When your analytics shows a wave of visitors from Ashburn, Virginia, you are almost always looking at servers, not shoppers. Ashburn sits in the part of Northern Virginia where several of the largest clouds run data centers, and analytics tools place a visitor by IP address. So crawlers, uptime monitors, scrapers and headless browsers running in those clouds arrive looking like people from Ashburn. Here is how to confirm it, keep it out of your reports where that is wise, and keep it off your ads.

Why Ashburn

Three of the biggest cloud providers run regions there or right around it:

  • Amazon Web Services runs its US East (N. Virginia) region, us-east-1, in Northern Virginia.
  • Google Cloud names Ashburn, Virginia as the location of its us-east4 region.
  • Microsoft Azure lists its East US and East US 2 regions in Virginia.

Anything that runs in those regions and loads your site, from a price-monitoring script to a bot clicking your ads, gets an address from that pool. Most real people in Ashburn browse from home broadband or a phone, and they don't arrive in bursts at 3 a.m. with identical devices.

Other towns that show up for the same reason

Ashburn is the best known, not the only one. Google Cloud names Council Bluffs (Iowa), The Dalles (Oregon), Columbus (Ohio) and Moncks Corner (South Carolina) as region locations; AWS runs regions in Ohio and Oregon; Microsoft's Central US region is in Iowa. A city report where small towns near those regions outnumber your real markets is telling you the same thing.

Sources: AWS Regions, Google Cloud Regions and zones and Microsoft Azure regions list.

Check the addresses

A city is a hint; the address settles it. Analytics tools like GA4 don't show visitors' IP addresses, but your server or hosting access logs do, and Google Ads visits normally carry a click identifier such as gclid in the landing-page URL, so you can pull out the paid arrivals first.

Paste the log, or just the addresses, into the free IP exclusion list builder. Given a log, it counts only the lines with a Google Ads click ID, and how many distinct clicks came from each address. It marks each address in a cloud or hosting network, using the ranges Amazon Web Services, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Akamai (Linode) and Vultr publish and the networks Hetzner, OVHcloud, Contabo, Scaleway, Alibaba Cloud, Tencent Cloud and Huawei Cloud announce, and says how many belong to which. It runs in your browser, so the addresses never leave it.

A cloud address isn't always a bot

Some real people browse from cloud addresses, through a VPN or a virtual desktop. Look at what the visits did, how long they stayed and whether they converted, before you treat a whole network as automation.

Keep it out of GA4, carefully

GA4 already excludes traffic from known bots and spiders on its own, and you can't switch that off. What reaches your reports from Ashburn is the automation that isn't on those lists.

You can exclude IP addresses or ranges, written in CIDR notation, with an internal-traffic rule and a data filter. Think before you do: a data filter's effect is permanent, it applies only from the moment you create it, a property can have up to 10 data filters, and cloud addresses change hands. To study the traffic without losing it, use a report filter or a comparison instead. Our guide to bot traffic in GA4 covers the signs to look for.

Sources: Analytics Help, Known bot-traffic exclusion and Filter out internal traffic.

Keep it off your ads

Cleaner reports don't give you back ad spend. If the Ashburn visits arrive through your ads, they cost you clicks and, when they trigger a conversion, they teach Smart Bidding to find more of the same. Two things help:

  • Exclude the addresses, not the town. Excluding Ashburn as a location in your campaign settings also hides your ads from real customers there. Excluding the data-center addresses is precise, and datacenter networks are the one place an asterisk range such as 203.0.113.* is safe. The account-level IP exclusion list reaches every campaign, Performance Max included. The builder can keep only the cloud and hosting addresses and builds ranges only inside those networks; how to spend Google's 500 slots explains which list each belongs on.
  • Keep their conversions out of bidding. A form fill or a checkout started by a script is still a conversion to Google Ads, Meta and GA4 if it reaches them.

Store owners see the same pattern in Shopify's reports; merchants have asked how to stop traffic from Ashburn in the Shopify Community. When those sessions also fill carts, our guide to bot checkouts on Shopify covers what to do.

What AdProtektor adds

A one-time list goes stale, because the addresses rotate. AdProtektor scores every visit as it happens, with the network an address belongs to among its signals, blocks the sources that cross your threshold and keeps your Google Ads exclusion lists in step, with datacenter and bot-network addresses on the account list. With ConversionOS, it can also withhold the conversions of blocked visitors instead of sending them to Google Ads, Meta and GA4.

A city in your report is a hint. The address behind it is the answer.

To see which of your ad visits come from data centers, start a free trial and add the script to your site.