If your statistics suddenly show lots of website traffic from China or Singapore, most of it is probably bots running on cloud servers, not new customers. They load one page, do nothing, and leave, and they make your visitor numbers, bounce rate and country reports wrong.

The short answer

• Most of this traffic comes from data centres: rented cloud servers. On my site, the Singapore visits were all Tencent Cloud.
• The bots pretend to be an ordinary desktop Chrome browser, so the usual bot lists don’t catch them.
• Each one loads a single page with no scrolling, no clicks and no time on the page.
• It rarely harms your site, but it makes your visitor numbers, bounce rate and country reports wrong.
• You can flag or remove these visits by network, without blocking China or Singapore as countries.

🔍 What it looks like in real figures

These figures are from royaltyfreemusichub.com, a music site I run, over the 30 days to 4 November 2026. It sells nothing in Asia and has no Chinese or Singaporean audience.

Singapore was the top country, even though it was left out of the statistics until 28 October. Almost every Singapore visitor looked at exactly one page. Visitors from the UK looked at more than two.

The Singapore visits also arrive in runs. On 7 October, for example, they came one a minute from 06:15 to 06:26 and again from 08:18 to 08:38. Each one had a brand-new visitor ID, so to a statistics plugin every visit looked like a new person.

☁️ Why China and Singapore?

The visits don’t come from homes or offices. They come from servers that anyone can rent by the hour.

I checked the IP addresses behind the Singapore visits against RIPEstat, the public register of who owns which internet addresses. They sat in the ranges 43.163.x.x to 43.173.x.x and 119.28.x.x, and every one belongs to network AS132203: Tencent Cloud. The addresses look up as Singapore because that’s where Tencent runs those servers. Alibaba Cloud and Huawei Cloud have large data centres in Singapore too.

A visit from a cloud server isn’t automatically a bot, because some VPNs and work networks route through data centres too. But a real person reading your page on a phone or laptop normally comes from a home broadband or mobile network.

Bots now make up the majority of web traffic, according to Imperva’s 2026 Bad Bot Report. Nothing in your statistics tells you why these ones come. Scraping page content, checking prices or search positions, and scanning for weak spots are all common. Your site doesn’t have to be a target. These tools work through long lists of sites.

🧪 How to tell real visitors from bots

Look at the country in your visitor list or sessions report, then check these six signs:

1. One page per visitor. Pages per visitor is exactly 1.0, or very close.
2. No time on the page. Engaged time is zero or a second or two.
3. No scrolling or clicks. Nothing is recorded after the page loads.
4. Direct traffic. No referrer: they didn’t arrive from Google, a link or social media.
5. Runs of visits. Many new visitors within minutes of each other, often the same device and browser.
6. A data-centre network. The visit comes from a cloud or hosting company, not a broadband or mobile provider.

One sign on its own proves nothing. A real person can open your page in a background tab and never look at it, check one fact and leave, or tap a link by mistake. All of those show as one page with no engaged time, but when five or six signs line up across hundreds of visits from one country, you’re looking at bots.

📊 What Google Analytics already does

Google Analytics 4 removes known bots automatically. Google says it uses its own research plus the bots and spiders list kept by the Interactive Advertising Bureau. You can’t switch the filter off, and you can’t see how much traffic it removed.

A known-bot list works from how a bot names itself. Bots that present themselves as an ordinary Chrome browser don’t give that away. Google doesn’t say whether it catches those as well, so if GA4 shows a burst of one-page visits from Singapore, you have no way to check what it filtered.

🛠️ What to do about it

1. Flag visits from data-centre networks

GreenOrb Statistics, the WordPress analytics plugin I make, checks each visit’s network against a list of cloud and hosting companies. That includes Tencent Cloud, Alibaba Cloud, Huawei Cloud, Amazon Web Services, Google Cloud, Microsoft Azure, DigitalOcean, OVH and Hetzner, among others. It’s in the free version from 1.0.7.

You switch it on under Settings → Bot Filtering → Data-centre networks, then download the network database. The setup wizard offers it too. The database comes from DB-IP and is looked up on your own server; no visitor details are sent anywhere.

You choose what happens to a matching visit:

• Flag (the default): the visit is counted but marked “Data-centre network”, so you can review it.
• Exclude: the visit isn’t counted. The Bot Filtering report lists it under traffic left out by your own settings.

Flag is the safer start, because someone on a VPN can exit from a data centre. Apple iCloud Private Relay and Cloudflare WARP are never treated as data centres.

On royaltyfreemusichub.com, 328 visitors were flagged in the 30 days to 4 November, every one for “Data-centre network”. Of the 100 newest, 96 were from Singapore, 3 from Malaysia and 1 from Hong Kong, and each had one session and one page view.

Open a flagged visitor and the profile says why it was flagged.

2. Clear out the ones already recorded

Once you’re happy with what was flagged, the Delete all data-centre visitors button on the Bot Filtering report removes them, up to 500 per click. Their visits and sessions are deleted, and the daily totals for those days are recalculated, so your past reports drop the bots as well. This can’t be undone, so look through the list first.

3. See only the visits where something happened

Some bots run on ordinary home or mobile networks, and no network list will catch them. When I checked royaltyfreemusichub.com on 31 October, only 4 of the 133 China visitors that month had been flagged. The rest came from networks the data-centre list doesn’t cover.

For those, choose the Engaged filter on the Sessions report. It lists sessions with 2 or more pages, 15 seconds or more on the page, or a scroll half way down. The Overview cards show the same split. On 4 November the card read “114 visitors · 114 sessions, 8 engaged”. The Engaged filter isn’t a bot list: it hides real people who left quickly too. It shows you the visits where someone actually did something.

The daily bot scan also looks for waves: 5 or more brand-new visitors from the same country, device and browser, arriving within an hour of each other, each viewing one page and doing nothing else. It flags them as “Bot wave”. A group that includes real readers who scroll, click or stay isn’t flagged, so a post going viral doesn’t set it off.

4. Leave out a whole country

If you have no visitors at all from a country, GreenOrb Statistics Pro can leave it out of your statistics. On royaltyfreemusichub.com, Singapore was excluded until 28 October, and 700 visits were left out in the last 30 days. It’s a blunt tool, and it only works from the day you switch it on. If you ever sell to that country, use the data-centre check instead.

5. Block them before they reach the site

Everything above changes what your statistics count. The bots still load your pages. If they’re slowing the site down, ask your host whether they can block or challenge traffic from cloud networks before it reaches WordPress.

⚠️ What this won’t catch

The data-centre check only knows about networks on its list, and you can add more. Bots on home broadband, mobile networks or networks not on the list get through, as the China figures above show. Wave detection only catches visits that arrive in clusters. On royaltyfreemusichub.com, the remaining bots trickle in one or two an hour, so the waves rule hadn’t flagged any by 4 November.

There’s more on how the plugin’s bot checks fit together in Bot detection explained, and on why its numbers can look lower than other tools in Why your numbers may look lower than other plugins. For bot traffic in general, see How Much of Your WordPress Traffic Is Actually Bots?

Try it on your own site

Data-centre detection, wave detection and the delete button are in the free version of GreenOrb Statistics. Install it, switch on Data-centre networks in Flag mode, and check the Bot Filtering report after a few days.

If you’ve found a pattern of bot traffic that this doesn’t catch, tell me in the comments.

FAQ

Sources

• Google Analytics Help: Known bot-traffic exclusion
• RIPEstat: network lookup for 43.163.22.227, 43.173.182.254 and 119.28.64.124 (all AS132203, Tencent), checked 4 November 2026
• DB-IP IP to ASN Lite (CC BY 4.0)
• Imperva 2026 Bad Bot Report: bots now make up the majority of global web traffic (full-year 2025 data)

Screenshots are from royaltyfreemusichub.com running GreenOrb Statistics 1.0.7. No figure has been edited.