If you’re a small business, the chances are you will have been hit by online Bots.
They may be generated from Lanzhou and Singapore, which Google says are bots registering on Google Analytics.
The recent spikes in traffic are probably inauthentic, non-human traffic (bots) that is bypassing the standard filtering systems.
These spikes are correlated with low-quality session metrics, specifically:
Extremely low engagement: Sessions with only initial events (session_start, page_view) and no further user interaction.
Anomalous data: Unusual concentrations of traffic from older device/OS profiles, or sudden spikes from unexpected countries/cities, often labeled as (not set).
Google is working to improve protection to ensure users receive the most accurate data.
The recommended immediate step is to create Segments in Explore reports. This action only affects how you view the data and ensures no valid traffic is excluded.
Identify the spam pattern: Use the explore section and post-processed dimensions (like geographic info) to find the “fingerprint” of the spam. Look for patterns such as:
High traffic from a specific country/city paired with extremely low engagement (e.g., Session Duration < 10 seconds) and unusual concentrations of specific technical profiles or violations of event logic.
Create an exclusion segment: Build a user or session segment in the explore builder with the necessary conditions (e.g., exclude sessions where country = ‘Singapore’ and session duration < 10).
Apply to reports: Apply this exclusion segment to any exploration report you use for analysis to immediately view your clean data.
A long-term spam detection fix is in development.