GA4 traffic from China and Singapore: what it is, and what to do

If GA4 suddenly shows a wave of visitors from China, often Lanzhou, and from Singapore, you are almost certainly looking at bots, not a new market. Site owners around the world have reported the same pattern since October 2025, and the explanation passed on from Google's teams is that it is non-human traffic getting past GA4's bot filtering. Here is how to recognise it, keep it out of your reports without losing data, and check whether any of it reaches your ads.

What it looks like

• Direct traffic. Most of the sessions arrive with no source, so they land in the Direct channel.
• Two places. China, often Lanzhou in Gansu province, and Singapore, usually near the top of the Town or City report.
• Nothing happens. One page per session, almost no engagement time, and no scrolling, clicks or conversions.
• No business behind it. Sessions jump while calls, form enquiries and sales stay where they were.

Sources for the pattern: Castus, Why GA4 Is Recently Reporting Traffic From China & Singapore, and GoOp, GA4 traffic spike from China and Singapore in regional Australia.

What Google's teams said

The main discussion is a Google Analytics Help Community thread opened in October 2025. In November 2025, a Product Expert there, a volunteer rather than a Google employee, relayed that Google's teams had identified the spikes as a new, targeted form of non-human traffic that was getting past the standard bot filtering, that self-identifying bots were already filtered out, and that a long-term fix was in development. The immediate step offered was a segment in an Explore report, because it changes only how you view the data, so no real traffic is excluded for good.

Source: Google Analytics Help Community, Google Analytics 4 Bot Traffic Increase from China / Singapore on WordPress Sites (the Product Expert's update of 10 November 2025).

Why blocking China doesn't always clear it

Some site owners block both countries in their firewall and still see the sessions. GoOp's explanation is that part of this traffic behaves like ghost traffic: GA4 records it, but the server and firewall logs show no matching visits, so there is nothing at the website to block. The rest really loads your pages, and that part leaves addresses in your access logs.

A log that records every page request, your CDN's if it serves cached pages, tells you which part you have. If the visits are there, paste the log into the free IP exclusion list builder: it marks every address in a cloud or hosting network, Alibaba Cloud, Tencent Cloud and Huawei Cloud included, and says how many belong to which. It runs in your browser, so the log never leaves it.

Keep it out of your reports, not out of your data

• A report filter for a quick look: in a standard report, add a filter on Country that leaves out China and Singapore. It changes only that report.
• A segment in an Explore report for analysis you come back to: exclude sessions from those countries or, if you have real customers there, only the ones with almost no engagement.
• Not a data filter. GA4's data filters cover internal traffic you mark by IP address, developer traffic and unwanted hostnames, not countries, and what they exclude is gone for good.

Our guide to bot traffic in GA4 covers the rest of GA4's tools and their limits.

Check whether it reaches your ads

On its own, this traffic costs you clean reports, not money: it mostly arrives as Direct, not through your ads. Check that it stays that way. Break the sessions from those two places down by session source / medium; any that arrive as google / cpc are ad clicks you paid for. Paid landings carry a click ID such as gclid in the URL, so the builder can count them from your log too: it counts the distinct Google Ads clicks behind each address and marks the ones in cloud networks, which are the safest to exclude.

What AdProtektor adds

AdProtektor scores every visit that loads your pages, from the network an address belongs to and how the visit behaves, so automated sessions show up as Bot in your dashboard instead of as an audience, whether they came from an ad or not. When they come from your ads, it blocks the sources that cross your threshold and keeps your Google Ads exclusion lists in step. With ConversionOS, it can also withhold the conversions of blocked visitors instead of sending them to Google Ads, Meta and GA4. Ghost hits that never load your pages are invisible to any script on your site, ours included; those can only be handled in GA4.

To see which of your visitors are automation, and keep them out of your ads, start a free trial and add the script to your site.