We are currently facing a huge attack: a large set a bots (with IP addresses located mainly in the US , Brazil, Columbia, ...) are opening connection to our server without getting the content of the pages.

These geographical origins are not believable for our site, since we are a French Forum with mostly all users located in France.

Many of these connections are counted by IPS as "visitors". Indeed, all our counter are becoming completely wrong and does not represent anymore the real usage of our Forum.

However, this is not really a problem, since we are on the Invision Cloud solution, which has all the needed protections to maintain our Forum 100% up and responsive.

Our problem lies on the GoogleAd side, which gives us a significant part of our revenues (we push Ads to our guest and free user).

The current attack makes the GoogleAd system become crazy: when a bot gets the page, the GoogleAd code is pushed to the bot, but no revenue is generated by Google, since the bot does not behave in the expected way.

As a consequence our Ad revenue have dramatically dropped and we have been tagged by Google as an untrusted site.

Regarding this problem, I have 2 questions:

• is someone else facing the same problem?

• as we are hosted on a Cloud instance managed by Invision, we have no access to the incoming network filtering configuration.
  Is there a way to make a configuration at IPS Admin level that would reject all the ill traffic or make the GoogleAd script resistant to this kind of attack?

Edited September 4Sep 4 by bernhara

seeing the same.

https://invisioncommunity.com/forums/topic/485027-chinese-traffic/#comment-3026511

Edited September 5Sep 5 by John Horton

On 9/4/2026 at 8:39 PM, bernhara said:

We are currently facing a huge attack: a large set a bots (with IP addresses located mainly in the US , Brazil, Columbia, ...) are opening connection to our server without getting the content of the pages.

These geographical origins are not believable for our site, since we are a French Forum with mostly all users located in France.

Many of these connections are counted by IPS as "visitors". Indeed, all our counter are becoming completely wrong and does not represent anymore the real usage of our Forum.

However, this is not really a problem, since we are on the Invision Cloud solution, which has all the needed protections to maintain our Forum 100% up and responsive.

Our problem lies on the GoogleAd side, which gives us a significant part of our revenues (we push Ads to our guest and free user).

The current attack makes the GoogleAd system become crazy: when a bot gets the page, the GoogleAd code is pushed to the bot, but no revenue is generated by Google, since the bot does not behave in the expected way.

As a consequence our Ad revenue have dramatically dropped and we have been tagged by Google as an untrusted site.

Regarding this problem, I have 2 questions:

• is someone else facing the same problem?

• as we are hosted on a Cloud instance managed by Invision, we have no access to the incoming network filtering configuration.
  Is there a way to make a configuration at IPS Admin level that would reject all the ill traffic or make the GoogleAd script resistant to this kind of attack?

Do you have further information from google on what has been provided to you to state your Adsense is being penalised because of bots hitting your site? If so, please feel free to open a ticket with that information (or respond to the one you already have set up).

Besides screwing up my metrics should I care??

8 hours ago, BarneyLongden said:

Besides screwing up my metrics should I care??

Honestly, probably not no

On 9/6/2026 at 10:04 PM, Marc said:

Do you have further information from google on what has been provided to you to state your Adsense is being penalised because of bots hitting your site

Not exactly.

The only thing we saw is that the daily revenues have dropped to almost zero. Before the situation became critical, we removed the AdSense code from our site, waiting for the end of the storm.

And as expected, the bots probably understood that we are of no use to them. So, they stopped the attack and everything is OK again.

Maybe CloudFlare helped to stop the attack. However, since we have no visibility on the CloudFlare activity, I can only speculate.

Cloudflare would indeed automatically stop any attack like that. I cant honestly see how it would affect your Adsense there

On 06/09/2026 at 22:04, Marc said:

Avez-vous reçu des informations complémentaires de Google concernant la pénalité infligée à votre compte AdSense en raison de visites de robots sur votre site ? Si oui, n'hésitez pas à ouvrir un ticket d'assistance en y incluant ces informations (ou à répondre à celui que vous avez déjà ouvert).

Abnormal bot traffic is back and severely impacting AdSense monetization

The situation had returned to a relatively normal level over the last few days, and AdSense monetization was starting to recover. Yesterday, September 8,

Unfortunately, since yesterday evening, the abnormal traffic appears to have started again very aggressively.

Google Analytics recorded approximately 71,000 page views yesterday, compared with around 40,000 page views on a normal day. This represents an abnormal increase of more than 30,000 page views in a single day.

Today the consequences on AdSense are immediate and severe. At 12:47 PM, despite already recording approximately 19,800 page views, with the page RPM collapsing to €0.53. Yesterday the RPM was around €1.51.

Google Analytics real-time data again shows a very unusual geographical distribution of traffic, with large volumes coming from countries that normally represent very little legitimate traffic for our French Citroën community, particularly:

United States, Colombia, Ecuador, Venezuela, Vietnam and several other non-European countries visible in the attached Analytics screenshot.

This is consistent with the abnormal traffic pattern I previously reported: very large volumes of apparently automated traffic generating page views without corresponding normal user behaviour.

At this point, this is no longer just an analytics issue. It is directly and severely affecting our advertising monetization and therefore the financial sustainability of the website. Planète-Citroën relies heavily on advertising revenue to cover its operating costs, and repeated waves of this traffic are causing AdSense monetization to collapse.

I therefore urgently ask Invision to intervene at the Cloud/WAF level.

Could you please:

immediately investigate the current traffic and identify the IP ranges, ASNs, User-Agents or other common characteristics responsible for these requests;

apply appropriate WAF / Managed Challenge protection against this automated traffic;

and, if necessary as an immediate protective measure, block or challenge traffic from the countries currently generating these abnormal volumes, particularly the countries mentioned above.

I understand that country-wide blocking is a strong measure, but given the repeated attacks and the direct financial impact on the site, I would prefer temporarily losing the very small amount of legitimate traffic from these countries rather than continuing to expose the site and our AdSense account to massive automated traffic.

This is now urgent. The abnormal traffic has returned, AdSense monetization is collapsing again, and the financial sustainability of the site is being affected.

Could you please investigate this as soon as possible and let me know what immediate protection can be implemented on the Invision Cloud infrastructure?

Thank you in advance for your prompt assistance.

Best regards,

Nicolas

Administrator – Planète-Citroën

Edited September 9Sep 9 by NicolasPC

23 minutes ago, NicolasPC said:

Today the consequences on AdSense are immediate and severe. At 12:47 PM, despite already recording approximately 19,800 page views, with the page RPM collapsing to €0.53. Yesterday the RPM was around €1.51.

This is the rate per million views. So if you have more views, of course that rate is less, but there are more views

For any infrastructure specific issues, please feel free to open a ticket

Thank you Marc.

I understand how RPM is calculated, but unfortunately this is not the issue I am trying to report.

The problem is the massive amount of abnormal traffic currently reaching the community. GA4 is showing approximately 16,000 Direct sessions today, with thousands of users coming from countries that normally represent only a very small part of our French community.

For example, today GA4 reports approximately 4,850 users from the United States, 1,670 from Brazil, 1,590 from Colombia and 890 from Ecuador. Most importantly, the average engagement time for several of these countries is 0 seconds, while France is at approximately 1 minute 17 seconds. GA4 itself is flagging this traffic increase as an anomaly.

This happened previously at the beginning of September, then the traffic returned closer to normal and AdSense monetization recovered at the same time. Since last night, the abnormal traffic has returned, and AdSense monetization has immediately collapsed again.

So my concern is not the RPM calculation itself, but whether Invision Cloud can identify and mitigate this automated/abnormal traffic at infrastructure/WAF level before it reaches the community and the advertising system.

I will open a ticket as you suggest and provide the GA4 screenshots. This is now quite urgent for us because advertising revenue finances a significant part of the community's operating costs.

Thank you for your help.

I actually already opened a support ticket about this infrastructure/traffic issue last week, including details about the abnormal traffic and a request to investigate possible bot activity and WAF protection.

Unfortunately, I still have not received a response to that ticket, and the situation has now become urgent. The abnormal traffic returned last night and is once again severely affecting our AdSensemonetization.

Today GA4 is showing thousands of abnormal visitors from the United States, Brazil, Colombia, Ecuador and other countries, mostly through Direct traffic, with 0-second engagement for several of them.

Could you please help escalate my existing ticket to the Cloud/infrastructure team, rather than having me open another one?The financial impact on our community is now significant, so I would really appreciate if someone could investigate this as soon as possible.

Thank you.

35 minutes ago, NicolasPC said:

I actually already opened a support ticket about this infrastructure/traffic issue last week, including details about the abnormal traffic and a request to investigate possible bot activity and WAF protection.

Unfortunately, I still have not received a response to that ticket, and the situation has now become urgent. The abnormal traffic returned last night and is once again severely affecting our AdSensemonetization.

Today GA4 is showing thousands of abnormal visitors from the United States, Brazil, Colombia, Ecuador and other countries, mostly through Direct traffic, with 0-second engagement for several of them.

Could you please help escalate my existing ticket to the Cloud/infrastructure team, rather than having me open another one?The financial impact on our community is now significant, so I would really appreciate if someone could investigate this as soon as possible.

Thank you.

Your ticket has been escalated to be looked into.

43 minutes ago, NicolasPC said:

Thank you Marc.

I understand how RPM is calculated, but unfortunately this is not the issue I am trying to report.

The problem is the massive amount of abnormal traffic currently reaching the community. GA4 is showing approximately 16,000 Direct sessions today, with thousands of users coming from countries that normally represent only a very small part of our French community.

For example, today GA4 reports approximately 4,850 users from the United States, 1,670 from Brazil, 1,590 from Colombia and 890 from Ecuador. Most importantly, the average engagement time for several of these countries is 0 seconds, while France is at approximately 1 minute 17 seconds. GA4 itself is flagging this traffic increase as an anomaly.

This happened previously at the beginning of September, then the traffic returned closer to normal and AdSense monetization recovered at the same time. Since last night, the abnormal traffic has returned, and AdSense monetization has immediately collapsed again.

So my concern is not the RPM calculation itself, but whether Invision Cloud can identify and mitigate this automated/abnormal traffic at infrastructure/WAF level before it reaches the community and the advertising system.

I will open a ticket as you suggest and provide the GA4 screenshots. This is now quite urgent for us because advertising revenue finances a significant part of the community's operating costs.

Thank you for your help.

We completely understand the frustration here, and we do get it. Please be assured that we can, and do, act on abnormal traffic. After all, this traffic also impacts our network, so it’s certainly not in our interest to ignore it. The challenge is that this kind of activity is becoming increasingly common across the internet. New actors and traffic patterns appear constantly, and it can sometimes take a little time for these to be identified and automatically blocked by our network.

So while we absolutely understand why you’re raising it, this isn’t something specific to your site or to our network. It’s an internet-wide problem that providers everywhere are having to continually adapt to.

Thank you Marc, I appreciate you escalating the existing ticket.

I completely understand that this is a wider Internet issue and not something specific to Invision. My main concern is simply whether the Cloud/infrastructure team can identify this particular traffic pattern and mitigate it before it reaches the community, as its impact on our AdSense monetization is immediate and severe.

I will now wait for the advanced team to investigate the ticket and I will avoid making further changes on my side in the meantime.

Thank you again for your help.

I wish you luck working with support if this involves IC infrastructure. Be prepared for zero response, rude response, and them to say they can do anything to help you as you’re only a “consumer” vs enterprise customer.

I know this from recent experience. Didn’t leave me feeling positive about the company after many years.

8 hours ago, Chris027 said:

I wish you luck working with support if this involves IC infrastructure. Be prepared for zero response, rude response, and them to say they can do anything to help you as you’re only a “consumer” vs enterprise customer.

I know this from recent experience. Didn’t leave me feeling positive about the company after many years.

Sorry to hear you believe responses to you were rude, Chris. Im sure that was not our intention. Reading your tickets there, Im not seeing anything I would see as being rude to yourself.

Hi Marc,

I’m following up as it has now been 7 days since the ticket was escalated to the advanced/Cloud infrastructure team, and I still haven’t received any update.The abnormal traffic is still clearly visible in GA4, with the same unusual geographical patterns and very high numbers of guest requests.

Our AdSense monetization has returned to normal, but this is because we have blocked guests from accessing pages where ads are displayed. This prevents the abnormal traffic from generating ad impressions, but unfortunately it also affects legitimate guest visitors.

This is therefore only a workaround, not a satisfactory long-term solution.Could you please confirm whether the Cloud/infrastructure team has applied any filtering, WAF rules, rate limiting or other mitigation to our community since the ticket was escalated?

If nothing has been applied yet, could you please let me know whether the infrastructure team has identified this traffic pattern and whether server-side mitigation is possible?The abnormal traffic is still reaching the community, so I would really appreciate a technical update on the investigation.

Thank you.

Updates on issues related to these can take time to be addressed, as they are with an advanced team and changes dont only affect one site. Someone will be in contact as soon as they can.

Hello Marc,

I just wanted to provide an additional update regarding the abnormal traffic affecting our community.

The issue is still clearly ongoing today, Sunday September 20. At the time of the attached screenshot, GA4 was reporting 686 active users over the last 30 minutes, with a very unusual geographical distribution for our French-language community.

Earlier this morning, AdSense had already recorded approximately 7,900 page views by 8:00 AM, which is far above the traffic level we would normally expect at that time of day.

GA4 also reported 5,731 active users so far today, with 2,193 from the United States compared with only 392 from France. Brazil, Colombia, Ecuador and several other countries continue to generate unusually high volumes of traffic.

In the real-time screenshot below, only 61 users are attributed to Google, while GA4 reports 686 active users, together with 678 session starts and 604 first visits during thedisplayed period. This appears consistent with the same abnormal traffic pattern already reported in the ticket. I am attaching this screenshot as additional information that may be useful to the advanced/Cloud team in their investigation.

The attached GA4 report is displayed in French, but the figures show the situation very clearly: by approximately 9:00 AM today, 6,382 active users had already been recorded, including 2,440 from the United States compared with only 443 from France. Average engagement time is 0 seconds for the United States, Brazil and Colombia, compared with 1 minute 45 seconds for France.

Thank you again for your help and for forwarding this information to the appropriate team.

Kind regards,

Nicolas

Edited September 20Sep 20 by NicolasPC

Hello Marc,

I am sorry to post another update so soon, but the situation has deteriorated significantly this morning and is now having a severe impact on our AdSense monetization.

The latest GA4 report shows that the abnormal traffic is no longer targeting only specific sections of the community. It is now crawling a very large number of regular forum topics (/topic/ URLs), including old topics and deep pagination pages.

So far today, GA4 has recorded 21,122 page views, including 6,370 from the United States (30.16%), compared with 4,735 from France (22.42%). This means that today our French-language community is actually receiving more page views from the United States than from France.

The report clearly shows that these US views are distributed across a very large number of ordinary forum topics rather than being concentrated on one particular page. This is consistent with automated crawling of the community.

As shown in my previous report, this abnormal international traffic also has extremely poor engagement, with 0-second average engagement time for the United States and several other countries, whereas legitimate French traffic shows normal engagement.

The most serious consequence is now visible in AdSense. At approximately 12:12 PM today, AdSense had already recorded 13,300 page views, but only 7,400 ad impressions, with the page RPM collapsing to just €0.69 and page CTR to 0.84%. Estimated revenue was only €9.20, despite this exceptionally high number of page views.

In recent days, when traffic quality was much more normal, our page RPM was around €3 or more. The sudden combination of huge volumes of abnormal page views and the collapse in RPM strongly suggests that this traffic is severely degrading the monetization of our advertising inventory.

Unfortunately, because these requests are now reaching normal public forum topics containing advertising, I cannot simply block these pages for guests without also blocking legitimate visitors coming from Google and seriously affecting the normal operation and visibility of the community.

This is therefore becoming extremely concerning for us. Restricting individual sections such as Downloads, profiles or search can reduce the exposed surface, but it cannot solve the problem now that the abnormal traffic is systematically crawling ordinary public topics.

I am attaching the latest GA4 report because I believe it demonstrates particularly clearly why this issue now requires infrastructure-level mitigation rather than additional community permission restrictions.

Could the Cloud/advanced team please urgently investigate whether this traffic can be filtered, challenged or rate-limited before it reaches the community pages and the advertising code?

Thank you again for your help and for forwarding this additional information to the Cloud team.

Kind regards,

Nicolas

8 hours ago, NicolasPC said:

Hello Marc,

I am sorry to post another update so soon, but the situation has deteriorated significantly this morning and is now having a severe impact on our AdSense monetization.

The latest GA4 report shows that the abnormal traffic is no longer targeting only specific sections of the community. It is now crawling a very large number of regular forum topics (/topic/ URLs), including old topics and deep pagination pages.

So far today, GA4 has recorded 21,122 page views, including 6,370 from the United States (30.16%), compared with 4,735 from France (22.42%). This means that today our French-language community is actually receiving more page views from the United States than from France.

The report clearly shows that these US views are distributed across a very large number of ordinary forum topics rather than being concentrated on one particular page. This is consistent with automated crawling of the community.

As shown in my previous report, this abnormal international traffic also has extremely poor engagement, with 0-second average engagement time for the United States and several other countries, whereas legitimate French traffic shows normal engagement.

The most serious consequence is now visible in AdSense. At approximately 12:12 PM today, AdSense had already recorded 13,300 page views, but only 7,400 ad impressions, with the page RPM collapsing to just €0.69 and page CTR to 0.84%. Estimated revenue was only €9.20, despite this exceptionally high number of page views.

In recent days, when traffic quality was much more normal, our page RPM was around €3 or more. The sudden combination of huge volumes of abnormal page views and the collapse in RPM strongly suggests that this traffic is severely degrading the monetization of our advertising inventory.

Unfortunately, because these requests are now reaching normal public forum topics containing advertising, I cannot simply block these pages for guests without also blocking legitimate visitors coming from Google and seriously affecting the normal operation and visibility of the community.

This is therefore becoming extremely concerning for us. Restricting individual sections such as Downloads, profiles or search can reduce the exposed surface, but it cannot solve the problem now that the abnormal traffic is systematically crawling ordinary public topics.

I am attaching the latest GA4 report because I believe it demonstrates particularly clearly why this issue now requires infrastructure-level mitigation rather than additional community permission restrictions.

Could the Cloud/advanced team please urgently investigate whether this traffic can be filtered, challenged or rate-limited before it reaches the community pages and the advertising code?

Thank you again for your help and for forwarding this additional information to the Cloud team.

Kind regards,

Nicolas

Hi Nicolas,

Can you submit a ticket from your client area please? We can make sure it gets to the right department.

Thanks!

Hi,

Thank you very much for your reply.

I already have an existing support ticket regarding this issue: #205963. It was escalated by Marc to the advanced/Cloud infrastructure team on September 9, but unfortunately I have not yet received any technical update from that team.

The abnormal traffic is still ongoing today and has significantly worsened again, as shown in the screenshots above. It is now systematically crawling thousands of normal public /topic/ pages and is having a severe impact on our AdSense monetization.

Since the ticket has already been with the advanced team since September 9, I would greatly appreciate it if you could check that ticket #205963 has reached the appropriate Cloud/infrastructure team and, if possible, ask them to review the new information I have provided here.

I would prefer to keep everything within the existing ticket rather than create a duplicate.

Thank you very much for your help.

Kind regards,

Nicolas

Hello,

I am sorry to post another update, but the situation is continuing again this morning and I would really appreciate an update from the Cloud/infrastructure team regarding ticket #205963, which has been escalated since September 9.

The attached GA4 reports are particularly revealing. The day has only just started, yet abnormal international traffic is already dominating our audience.

At the time of the report, GA4 had recorded 3,753 active users, including:

United States: 1,403 active users (37.38%), including 1,400 new users, with an average engagement time of 0 seconds

Brazil: 380 active users, all 380 new, with 0 seconds average engagement

Colombia: 315 active users, all 315 new, with 0 seconds average engagement

Ecuador: 232 active users, all 232 new, with 0 seconds average engagement

France: only 319 active users, but with an average engagement time of 1 minute 24 seconds

This contrast is extremely unusual for a French-language community. The United States alone currently represents more than four times as many active users as France, while virtually all of those US users are new and their average engagement time is 0 seconds.

The page-level GA4 report taken at approximately the same time had already recorded more than 2,500 page views from the United States this morning. These views are distributed across a very large number of ordinary public forum topics, including old topics and deep pagination pages. Some requests are also reaching URLs containing parameters such as do=showReactionsComment.

I understand that GA4 alone cannot formally identify individual requests as bots. However, the combination of the geographical distribution, the extremely high proportion of new users, 0-second average engagement and systematic traversal of a very large number of forum URLs appears strongly consistent with automated crawling.

The second attached screenshot shows the direct consequences in AdSense.

Yesterday, AdSense recorded 27,800 page views — 96% more than the previous Sunday. Despite this enormous increase in page views, advertising performance collapsed:

Page RPM: €0.68 — down 79%

Ad impressions: 20,900 — down 41%

Clicks: 451 — down 21%

CPC: €0.04 — down 50%

Page CTR: 1.62% — down 60%

In other words, AdSense recorded almost twice as many page views, while the value of those page views collapsed. The abnormal traffic is therefore not generating additional revenue; on the contrary, it is coinciding with a severe deterioration in all of our main monetization indicators.

This is particularly concerning because these automated-looking visits are now reaching ordinary public /topic/ pages where advertising can be displayed to guests. We cannot simply block guest access to those pages without also blocking legitimate visitors and potentially damaging the normal operation and search visibility of the community.

This is now having a direct and severe financial impact on our community. If several consecutive days are affected in this way, it puts a significant part of the funding of the community at risk.

Could the Cloud/infrastructure team please investigate this traffic pattern at server/WAF level, where IP addresses, request frequency, user agents, ASNs and other request characteristics can be analysed, and let us know whether any filtering, rate limiting or other mitigation can be applied before this traffic reaches the community?

I sincerely hope this issue can now be investigated by the appropriate team. As ticket #205963 has been escalated since September 9, I would be very grateful for any technical update regarding the investigation.

Thank you very much for your help.

Kind regards,

Nicolas

Edited September 21Sep 21 by NicolasPC

Please post all information in reply to the ticket you have open. As this is with our advanced team ,it can indeed take some time to be looked into.

As I believe I have mentioned previously, I personally dont believe one is related to the other. However its been escalated to be advised on.

Hello,

I am sorry to post another update, but the situation this morning is becoming extremely concerning and I really need the Cloud team to investigate this traffic at server/WAF level.

At only 7:30 AM France time on September 22, GA4 has already recorded 7,233 page views:

United States: 2,294 (31.72%)

Brazil: 844 (11.67%)

Colombia: 680 (9.40%)

Ecuador: 381 (5.27%)

France: only 922 (12.75%)

The United States, Brazil, Colombia and Ecuador therefore already represent approximately 58% of all page views this morning, while France represents less than 13%.

As shown in the attached GA4 report, this traffic is again distributed across a very large number of unrelated and often old topics, including deep pages and Invision actions such as do=showReactionsComment, rather than being concentrated on any particular popular content.

From my side as an Invision Cloud customer, I unfortunately have no server/WAF access that would allow me to identify or rate-limit these visitors without restricting legitimate guests and search-engine traffic.

The country-level user behaviour makes the anomaly even clearer.

At the same time this morning, GA4 recorded 3,734 active users. The United States alone accounted for 1,263 active users (33.82%), compared with only 301 from France (8.06%).

More importantly, almost all users from the countries generating this unusual traffic are new users, with 0 seconds of average engagement time:

United States: 1,263 active / 1,265 new — 0 sec

Brazil: 466 active / 466 new — 0 sec

Colombia: 389 active / 389 new — 0 sec

Ecuador: 214 active / 214 new — 0 sec

By comparison, France shows a completely different and expected behaviour: 301 active users, 197 new users and 1 min 30 sec average engagement time.

GA4 cannot by itself prove that these visits are automated, but the contrast is extremely unusual and strongly consistent with the abnormal crawling pattern described above. This is why I really need the Cloud team to examine the corresponding server/WAF logs.

I would also like to clarify why I have been mentioning the AdSense impact. I am not claiming that I can see Google's internal invalid-traffic classification. I cannot. However, Google's own AdSense documentation explicitly states that invalid traffic can include automated traffic sources and robots, that Google analyses abnormal usage patterns and filters invalid traffic, and that invalid traffic can affect impressions and earnings.

Official Google documentation:

Google AdSense — Invalid traffic

Google AdSense — How Google prevents invalid traffic

Google AdSense — Troubleshoot issues with impressions

Google AdSense — Invalid activity deductions from earnings

This documented mechanism is consistent with what we are observing: a very large increase in abnormal traffic occurring at the same time as a severe deterioration in AdSense monetization. Again, I am not asking Invision to diagnose AdSense; I am asking the Cloud team to investigate the abnormal traffic reaching the community.

Could the Cloud/Infrastructure team please correlate these periods with the server/WAF logs and check the corresponding IPs, ASNs, user agents, request frequency and URL patterns, and advise whether WAF filtering, rate limiting or another mitigation can be applied?

Ticket #205963 has been escalated since September 9, and at this stage I unfortunately cannot take any effective action myself without blocking legitimate visitors.

Thank you.

Edited September 22Sep 22 by NicolasPC

We went ahead and pulled the raw connection logs for your community to compare against what GA4 is reporting, and the two don't line up.

Looking at actual server level connections, the traffic is overwhelmingly from France and from known search engine crawlers, primarily Googlebot, Bingbot, and Facebook's link preview fetcher (facebookexternalhit). For the specific window you referenced, we only see 53 total connections from Colombia, nowhere close to the 680 page views GA4 attributed to that country. The same gap holds for the Brazil, and Ecuador numbers you sent over.

That mismatch tells us much of this traffic isn't even hitting your site. If it were real requests, even automated ones, they would show up in our edge logs regardless of what GA4 does or doesn't capture. Since they're not there, the traffic GA4 is counting never actually reached your server.

What's most likely happening is that your GA4 Measurement ID is being hit directly by scripts sending fake data straight to Google's collection endpoint, without ever loading a page on your site. This is a known issue sometimes called ghost or phantom traffic or GA4 measurement spam, and it's unfortunately common when a Measurement ID is exposed in public page source, which it always is by design. Because it bypasses your site entirely, there's nothing at the server or WAF level for us to filter, rate limit, or block, since no request is being made to your infrastructure in the first place.

A couple of things on your end that should help confirm this and clean up your reporting:

1. In GA4, check the Traffic acquisition report and add the Hostname dimension. Legitimate hits will show your actual domain. Spoofed hits typically show blank, "not set," or an unrelated domain.

2. Consider setting up a valid hostname filter in GA4 so only traffic reporting your real domain is counted. This is the standard fix for this exact issue.

3. If you want to fully cut this off, the Measurement ID can be rotated, though that requires re tagging your GA4 setup.

You should Google "GA4 phantom" or ghost traffic. There is a lot of information and potential solutions. In any event, it's not something we can solve on our end as it's often not real traffic. Even in the event of legitimate automated traffic passing through, we unfortunately just do not live in a world where we can toggle a one-size-fits-all "desirable traffic only" button. I wish it existed. At a retail platform level, we have to make adjustments that capture as much malicious/automated traffic as possible while balancing false positives. It's a never-ending game of cat and mouse.