If you have opened your Google Analytics 4 (GA4) dashboard recently and felt a sudden rush of excitement followed by a wave of confusion, you are not alone. Across the globe, website owners are reporting the same bizarre phenomenon: thousands of “Direct” visitors suddenly appearing from Lanzhou, China and Singapore.
At first glance, it looks like a marketing miracle. But a quick peek at the engagement metrics tells a different story: 0-second session durations, 100% bounce rates, and zero conversions.
Welcome to the 2025–2026 Ghost Traffic Surge. Here is everything you need to know about why this is happening, why it isn’t a security breach, and how to fix your data.
1. What is “Ghost Traffic” Anyway?
Unlike traditional bots that crawl your site to index content, this new wave is often called “Ghost Traffic”. These bots don’t always visit your actual website; instead, they send fake data hits directly to Google’s servers using your unique Measurement ID.
Because they bypass your server, they often won’t even show up in your hosting logs, appearing only in your GA4 reports.
Why the sudden surge?
Industry experts believe this traffic is fueled by:
- AI Scrapers: As AI models race to train on real-world data, automated scrapers are constantly probing sites for structured information.
- Cloud Routing Hubs: Singapore is a major global data center hub; many automated tools route through there even if the “human” behind them is elsewhere.
- Filter Testing: Sophisticated bots are being designed specifically to bypass GA4’s standard automated filtering systems to see what they can get away with.
2. Is My Website Being Hacked?
The short answer is: No.
While a sudden spike from foreign countries can feel like a security threat, this traffic is generally harmless to your site’s infrastructure. These bots are harvesting data or testing tracking IDs, not attempting to breach your database.
However, they are extremely dangerous to your data accuracy. They “pollute” your KPIs, making your engagement rates look terrible and your geographic reports completely unreliable.
3. How to Clean Your Data (The 2-Layer Fix)
Since Google has confirmed these hits are inauthentic, they are working on a long-term fix. Until then, you need a two-layer defense.
Layer 1: The “Firewall” Defense (Cloudflare)
If you use Cloudflare, you can stop many of these bots before they even trigger a page load.
- The Rule: Create a custom WAF rule to Challenge or Block traffic where
Countryis China or Singapore. - The Exception: Always add a condition to exclude Verified Bots (like Googlebot) so your SEO rankings aren’t accidentally harmed.
Layer 2: The “Clean View” (GA4 Exploration)
Standard reports will remain “dirty” for a while, but you can see the truth in the Explore section:
- Create a new Blank Exploration.
- Create a Session Segment to Exclude traffic where
Countrycontains China or Singapore. - Apply this segment to see your true engagement, conversion, and traffic numbers.
4. Final Verdict: Don’t Panic, Just Filter
The “China/Singapore Bot Wave” is a regular scene in the 2026 digital landscape. It’s a side effect of the AI revolution and the constant battle for data.
By implementing these filters today, you can stop making business decisions based on “ghost” numbers and get back to growing your real human audience.
Sources
Google Analytics Official Community: A major thread titled “Google Analytics 4 bot traffic increase from China/Singapore” has become the central hub for reports and updates. https://support.google.com/analytics/thread/378622882
Reddit (r/GoogleAnalytics): Extensive discussions can be found under threads like “This Lanzhou-Singapore bot traffic is getting worse”. https://www.reddit.com/r/GoogleAnalytics/comments/1oi4bo0/unexpected_traffic_from_singapore_and_lanzhou/?rdt=37365