poisoned. When bot traffic pollutes your conversion signal, bidding algorithms learn the wrong patterns. They optimize to find more traffic that looks like bots, creating a negative feedback loop that drains your budget.
Attribution models fall apart. Bot sessions inject noise into the customer path, causing attribution models to assign credit incorrectly. Budget flows to the wrong channels.
Stakeholder trust erodes. Unexplained data anomalies are credibility killers. When traffic jumps 300% overnight with zero business impact, every number you present becomes suspect.

How Can You Protect Your Data?

There's no single fix that eliminates this problem entirely, but a layered defense can dramatically reduce the impact.

Block at the Edge

If you use Cloudflare, Akamai, or another CDN/WAF, set up firewall rules targeting traffic from China (CN) and Singapore (SG), along with specific ASNs (113220, 113203, 45899 are known sources). Enable bot fight mode if available.

Note: Edge blocking stops bots that actually load your pages, but it won't catch ghost sessions that send measurement calls directly to analytics platforms without hitting your server.

Filter in Your Analytics Platform

Create segments or filters that exclude the bot traffic pattern: sessions from China and Singapore with engagement time under 10 seconds and bounce rates near 100%. Apply these when analyzing data to see your real performance.

Use Real-Time Bot Detection

Manual blocks via Cloudflare and filtering in GA4 are essential first steps, but they cannot keep up with this dynamic threat. Real-time bot detection automatically adapts to bot networks that constantly rotate their IPs and device fingerprints. It blocks malicious traffic before it can fire your Google Ads, Meta, or TikTok pixels, ensuring your bidding algorithms learn only from verified human interactions.

Cross-Reference with Server Logs

Compare your analytics data against server logs or CDN logs. If sessions appear in your analytics but not in your server logs, you've confirmed ghost traffic.

Monitor Your Ad Platforms Separately

Check geographic breakdowns in Google Ads, Meta Ads Manager, and other platforms. Look for unusual spikes in impressions or clicks from regions you don't target.

What Should You Do Right Now?

If you haven't already, take these steps this week:

Check your analytics for traffic spikes from China and Singapore over the past 90 days.
Look at engagement metrics for that traffic. If it's near-zero engagement with 100% bounce, you've been hit.
Set up exclusion filters to clean your reporting.
Implement edge blocking if you have a WAF/CDN.
Review your ad platform data for similar patterns.

The bot traffic problem isn't going away. If anything, it's accelerating as AI development intensifies globally. The question isn't whether you'll deal with invalid traffic, it's whether you'll deal with it proactively or let it quietly corrupt your marketing decisions.

Want to see how much invalid traffic is really hitting your campaigns? Try our free traffic analyzer. No signup required.

Why Your Site Is Getting Flooded with Bot Traffic from China and Singapore