What's with all that traffic from Singapore?

Open your analytics dashboard on a quiet Tuesday and the numbers can look fine — until a map or geo report lights up with sessions from places you don’t sell into. Singapore is a common one. Sometimes it’s a CDN edge or a VPN. Often it’s bots: scrapers, uptime monitors, ad fraud, and AI crawlers reading your pages so models and answer engines can cite (or train on) your content.

That pattern isn’t new — Cloudflare’s 2022 Radar year-in-review already flagged Singapore among locations where bots made up roughly 60–70% of traffic, driven by cloud regions that are cheap to spin up and tear down. What’s changed is the scale. For years, Cloudflare put bot share of global HTTP or application traffic around ~30%. In 2026 their own reporting flipped the story: more than half of Internet traffic wasn’t human, and Radar’s bot-vs-human split for HTML content put bots near 57.5%. AI-agent requests on their network grew more than 1,700% year over year. Non-human traffic isn’t a side channel anymore — it’s exploding.

Source: Cloudflare Radar & Blog.

For marketers, that isn’t a niche ops problem. Geo spikes and dashboard noise matter more when machines already dominate the request stream — they change what “traffic,” “engagement,” and even “visibility” mean.

The good: bots that work for you

Not all non-human traffic is waste.

Search and discovery. Legitimate crawlers (Googlebot and peers) are how you get indexed. Block them badly and organic demand collapses. AI answer systems also crawl or fetch pages so your brand can show up in summaries and citations — a new layer of discoverability even when the user never lands on your site.

Monitoring and reliability. Synthetic checks, SEO crawlers you hired, and uptime bots catch broken pages before customers do. That traffic is intentional and useful.

Competitive and market intelligence. Your own research tools crawl the open web too. The ecosystem depends on machines reading pages at scale.

Used well, bot traffic is infrastructure for reach and quality — not vanity volume.

The bad: noise, cost, and fake signal

The downside shows up in three places marketers care about.

Inflated or distorted dashboards. Click fraud and referrer spam can pad sessions and junk referral reports. Mystery geo spikes (Singapore included) can look like “international interest” when they’re mostly machines. Some bots run enough JavaScript to look like short, empty sessions; others never fire analytics tags at all. Either way, you can over-credit channels that didn’t drive people — or under-credit work that did.

Server and CDN load. Training and retrieval crawlers (GPTBot, ClaudeBot, PerplexityBot, and others) can hammer public pages. Your hosting bill rises while GA4 stays quiet, because most of those crawlers never run your tracking script. Ops feels the bot; marketing doesn’t see it. Cloudflare also reports that AI training has become a much larger share of crawler purpose — from about 22% of crawler requests in spring 2025 to 52% by June 2026 — which is one reason those silent hits keep climbing.

Broken attribution for AI-assisted visits. When someone clicks from ChatGPT, Perplexity, or similar into your site, referrers are often missing or incomplete. A lot of that high-intent traffic lands in Direct. Content and SEO that earned the AI mention get zero credit, so budget and roadmap decisions skew toward whatever still looks “attributable.”

Zero-click AI answers add another wrinkle: you may shape the answer without getting a session at all.

What it means for web metrics

Classic funnels assumed: request ≈ person ≈ session ≈ measurable journey. That chain is breaking apart.

• Server / CDN logs — People and crawlers (volume, paths, user-agents)
• GA4 / client analytics — Mostly people who run JS (plus some bots that slip through)
• Search / AI visibility — Mentions, citations, and crawls that may never become sessions

So “sessions up” no longer equals “audience up.” Conversion rate can look worse if bots or synthetic agents inflate views without converting. Engagement time can swing either way depending on how agents fetch pages. And “Direct” is no longer a clean leftover bucket — it’s where dark AI referral often hides.

Marketers need two scorecards, not one:

1. Human performance — qualified sessions, engagement, conversion, revenue (bot-filtered, consent-aware).
2. Machine visibility — which crawlers hit which URLs, how often AI systems surface you, and whether that lines up with branded search or assisted conversions later.

Practical tips for marketing teams

• Reconcile GA4 with logs or CDN analytics monthly. Gaps usually mean crawlers (and setup issues) your dashboard never shows. Odd geos without revenue or scroll depth deserve a second look before you celebrate “new markets.”
• Don’t treat “block all bots” as the default. Protect capacity and block abusive scrapers, but keep indexed discovery and useful AI visibility in mind.
• Segment AI-referred human traffic where referrers exist; treat unexplained Direct growth as a hypothesis, not pure brand demand.
• Judge campaigns on outcomes people complete (leads, pipeline, revenue), not raw pageviews in a bot-heavy world.
• Publish crawlable, substantive pages if you want to be cited — critical content that only loads via JavaScript is invisible to many crawlers and to the AIs that read like them.

The bottom line

Bot traffic isn’t simply “fake traffic to delete.” Some of it is how you get found. Some of it is a tax on your stack. Some of it is people arriving through AI with broken attribution. The next time Singapore (or another hub) dominates a report, ask whether you’re looking at demand — or at machines doing their job. Marketers who stay ahead stop asking only “How much traffic did we get?” and start asking “How much of that was real demand — and how visible are we to the machines that shape discovery?”

That’s the metric shift. Everything else is cleanup.