Chinese Bot Traffic Surge: Mysterious Web Visits from Lanzhou Puzzle Website Owners

Website owners worldwide have been experiencing a mysterious surge in bot traffic originating from Lanzhou, China, and Singapore since October 2023. These automated visits have skewed analytics, increased costs, and created confusion about their purpose and origin.

The Mysterious Bot Invasion

Alejandro Quintero, who runs a paranormal content website, was among the first to notice the strange traffic pattern when more than half of his site’s visitors suddenly appeared to be coming from China and Singapore. Similar reports emerged from diverse websites including Indian lifestyle magazines, personal blogs, e-commerce shops, and even U.S. government domains.

The bot traffic is easily identifiable by several distinctive characteristics: visitors appear to come predominantly from Lanzhou, China; they spend zero seconds on pages; they don’t scroll or click; and they significantly distort normal traffic patterns. On U.S. government websites, Lanzhou and Singapore have become the top two visiting locations globally, accounting for 14.7% and 6.6% of visits respectively.

Technical Investigation

Technical analysis reveals these bots are being routed through servers belonging to major Chinese cloud companies including Tencent, Alibaba, and Huawei. While the traffic appears to originate from Lanzhou, experts suggest this might be an approximation rather than the actual source.

Unlike legitimate AI crawlers from major companies that typically identify themselves clearly, these bots disguise themselves as regular users and bypass common blocking methods. This behavior differentiates them from standard AI data collection operations.

Impact on Website Owners

While the bots don’t appear to have malicious intent such as cyberattacks or vulnerability scanning, they create several problems for website owners:

• Increased bandwidth costs as bot traffic crowds out legitimate users
• Distorted analytics that misrepresent actual audience demographics
• Reduced ad revenue as platforms like Google AdSense may devalue sites with high bot traffic
• Concerns about unauthorized scanning of copyrighted material

Makeshift Solutions

In the absence of official solutions from hosting platforms, website owners have developed their own countermeasures:

• Blocking traffic from specific Autonomous System Numbers (ASNs) associated with Chinese cloud providers
• Identifying and filtering out visitors with unusual characteristics like old Windows versions and uncommon screen aspect ratios
• Restricting all traffic from China and Singapore for sites that don’t need visitors from those regions

One weather website manager reported reducing daily bot visits from 127,000 to just over 2,000 by implementing these measures.

The Bigger Picture

This wave of bot traffic highlights a growing challenge for website operators in an era of proliferating AI tools. As Brent Maynard from Akamai notes, “This is the cost of being on the internet to some degree. You’re open, and you’re in public view.” The situation underscores the increasing complexity of managing online spaces as autonomous AI tools become more prevalent.