In June 2026, Cloudflare’s CEO announced something that should have made every marketer stop and look at their analytics. Bots now account for 57.5% of all web traffic globally. For the first time, automated traffic outnumbers real human visits online. And that milestone arrived 18 months earlier than anyone predicted.
At DNM Digital, we had already been seeing this play out in client accounts. A spike in Direct traffic. Zero engagement. Sessions lasting zero seconds. All originating from overseas locations like Singapore and China.
If that sounds familiar, this post is for you.
What the Cloudflare Report Actually Found
The 57.5% figure comes from Cloudflare Radar, which tracks HTTP requests to HTML content across the websites it serves globally. Bots have officially crossed the halfway mark, and the force driving the surge is not the old-school search crawler. It is agentic AI: semi-autonomous programs that browse and retrieve pages on behalf of tools like ChatGPT and Gemini.
Human Security’s 2026 State of AI Traffic report found AI-driven traffic growing eight times faster than human traffic across 2025. The crossover was not a slow creep. It was a jump.
Now, one important nuance before you panic: the 57.5% figure measures HTTP requests, not GA4 sessions. An AI agent crawling a site fires rapid-fire page loads that inflate request counts. Your GA4 session count is not 57% bots. But it does contain bots, and depending on your site, the number could be significant enough to affect decisions you make every week.
The Overseas Traffic Pattern: What It Is and Why It Matters
One of the clearest signs of bot traffic in GA4 right now is a spike in Direct channel sessions from overseas with zero engagement. Zero seconds on site. Zero events. Zero conversions. Just sessions that appear and disappear.
This is not a coincidence. Singapore has become a primary hub for this activity because of its massive data centre density and its role as a global VPN exit node. Bots routing through Singapore infrastructure are essentially using it as a launchpad.
What makes this pattern particularly tricky is how it lands in GA4. Unlike bots that visit your actual site and show up in server logs, many of these send fake data hits directly to Google’s measurement servers using your GA4 Measurement ID. They never touch your website. They just inject sessions into your reports.
Google has confirmed the issue. It is widespread, it peaked in early 2026, and it is affecting accounts across every industry and country, including Australian businesses.
Why This Is a Marketing Problem, Not Just a Technical One
If you are making decisions based on your Direct channel traffic, bot sessions from overseas are quietly corrupting your data. Here is where it causes real damage:
- Inflated session counts: your total traffic looks higher than it is, which makes your conversion rate look lower than it actually is
- Distorted channel mix: Direct is getting credit for sessions that have nothing to do with brand recall or offline activity
- Skewed geographic data: overseas locations with no relevance to your business appear as top traffic sources in your reports.
- Polluted A/B test results: bot sessions entering your experiments dilute statistical significance and can produce false winners
If you are running ecommerce, the conversion rate distortion is the most dangerous. A lower-than-real conversion rate can trigger the wrong decisions: cutting ad spend, changing landing pages, or abandoning campaigns that are actually working fine.
How to Check If This Is Happening in Your Account
Open GA4 and go to Explore. Build a free-form report with the following dimensions: Country, Session default channel group, Average session duration, and Conversions. Filter for Direct traffic and look for sessions from other countries with zero or near-zero session duration and zero conversions.
If you see a significant volume there, you have ghost traffic in your account.
You can also check your real-time report during business hours. If you see users from Singapore active on your site while your Australian traffic is normal, and none of those Singapore sessions are converting or engaging, that confirms it.
Three Things to Do About It
1. Reset Your GA4 API Secret
Many ghost traffic bots send fake hits using your Measurement ID combined with your API Secret. Resetting the API Secret in your GA4 data stream settings changes the credential the bots are using, which cuts off ghost hits that never actually visited your site. Go to Admin, Data Streams, your web stream, then Measurement Protocol API secrets and rotate it.
2. Enable Bot Filtering in Cloudflare
If your site runs through Cloudflare, turn on Bot Fight Mode in the security settings. This identifies known data centre IPs, including Singapore-based ones, and challenges them before they reach your site or your analytics.
3. Use Segments for Clean Reporting
While you are cleaning up the source, use GA4 Exploration reports with a segment that excludes sessions from known bot geographies with zero engagement. This gives you a cleaner view of real performance without waiting for the underlying issue to be fully resolved. Your data and analytics setup should always have a clean segment ready for reporting, regardless of bot activity.
The Bigger Picture: AI Is Changing What Your Data Means
The ghost traffic issue is one symptom of a wider shift. As AI agents multiply and agentic traffic grows eight times faster than human traffic, the gap between what your analytics reports and what is actually happening on your site will keep widening.
Traditional analytics was built for humans clicking links in browsers. It was not built for AI crawlers, agentic bots, or ghost hits injected directly into measurement servers. The tools are catching up, but slowly.
This is why at DNM Digital we always anchor performance conversations in revenue, not traffic. Traffic numbers have always been imperfect. They are getting more imperfect every month. The brands that stay grounded in conversion rate, cost per acquisition, and customer lifetime value are the ones that make better decisions regardless of what the session count says.
If you want a clean read on what your analytics are actually telling you, we can help you build a measurement setup that filters the noise and focuses on what matters.
