For a brief moment in October, Alejandro Quintero thought he had made it big in China. The Bogotá-based data analyst owns and manages a website that publishes articles about paranormal activities, like ghosts and aliens. The content is written in “Spanglish,” he says, and was never intended for an Asian audience. But last fall, Quintero’s site suddenly began receiving a large volume of visits from China and Singapore. The amount of traffic coming from the two countries was so high and consistent that it now accounts for more than half of total visits to Quintero’s site over the past 12 months.
When he first noticed the traffic spike, Quintero thought he’d found an audience on the other side of the world. “I need to travel to China right now because I’m the bomb there,” Quintero says he recalls thinking. But as soon as he dug into the data, he knew something was wrong. Google Analytics, a common tool used by website owners to parse web traffic, shows that all the Chinese visitors are from one specific city: Lanzhou. They are unlikely to be real humans, because they stay on the page for an average of 0 seconds and don’t scroll or click. Quintero quickly realized his website was actually being bombarded by bots.
Quintero later found out from social media that he was far from the only website operator who started seeing a large influx of bots from China and Singapore beginning in September. A lifestyle magazine based in India, a blog about a small island off the coast of Canada, the owners of several personal portfolio websites, a weather forecast platform with over 15 million pages, ecommerce shops hosted by Shopify, and even domains run by the US government have all reported being hit by what appear to be the same bots. And they were easy to spot because the bots significantly skewed each website’s usual analytics patterns. In the last 90 days, 14.7 percent of visits to US government websites came from Lanzhou and 6.6 percent came from Singapore, making them the top two cities in the world supposedly hungry for information from the American government, according to Analytics.usa.gov.
While their IP addresses can be traced to China and Singapore, there’s little information about who’s actually behind this massive amount of automated visits. Website owners who are being targeted have largely concluded that the bots don’t pose any immediate harm. Given that AI-related bot activity surged across the internet last year, many believe the traffic could be connected to companies harvesting web data for training models.
Where Is Lanzhou, Anyway?
When website owners saw the sudden uptick of visits from China, many of them started asking, where is Lanzhou? The second-tier city in China’s northwest is known for its heavy manufacturing industries and historical legacy as a Silk Road trading hub. But it’s neither a tech hub nor home to significant numbers of data centers. So why is so much traffic coming from the city?
Lanzhou might not be the actual source of the bots, says Gavin King, founder of Known Agents, which analyzes automated online traffic. King’s own company website has also been targeted by bots from China and Singapore. When he looked deeper into the specific details of the visits, the only thing he could say for certain was that all of the traffic was eventually being routed through Singapore. Google Analytics determined the visits originated from Lanzhou, but King says that could just be an educated guess instead of a precise location.
But the most concrete detail King found is that the traffic is being routed through servers belonging to several major Chinese cloud companies. King says the bot traffic his website received all came through the Autonomous System Number (ASN) 132203, a unique identifier in the internet’s routing system assigned to an internet service provider operated by the Chinese company Tencent. Andy, the manager of a large weather forecasting website group, says he detected bot traffic coming from ASNs associated with Tencent, Alibaba, and Huawei. (He asked only to use his first to protect his privacy.) All three companies are major cloud providers, and it’s unclear whether the bots are coming from in-house or clients using their servers.
Many people suspect that these bots are part of an AI company’s effort to collect training data from web pages. In 2025, AI bots accounted for a significant portion of overall web traffic, which crawl the internet for text and other information to feed to data-hungry large language models.
But there are some key differences between these Chinese bots and other AI bots. First, there’s simply way more of them. King says on his website that the traffic from China and Singapore accounts for 22 percent of overall traffic, while all other AI bots account for less than 10 percent combined.
Most leading AI companies clearly identify their bots to website operators, which also makes them easier to block. The frontier AI labs are “not as interested in evading” bot-blocking rules, says Brent Maynard, senior director of security technology and strategy at the internet infrastructure company Akamai. He says AI companies usually only start trying to disguise their bots after a website shuts the front door. This wave of Chinese bots, however, disguised themselves as normal human users from the start, and they have even bypassed common bot-blocking rules, several website owners told WIRED.
Beyond AI companies, there are other businesses incentivized to scrape the internet, including search crawlers and intelligence-gathering companies.
Rising Costs and Distorted Data
The good news, at least for now, is that the bots don’t seem to have an explicitly malicious purpose. They haven’t been publicly connected to any cyberattack and don’t seem to be scanning for vulnerabilities. But the lack of a clear motive also adds to the confusion.
Some website owners are worried that the bots are scanning copyrighted material without permission. Others say the surge has forced them to pay more for bandwidth, as bot traffic crowds out human users, or to invest in more sophisticated prevention tools. The visits also skew traffic analytics, distorting reports about who is actually visiting their sites.
But the biggest impacts are felt by people who earn revenue from attracting ad clicks on their websites. “This is destroying my AdSense strategies,” says Quintero, the paranormal blog owner, “because they are saying [your website is] only visited by bots, so your content is not something that is valuable to the viewer.” As a result, websites like his may be seen as less desirable to advertisers and penalized by Google.
Makeshift Solutions
Many people have complained about the China AI bot problem in online support channels over the past few months, or sent messages about it directly to their web-hosting providers. But so far, there are still few concrete answers.
Contacted by WIRED, WordPress acknowledged that it has seen reports in recent months that some of its sites are experiencing increased traffic from suspected AI bots or scrapers. “WordPress websites have always had a great structure that makes them easy to find and be indexed by search engines. Those same capabilities make them easily crawled [by] AI as well,” the company said in an unsigned email. Google, Cloudflare, and Squarespace did not respond to requests for comment.
Some website operators are now taking matters into their own hands. On social platforms like Reddit, victims of the bots have swapped makeshift strategies for identifying and blocking them. Over time, they learned that these bots often present themselves as using old versions of Windows operating systems and uncommon screen aspect ratios, characteristics that allow website operators to block them as a group. If the websites don’t care about traffic from China or Singapore at all, some also elect to prevent anyone with an IP address located in those countries from accessing their sites.
Andy, the weather website manager, says he ended up blocking four ASNs associated with Tencent, Alibaba, and Huawei. That was enough to reduce the number of bots significantly but not completely eliminate them, he says. The number of daily visits from the Chinese bots to his site have gone from 127,000 at their peak down to just above 2,000 the day he spoke to WIRED.
As autonomous AI tools proliferate across the internet, figuring out how to combat them will likely become a more common headache for website owners. “This is the cost of being on the internet to some degree,” says Akamai’s Maynard, “You’re open, and you’re in public view.”
This is an edition of Zeyi Yang and Louise Matsakis’ Made in China newsletter. Read previous newsletters here.
The post A Wave of Unexplained Bot Traffic Is Sweeping the Web appeared first on Wired.
