GA4 Bot Traffic From China and Singapore, Explained

Your site isn't suddenly famous in Singapore

You open GA4 on a Tuesday morning and real-time shows 400 active users. From Singapore. On a site that sells, say, landscaping services in Ohio.

Congratulations, you've joined one of the longest-running unresolved messes in GA4's history. Since mid-September 2025, site owners have been reporting waves of fake traffic from China and Singapore, and the reports haven't stopped. One Google support thread describes 600+ real-time "users" from Singapore at once. Google has acknowledged the problem. Ten months later, there's still no fix on their side.

We watched this hit our own dashboards too. Sessions doubled overnight, engagement rate fell off a cliff, and every extra "visitor" was direct traffic from the same two countries.

What the traffic actually is

Two different things are going on, and they need different responses.

Real bot visits. Actual automated browsers loading your pages, often from cloud data centers in those regions. These run your GA4 tag like a normal visitor would. They show up with sessions, pageviews, sometimes even scroll events. GA4's built-in bot filtering (which relies on the IAB spider list) doesn't catch them because they don't identify themselves as bots.

Ghost hits. Nobody visits your site at all. Spammers fire events directly at GA4's Measurement Protocol using guessed or scraped Measurement IDs. Your server logs show nothing. Your CDN shows nothing. But GA4 dutifully records the "session," because as far as the API is concerned, a valid ID sent it data.

That second one is the part most people find unsettling. Your Measurement ID is public. It's sitting right there in your page source, and anyone can send events against it. There's no authentication step.

The damage is in your attribution, not your ego

Most write-ups treat this as a vanity problem. Inflated user counts, embarrassing, filter it out, done.

That undersells it. The bot traffic lands almost entirely in direct/(none), which means it doesn't just add noise, it changes the denominators your channel reporting depends on. Your sitewide conversion rate drops. Your engagement rate drops. Direct traffic swells, so every "what share of our traffic comes from campaigns?" answer is now wrong. If you report month-over-month to a client or a boss, September 2025 onward has a bot-shaped asterisk on it.

And it degrades slowly. We've talked to marketers who spent weeks A/B testing landing pages against numbers that were a third garbage. That's the real cost. Not the spike itself, the decisions made on top of it.

Direct traffic was already a junk drawer of lost attribution before the bots arrived. Now it's a junk drawer with a hole in the bottom.

What to do inside GA4

The standard fixes work, with caveats:

• Define unwanted traffic rules. In Admin, set up filters for the offending regions if you genuinely have no audience there. Blunt but effective. The obvious catch: any real customer from those countries disappears too.
• Use comparisons or segments to exclude the countries in reports. This is what most of the tutorial posts recommend. Understand what it does: it hides the rows. The data is still collected, still polluting exploration reports and anything unsegmented.
• Check hostname and screen resolution. Ghost hits often carry a missing or wrong hostname and default screen sizes. A hostname filter catches a decent share of them.
• Accept that history stays dirty. GA4 filters aren't retroactive. The polluted months are polluted forever. Annotate them (we keep a shared doc of "known bad" date ranges) so nobody trends against them in a QBR later.

Do these this week if you haven't. They're 30 minutes of work. Our guide to cleaning up messy GA4 data covers the broader hygiene pass while you're in there.

The part nobody mentions: keep a data source bots can't reach

Here's the angle the filter tutorials skip. Every fix above is triage inside a compromised system. The pageview-tag model is what's vulnerable: anyone can load your page, and worse, anyone can spoof your public Measurement ID without loading anything.

Click-level campaign data doesn't share that exposure. When your campaign links are short links you control, the click gets logged server-side at the redirect, before any JavaScript tag and any Measurement Protocol enters the picture. There's no public ID to spam. A bot in a Singapore data center hammering your homepage does nothing to the click count on your newsletter link.

So while GA4 was busy hallucinating visitors last quarter, the question "how many people clicked our launch campaign?" stayed answerable from click logs. Same for per-channel comparisons, as long as the links were tagged properly to begin with.

That's not a reason to drop GA4. It's a reason to stop letting one polluted tool be the only witness. When two sources disagree, the one bots can't write to is the one we trust.

The China and Singapore wave will eventually fade or Google will finally act. The next wave won't need new advice, though. Filter what you can, annotate what you can't, and keep at least one measurement path that spam can't touch.