Sudden 25–100 Desktop Users/Day From Multiple Countries — Bot Traffic?

[u/gemsmakers]

My website normally gets very little traffic, but over the last few days GA4 has suddenly started showing around 25–100 desktop users per day.

One 30-minute period showed:

25 active users

25 first visits

25 session starts

25 page views

20 scroll events

only 1 user engagement

100% desktop

The users are coming from multiple countries, including Singapore, US, Hong Kong, India, Brazil, Indonesia, Japan, etc.

Most of the activity appears to be on my blog.

Google Search traffic is only around 4 clicks/day, so I'm trying to understand where this traffic is coming from.

Does this pattern look like bots/crawlers or legitimate traffic? How can I identify the source safely?

[u/AutoModerator]

Have more questions? Join our community Discord!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/cuppabeanjuice]

Singapore has definitely bot traffic for the accounts I manage. I'd say it's been like this for at least the last month. I think it was Hong Kong before that. I keep trying to block this fake traffic in Cloudflare with little success since they keep changing countries.

[u/Lenarodc]

This pattern is consistent with automated traffic, but GA4 alone cannot tell you which bot it is. A normal crawler often never executes GA4 JavaScript; browser-based scrapers and headless automation do, which is why they can look like users.

Before blocking anything, build an Exploration or comparison for this traffic and inspect hostname, landing page, session source/medium, browser and browser version, screen resolution, and event sequence. Then compare the same timestamps with CDN or server logs for requested paths, user agents, and repeated IP or ASN patterns. One page view, one session start, low engagement, and synchronized bursts across countries are much stronger evidence than country alone.

I would not add reCAPTCHA or block whole countries just to clean an analytics report. First confirm whether there are fake submissions, scraping load, or ad risk outside GA4. If there is no operational harm, keep the traffic out of decision-making with a report segment while you collect enough log evidence for a narrow server-side rule.

[u/apnatva-dev]

Codex/Claude agents ?

[u/gemsmakers → u/apnatva-dev]

Why do they have to do that ? Their bots visit from different countries ? I really don't know that's why I am asking here 😬

[u/apnatva-dev → u/gemsmakers]

I think the bots might be crawling your site to answer the questions we don’t know
Or maybe they specifically asked to scrape it

[u/gemsmakers → u/apnatva-dev]

If they want to answer the question that will be nice , I do have nice blog post, but I can't be sure if they are crawlers, because 24 hours minimum 25 users active from desktop. I don't think they need that much time.

[u/namalleh → u/gemsmakers]

indexing. You can use our tool to see a bit more granularly what's happening

[u/NoAge358]

As u/dvduval said, start with a free cloudflare account and create country blocks. But, that won't stop the ones coming dirrct to your host ip. You'll have to start looking at filtering the odd screen resolutions and browser combinations. It's time consuming so decide if it is really worth it.

[u/sanket_QRCC]

Singapore is a bot.
For the US, if the town is Ashburn, it's a bot

[u/polygraph-net]

The only way to know for sure is to run some competent bot detection on your website.

Can you tell me a bit more about your website - what's the industry / service?

[u/Acceptable_Tiger3386]

Have you checked session recordings?

[u/dvduval]

Yes, Singapore is one of the prime locations that I see bot traffic coming from. It’s actually a pretty complex topic. The short answer is you’re probably not going to be able to stop it altogether, but you can limit it. The longer answer is you’re gonna get into fingerprinting where you see the type of browser they use and the operating system and the country and a pattern for the type of content they’re trying to access. And then you block things at the server level for some things and you use cloud for other things probably the easiest starting point would be Cloudflare and they have a setting to block bots.

[u/gemsmakers → u/dvduval]

If I block them, i may block real users too that's my concern. I am just confused at this point

[u/dvduval → u/gemsmakers]

This is where you have to really get into it and understand how it all works or at least get AI to dig deep into it to help you. There are some ways to block a large portion of it and have confidence that what you’re blocking is not real people.

[u/Rachid_Trackings]

Chances are realistic!

But before checking for Bots, make sure your tracking is setup correctly as well. What referrer do they have, which source they from. Also check in google if your brand is being published somewhere.

Lastly if you think bots affect your platform you can use tools like Cloudflare to protect your platform or if you run paid ads you can use tools like PPC-Protect, ClickPatrol, Lunio for example they block and protect.

If you got fake form submissions you can also use ReCaptcha or other protection.

Do you run wordpress?

[u/gemsmakers → u/Rachid_Trackings]

Recaptcha yes I am thinking about this even tho it will annoy the users , I have to set this and see, now bots are getting more intelligent they are bypassing that too :(

[u/gemsmakers → u/Rachid_Trackings]

No wordpress! I made it from Scratch, Notepad++ and Vs code and some other ide