The finding in one paragraph
Over five weeks we recorded 5,224 sessions. 487 of them — 9.3 percent — geolocated to Singapore, a market where we have almost no customers. Those sessions were 92.8 percent direct with no referrer, averaged 40 seconds on desktop, and spread across roughly 155 different landing pages including legal pages, redirected URLs and foreign-language posts. That is not an audience. That is infrastructure crawling a sitemap.
Why Singapore keeps showing up in analytics
Singapore hosts major cloud regions for AWS, Google Cloud, DigitalOcean and others. Crawlers, scrapers, AI training and retrieval bots, uptime monitors and link-preview services all egress from datacenters there. GA4 geolocates by IP address, so a datacenter request in Singapore is recorded as a Singaporean visitor. We checked the same pattern across several unrelated sites we manage — including a Dubai clinic with no conceivable Singaporean audience — and it appears on every one of them.
The four tells, with our numbers
Any one of these alone is weak evidence. All four together are conclusive.
| Signal | Singapore segment | Site benchmark |
|---|---|---|
| Direct / no referrer | 92.8% | ~59% |
| Avg session duration (desktop) | 40s | 162s (US traffic) |
| Distinct landing pages | ~155 for 487 sessions | humans concentrate on winners |
| Pages no human lands on | refund policy, 301-redirected URLs, translations | — |
The landing-page spread is the sharpest test. Real audiences pile onto the handful of pages that rank. Crawlers visit everything once, evenly — which is exactly what a flat distribution across 155 URLs looks like.
Why engagement rate hid it for months
The Singapore segment showed a 50.1 percent engagement rate — essentially identical to our site average of 52 percent, and better than our US traffic. That is why we never caught it in routine reporting. GA4 counts a session as engaged if it lasts longer than ten seconds, and a 40-second automated fetch clears that bar every time. Engagement rate is the wrong instrument for detecting bots. Session duration and landing-page spread are the right ones.
How much of your traffic this might be
For us, the clearly non-human bucket was Singapore (9.3%) plus our own development traffic (5.3% — localhost and staging hostnames flowing into the production property). Adding sessions with no country set at all, the plausible range reached a quarter to a third of recorded traffic. Every rate we report — conversion, CTR, cost per session — was quietly distorted by that denominator.
Check yours in five minutes
- 1. Country report, sorted by sessions. Any country in your top five where you have no customers is a candidate.
- 2. For that country, read duration — not engagement rate. Under a minute on desktop is a red flag.
- 3. Break the segment down by landing page. A flat spread across dozens of URLs, including legal pages and old redirects, is a crawl.
- 4. Check source/medium. 90%+ direct in one geography is not how humans arrive.
- 5. Break down by hostname. If localhost, 127.0.0.1 or a staging domain appears, your own team is in your data too — fix that with a GA4 internal-traffic filter today.
What to do about it — and what not to
Do not geo-block the country: real customers exist there, and crawlers rotate regions anyway. Some of this traffic is even useful — AI assistants crawling you is how you end up recommended in their answers (see our guide to tracking AI traffic in GA4). Instead: build a filtered reporting segment, judge growth on signups and revenue rather than sessions, and never present raw session counts to a client without this check — we learned that the hard way. The deeper fix is measuring outcomes, not visits: 1ClickReport reads your GA4 alongside your ad accounts and revenue, so the numbers you act on are conversions and spend, not inflated sessions.
Frequently asked questions
How do I know if my GA4 traffic is bots?
Check four signals together: a top country where you have no customers, average session duration under a minute on desktop, sessions spread thinly across many unrelated landing pages, and a direct/no-referrer share far above your site average. Any one alone is weak; all four together are conclusive.
Why does bot traffic show up as Singapore?
Singapore hosts major cloud datacenter regions. Crawlers, AI bots and monitoring services egress from those datacenters, and GA4 geolocates sessions by IP address — so automated traffic is recorded as Singaporean visitors. The same effect appears with other datacenter hubs like Virginia, Frankfurt and the Netherlands.
Why doesn't engagement rate catch bot traffic?
GA4 counts any session over ten seconds as engaged. Automated fetches routinely last 30 to 60 seconds, so bot segments can show engagement rates equal to or better than your human traffic. Use session duration and landing-page spread instead.
Should I block bot countries in my analytics?
No. Real customers exist in those countries and crawlers rotate regions, so a block loses real data without stopping the bots. Build a filtered reporting segment instead, and judge growth on signups and revenue rather than raw sessions.