A mysterious wave of automated web traffic, primarily originating from Lanzhou, China, is flooding websites globally, leaving operators baffled and scrambling for solutions. Beginning in September, a surge of bot activity has been reported by site owners across diverse sectors – from paranormal blogs to US government domains – skewing analytics, inflating bandwidth costs, and potentially harming advertising revenue.
The Ghostly Visitors From Lanzhou
Alejandro Quintero, a data analyst running a paranormal-themed website, first noticed the anomaly in October. His site saw a sudden spike in traffic from China and Singapore, now accounting for over half of his total visits. The visitors, all seemingly localized to Lanzhou, exhibited unnatural behavior: zero dwell time, no scrolling, no clicks. This confirmed his suspicion – the traffic wasn’t human.
Others quickly echoed Quintero’s experience. A lifestyle magazine in India, a Canadian island blog, personal portfolio sites, a weather platform with millions of pages, and even US government domains were hit by the same pattern. Analytics from Analytics.usa.gov show that, in the last 90 days, Lanzhou and Singapore became the top two cities supposedly consuming American government information, accounting for 14.7% and 6.6% of visits, respectively.
Who’s Behind the Flood?
While the traffic originates from Chinese and Singaporean IP addresses, identifying the actors remains elusive. The bots haven’t been linked to cyberattacks or vulnerability scans, but their sheer volume is causing disruption. The most plausible explanation is AI data harvesting: companies scraping the web to train large language models.
However, these bots differ from typical AI crawlers. They are far more numerous – accounting for 22% of traffic on some sites, compared to less than 10% for all other AI bots combined – and they actively disguise themselves, bypassing common bot-detection mechanisms. Unlike established AI labs that often identify their bots, these actors appear determined to evade blocking.
Gavin King, founder of Known Agents, traced the traffic through servers belonging to major Chinese cloud providers, including Tencent (ASN 132203), Alibaba, and Huawei. Whether the bots originate from in-house operations or clients using these servers remains unclear.
The Costs Are Real
The bots don’t appear malicious, but their impact is significant. Website owners worry about copyright violations, increased bandwidth costs, and skewed analytics. For those reliant on ad revenue, the bot traffic can penalize their earnings, as platforms like Google AdSense may devalue sites flooded with artificial engagement.
“This is destroying my AdSense strategies,” says Quintero. “They are saying [your website is] only visited by bots, so your content is not something that is valuable to the viewer.”
Makeshift Solutions and an Uncertain Future
With no immediate fix in sight, website operators are resorting to ad-hoc measures. Blocking Chinese and Singaporean IPs, filtering out old Windows versions, and identifying unusual screen resolutions are among the makeshift strategies being shared online. Some have blocked entire ASNs associated with major cloud providers.
While effective to a degree, these solutions are temporary. As autonomous AI tools become more prevalent, website owners will likely face escalating challenges in distinguishing legitimate traffic from automated scraping. The cost of maintaining an online presence, in other words, is rising, and the distinction between human and machine activity is blurring.
The proliferation of AI-driven scraping underscores a fundamental truth of the modern internet: openness comes at a price. The web is public, and as Akamai’s Brent Maynard puts it, “You’re open, and you’re in public view.”
