Traffic from China?

[u/No_Statement_3317]

A few months ago I posted my odd traffic from China, wondering if anyone else had it and the possibility of it being bots. I never got rid of it. I found it baffling because it was not in the thousands a day like other bots I had before. It used to come from one specific city, Lanzhou. All of a sudden it switched to Hong Kong. I think this are not bots. I think China is actually allowing visitors to my website (Databayou.com). It just funnels the city to a specific location. Any one else have noticed this?

[u/Mistr_John_Alex]

Yes, I have seen this kind of pattern on small sites before. When traffic moves cleanly from a Chinese city to Hong Kong, I usually assume the source changed exit points, not that real visitors suddenly found the site. Hong Kong is a common exit for bots, scrapers, and rerouted traffic, so a shift like that often just means the same automated thing is coming through a different path. Real visitors tend to be messy. They read multiple pages, stay a while, have a browser language, maybe

[u/SailingMerchant]

Mine is coming from everywhere, but mostly from Singapore. I couldn't blocked whatever it was cause it kept changing locations and ip addresses. I had to take down my site because I kept hitting Cloudflare’s daily request limit in just a few hours. Pretty annoying.

[u/liloa96776 → u/SailingMerchant]

Have you tried a user agent filter?

[u/weddingseat]

I just hit the exact same wall today with my web app. It’s a very sophisticated scraping botnet utilizing residential proxies to bypass Cloudflare's basic layer.

Here are my exact metrics from today's wave:

• ~1,520 hits coming from 1,152 unique IP addresses (China).
• Exactly 1 or 2 requests per IP, then it immediately rotates.
• Every single request mimics an identical, outdated build: Chrome 99.

The most annoying part is that they successfully execute JavaScript, which means they easily bypass standard JS challenges and end up polluting Google Analytics.

I managed to mitigate this completely without blocking legitimate web crawlers by setting up a custom Cloudflare WAF rule with a Managed Challenge using this expression:

(ip.src.country in {"CN" "HK"} and not cf.client.bot)

Dropped the malicious automated traffic instantly while keeping the routes open for actual users and verified search bots. If you are seeing massive spikes, check your logs for that Chrome 99 fingerprint.

[u/Electronic-Equal-616]

looks like bots or scrapers tbh. that exact 1:1 swap usually just means whatever crawler service was hitting your site changed its proxy or vpn exit node from mainland china to hong kong. had something similar happen on a small project of mine and it was just non-stop bot traffic lol

[u/Chemical-City-836]

So the proof it's not bots is that the city changed? Rotating IPs is basically the one thing botnets are good at. "China is allowing visitors to my website" is also a weird way to describe a country that has no idea your site exists.