Three quarters of my GA4 users were a bot in Singapore

If GA4 suddenly shows a wave of Singapore users with almost no engagement, one page view each and a 1280x1200 screen, it is very likely the bot traffic reported since September 2025. GA4's built-in bot filter misses it. You can hide it in reports, and if it loads your real pages, block it at your host's firewall.

On 28 September, azmth, my satellite tracker, had the biggest day in its history: 22,470 users. These days an ordinary day brings about two thousand. Then I opened the country report, and 17,052 of them were in Singapore.

So: a bot, or had azmth gone viral somewhere? Both, it turned out. The viral part was hiding underneath the bot.

How do you tell bot traffic from real visitors in GA4?

It took one comparison, Singapore against everyone else:

• Engagement: one second on average, against a minute and a half site-wide.
• Screen resolution: 81% of the Singapore visitors reported 1280x1200. Across the rest of the world, 56 people did.
• Pages: one each, spread across the whole site, then gone. The site as a whole averages almost six.
• Devices: 83% Windows 10, most of the rest an old version of macOS, and almost no phones.
• Source: all Direct, with no referrer at all.

The cleanest test came later, and it is the one I would start with now: bots only ever load the page. People click things.

The real people hiding under the bot

Hide Singapore and the chart shows three waves I had nearly missed. None of them were bots.

• Argentina, 8 to 10 September. About 4,200 people in three days, starting three days after I launched the Mars globe. They stayed almost three minutes on average, and 72% of them properly engaged.
• Indonesia, 15 to 18 September. Almost 6,000 people, 84% of them on phones and 87% engaged. My page titles started showing up in GA4 in Indonesian (“Pelacak Satelit”), because people were reading azmth through their browser's translation.
• Iran, 28 September, the same day as the biggest spike. In the space of half an hour, about 730 people opened the globe and clicked on satellites just over 4,700 times between them. A few were reading it in Persian.

I still don't know where any of them came from. GA4 files most of it under Direct, which is usually what you get when a link travels through WhatsApp, Telegram or a group chat. If that was you, thank you. While I was busy being annoyed at a bot in Singapore, you were the people actually using the thing.

What is the Singapore bot?

I am far from the first person to meet it. The floods of Direct visits from Singapore and from Lanzhou, in China, started in mid-September 2025, and by October GA4 users were comparing notes in a Google Analytics Community thread. It has come back in waves since, including in April and September 2026, and Search Engine Watch has written about its return in GA4's Singapore bot problem is back.

Google itself has said very little. The closest thing to an answer came in November 2025 from a volunteer Product Expert on its forum, relaying that Google's teams see it as non-human traffic that gets past GA4's standard filters, and that a longer-term fix was in development. Nobody has shown who runs it or why. The theory you see most is scraping for AI training, which is a guess, not a finding.

My hosting logs on Vercel told me more than GA4 could. In one day azmth served just over a million requests, and 651,000 of them, 61%, came from a single network: AS132203, Tencent Cloud. Almost every request came from a fresh 43.172.x.x address, claimed a different version of Chrome, and went straight for the satellite catalogue and the 3D models. That address block is registered to Tencent's company in Singapore, which is probably why GA4 put all of it in Singapore, even though some of those servers sit elsewhere. And these were not fake hits sent to Google. The bot loaded the real site, about 38 requests per “visitor”.

Can GA4 filters block the Singapore bot?

No, they can only hide it. GA4 already removes known bots, using Google's own research and the IAB's list of known spiders and bots. You can't switch that filter off or see how much it removes, and this bot gets straight past it. GA4's data filters only drop traffic by IP address, by developer flag or by hostname. This bot changed IP with almost every request, so an IP filter wide enough to catch it would also drop real visitors on the same cloud network, and data filters are permanent. It also loaded the real hostname.

What GA4 can do is hide it. Add a comparison or a report filter that excludes Screen resolution 1280x1200, or Country Singapore if you don't mind losing real Singaporeans too. In Explorations, a segment does the same job. None of this stops the bot. It still loads your pages, and the days it already visited stay polluted.

How I blocked it on Vercel without blocking Singapore

What pinned it down was the TLS handshake. Vercel's firewall shows a JA4 fingerprint for incoming traffic, and all 651,000 of those Tencent requests had the same one:

The part that matters is the 00. It means the bot offered no ALPN, the part of the handshake where a browser lists the protocols it speaks. No ALPN means no HTTP/2. Chrome puts h2 in that slot.

The rule pairs that fingerprint with the network:

Rule:  Block Tencent Cloud scraper
If:    AS Number   equals  132203
and:   JA4 Digest  equals  t13d131000_f57a46bbacb6_e7c285222651
Then:  Deny

Why not block the whole network? Tencent Cloud rents servers to anyone, and as far as I know, servers like these are also a common place to run a personal VPN or proxy, including for people in China, where azmth has had readers since a Chinese tech site wrote about it. And why not block the fingerprint alone? Other software built on the same TLS library, set up the same way, could share it. Together, in my logs, they matched nothing but the bot.

I set the custom rule to Log first and watched it for a while. Every request it caught was the bot. Then I switched it to Deny. The next day, Singapore was back to a few dozen people a day, roughly what it had always had. And since May 2026, Vercel doesn't bill for requests its firewall denies, so the block costs nothing.

Quick answers

One more thing

Look at the bottom-left corner. When you arrived, this page filed you as a bot, because all you had done was load it. Scrolling doesn't change its mind, since bots scroll too. If it still thinks so, click anything. And if your screen happens to be exactly 1280 by 1200, it has a different message for you.