GA4 traffic from China and Singapore: what it is and what to report

If GA4 suddenly shows a wave of Direct sessions from China (often Lanzhou) and Singapore, with engagement time close to zero and no key events, it is almost certainly bot traffic, not new customers. GA4’s automatic exclusion only removes known bots, and these get through. You cannot delete it, but you can confirm it in five minutes, hide it from the reports you read, and correct the numbers you share.

What the China and Singapore traffic in GA4 is

GA4 already removes known bots. Google says traffic from known bots and spiders is excluded automatically, using Google research and the IAB’s International Spiders and Bots List, that you can’t turn this off, and that you can’t see how much was removed (Google’s documentation). The keyword is “known”. Anything not on that list lands in your reports like a normal visit.

The China and Singapore wave is the best known case of that gap. What follows comes from community reports, not from a Google post-mortem:

• When: reports describe the first signs around mid-September 2025, spreading through Reddit and Google’s support forums by October (DefiniteSEO). In September 2026, Search Engine Watch reported a fresh Singapore wave, some of it built to look closer to human browsing.
• What Google says: nothing specific to this wave. Its known-bot exclusion lets this traffic through, and we found no dated Google announcement of a fix.
• How it might work: a common theory is that the hits are sent straight to Google’s collection servers using your measurement ID, so they never touch your website (breached.company). It would explain why the visits often don’t show in server logs. Treat it as a plausible theory: nobody has published proof of who runs these bots or why.

How to tell if the spike is bots or real visitors

Do this before you exclude anything. A DTC brand that ships to Singapore, or a services firm with a client in Shanghai, has real visitors there.

1. Open Reports > Acquisition > Traffic acquisition and compare the spike week with the week before. If the jump is almost entirely in Direct, keep going.
2. Add Country as a secondary dimension, then switch it to City. The pattern reported everywhere is Singapore plus China, often with Lanzhou as the city.
3. Read the engagement columns for those rows. Bot sessions show an average engagement time near zero, an engagement rate close to 0%, very few events per session and no key events.
4. Open Reports > Tech > Tech details. A uniform device and browser split is another bot signal.
5. Check your own systems. If your store, CRM or booking tool shows zero orders or leads from those countries during the spike, the sessions are not customers.

If the rows match all of the above, it is the bot wave. If some Singapore sessions engage and convert, you have real visitors mixed in: segment on engagement, not on country alone.

What GA4 can and cannot filter

This is where most guides go wrong. GA4 has several kinds of filter and they do very different things.

Tool	Where	Can it target China and Singapore bots?	Deletes data?
Known bot exclusion	Automatic	No, these bots aren’t on the known list	Yes, silently
Internal traffic data filter	Admin > Data filters	Only by IP address, which you don’t have	Yes, permanently
Hostname data filter	Admin > Data filters	Only if the bot sends a hostname that isn’t yours	Yes, permanently
Report filter or comparison	Standard reports	Yes, by Country or City	No
Exclusion segment	Explore	Yes, by Country, City or engagement	No

No country data filter. GA4’s data filters cover internal traffic, developer traffic and hostnames (Google’s data filters page). The internal traffic filter works on IP addresses (Google’s documentation), and GA4 never shows you visitors’ IP addresses, so you have nothing to put in it. Data filters also only apply from the moment you create them and never clean history.

The hostname allowlist is worth a look, with limits. In September 2026 Google added Include filters for hostnames: you list the domains you own and GA4 drops events from any other hostname, including events with an empty one (What’s new in Google Analytics, covered by Search Engine Journal). That catches spam that sends a fake or missing hostname. Two catches: Google says the Include filter doesn’t apply to events sent with the Measurement Protocol, which is the route the main theory says these bots use, and a bot that sends your real hostname passes straight through. Run it in Testing state first, because an active data filter deletes data for good.

Blocking at the firewall is a separate fix. Some site owners say a Cloudflare country block didn’t remove the sessions from GA4 (breached.company). If the hits never reach your server, your server can’t block them.

How to clean the numbers you read every week

Since you can’t delete the sessions, hide them where you read the data:

• Standard reports: in Traffic acquisition, click Add filter, pick Country, choose Exclude, and select China and Singapore (Google’s documentation). Or create a comparison with Country “does not exactly match” (comparisons). If your property has saved comparisons (Admin > Data display > Comparisons, still rolling out), save it once and reuse it in any report.
• Explore: build a session segment and use Add condition group to exclude sessions where Country is China or Singapore (segment builder). If you have real customers there, exclude on City = Lanzhou plus engagement time under a few seconds instead.
• Your trend line: recompute last month’s sessions and engagement rate without those countries before comparing with this month. Otherwise the bot wave reads as growth, and the week it stops reads as a crash.

What to tell your boss or your team

Keep it short and lead with what it means for decisions:

“The jump in sessions since [date] is bot traffic from China and Singapore, a known GA4 issue that Google’s automatic filter doesn’t catch yet. It has zero engagement and zero orders. Excluding it, traffic is [up/down X%] versus last month, which is the number we should use.”

Then fix the one decision it might have distorted. If someone was about to cut a channel because the conversion rate fell, or celebrate a launch because traffic doubled, re-run that comparison on the filtered numbers first. The step-by-step version of that check is in our GA4 traffic drop checklist, and the same logic works for a spike: rule out the data problem before you read the marketing.

How to catch the next wave before Monday

The waves start and stop without warning, and the usual way to find one is opening GA4 and wondering why Direct doubled. Dialytics, our product, posts a weekly GA4 digest in Slack every Monday and checks your numbers every morning against the same weekday over the last 12 weeks or so. A sudden jump in sessions on a normal Tuesday is exactly what it flags, at most one alert a day. You can then mention the bot in the alert’s thread to ask which country or channel the sessions came from, without opening GA4. It doesn’t filter the bots out of GA4 for you; it tells you the day after they show up.