If you opened Google Analytics recently and thought you were huge in Asia — bad news. That traffic spike from Singapore and Lanzhou, China lighting up your GA4 dashboard? It's ghosts. Zero-second sessions, 100% bounce rates, no clicks, no scrolls, no conversions. Nothing.

Since roughly September 2025, website owners across every niche — indie blogs, SaaS products, ecommerce shops, local service sites — have been reporting the same pattern. A sudden, massive influx of "direct" visitors from two very specific places. At first glance it looks like a breakthrough. Then you check the engagement metrics and see the flatline.

What's actually happening

These aren't traditional bots crawling your site to index content. They're not even visiting your website. The new wave of ghost traffic sends fake measurement hits directly to Google's data collection servers using your GA4 Measurement ID — the G-XXXXXXXXXX string in your tracking code. The bots spoof a session without ever loading a single page on your actual server.

This is why it's so confusing. Site owners who checked their Cloudflare dashboards, server access logs, or hosting analytics found nothing. Some had already geo-blocked China and Singapore at the firewall level — and GA4 still recorded the visits. The bots aren't talking to your server. They're talking to Google's.

Why Singapore

Singapore is one of the world's largest data center and cloud infrastructure hubs. Top VPN exit node. When automated systems need to route traffic through a legitimate-looking origin with solid bandwidth and low latency to global endpoints, Singapore is a natural choice. The bots aren't in Singapore any more than your traffic is coming from real Singaporean users. They're just routing through it.

The Lanzhou, China signature is the other half of the pattern. The pairing of these two locations with identical behavioral fingerprints is what initially tipped off the analytics community that something coordinated was happening.

The fingerprint

If you're not sure whether your traffic spike is real, look for this combination:

Traffic source shows as Direct / (none). Geographic origin is Lanzhou, China and/or Singapore. Session duration is zero seconds. Bounce rate is 100%. No scroll events, clicks, video plays, or file downloads. Screen resolutions of 1280x1200 or 3840x2160. Outdated Windows device signatures. High volume of sessions landing on 404 pages.

If that matches what you're seeing — you have ghosts.

Who's behind it

The honest answer is nobody knows for certain. The leading theory, supported by security researchers and the behavioral patterns, is AI training data scrapers — automated systems harvesting web content at scale to feed large language models. Companies like Alibaba (Qwen) and DeepSeek have been named in speculation, though nothing has been definitively attributed.

Over 47% of global internet traffic is now bots. A significant portion originates from Asian data centers. The economics are straightforward: bandwidth is cheap, data center access is easy, and the incentive to scrape the open web for training data is enormous.

The ghost traffic variant is clever. By hitting GA4's measurement protocol directly, the bots can probe which Measurement IDs are active, what types of sites they belong to, and potentially map the web's content landscape — all without leaving a trace in traditional server-side defenses.

The real damage

This traffic won't hack your site or steal your database. The damage is subtler. It destroys the integrity of your analytics.

Engagement rates tank because thousands of zero-second sessions drag down the averages. Geographic reports become useless. Conversion rates crater because you're dividing real conversions by a massively inflated session count. If you're reporting to clients or stakeholders, your numbers suddenly tell a story that doesn't match reality. And if you're on GA360 enterprise pricing, inflated session counts can directly increase your bill.

Every decision you make based on polluted data — ad spend allocation, content strategy, audience targeting — is potentially wrong.

What you can do about it

No silver bullet yet. Google has acknowledged the traffic as inauthentic and says they're working on a permanent fix. Until that ships, you need a layered defense.

Clean your reports. In GA4's Explore section, create exclusion segments that filter out sessions where the country is China or Singapore AND session duration is under 5 seconds. This won't fix your standard dashboard reports retroactively, but it gives you a clean lens for actual analysis.

Filter at the reporting layer. If you don't do business in China or Singapore, filter those countries out of your Looker Studio dashboards and GA4 library reports entirely. The ghost data still gets collected, but it won't pollute the numbers you present to stakeholders.

Block at the WAF level. If you're using Cloudflare or a similar WAF, challenge traffic from specific ASNs associated with known scraper infrastructure rather than blocking entire countries. More surgical. Less likely to catch legitimate users.

Use GTM as a gatekeeper. Add conditions in Google Tag Manager to prevent the GA4 tag from firing on sessions matching bot signatures — like those unusual screen resolutions (1280x1200) that no real human is using.

Check your server logs. Cross-reference GA4 data against your actual access logs. If the spike exists in GA4 but not in your server logs, you've confirmed it's a measurement protocol attack, not real traffic hitting your infrastructure.

The bigger picture

This is a preview of an uncomfortable new normal. As AI training gets more competitive and the demand for web-scraped data intensifies, the boundary between legitimate crawling and adversarial scraping keeps blurring. Google Analytics was built for a web where most visitors were human. That assumption is rapidly becoming outdated.

Standards like robots.txt directives for AI crawlers, the llms.txt specification, and server-side bot detection via tools like Dark Visitors are all responses to this shift. But they're playing catch-up against an arms race where the scrapers are always one step ahead.

Don't trust your GA4 numbers at face value. Cross-reference with server-side data. Filter aggressively. Assume that a meaningful percentage of your "traffic" is machines talking to other machines.

The ghosts from Singapore aren't going away. But at least now you know they're there.