A traffic spike on a small site feels great for about a day. Then you look closer and some of it isn't people. I've been through this on several data sites I work on this year, and the pattern is consistent enough to write down: the bots that cause trouble now look like real visitors in Google Analytics, and the way to catch them is to compare sources that a bot can't fake at the same time.
Two real cases show how it works.
The fake Google visitor. On a data site, Google Analytics 4 showed traffic labeled google / organic jumping from about 3 sessions a day to about 75, all of them engaged. Search Console, Google's own record of clicks from search results, showed 0 to 2 clicks a day for the same period. Over three days, 223 of the 227 sessions GA4 labeled as Google came from one source: a datacenter network, a Linux desktop browser string, every visitor in the same city. It sent a header claiming to come from google.com, and it ran the page's JavaScript, so GA4 counted it as an engaged search visitor.
The polite crowd. On another site, a different fleet requested about 800 pages in 14 hours from 773 different home internet connections, almost exactly one page each. Every request used the same frozen browser version (Chrome 149). GA4 undercounted it by roughly ten times, because only some of those visits ran the analytics script, so the server's own logs were the only place the real size showed up.
Five checks that catch them
1. Compare GA4 with Search Console. If GA4 says Google traffic doubled and Search Console clicks didn't move, the extra traffic isn't from Google. Bing Webmaster Tools works the same way for Bing. This is the single fastest check, and it needs no technical skill.
2. Look for traffic that's too good. Real visitors leave quickly sometimes. A source with 100 percent engagement, one city, one screen size, and one browser is a machine.
3. Check where visitors say they came from against how they actually arrived. Browsers send a header called Sec-Fetch-Site. MDN defines the value none as "a user-originated operation. For example: entering a URL into the address bar, opening a bookmark." Someone clicking a Google result arrives as cross-site. A request that claims a Google referrer but says none is impossible for a real browser, and it's exactly what the census-site bot sent.
4. Count pages per visitor. People browse. They land on one page, click to another, and their browser loads the site's images and scripts along the way. Hundreds of addresses that each load exactly one page and nothing else, around the clock, is a fleet. On the lottery site the giveaway was that none of those addresses ever clicked an internal link.
5. Watch for a frozen browser version. Real browsers update themselves. A large group stuck on one specific version a few releases behind everyone else, often with no referrer at all, is usually one scraper pretending to be many people.
You can ask Claude Code to do most of this. Point it at your server's access log and ask it to group requests by browser version and count distinct addresses and pages per address. The fleets show up as a version with hundreds of addresses at one or two pages each.
Blocking is where you need to be careful, because real readers share networks with bots. A rule that challenges a whole home internet provider will hit your actual audience. On these sites, the rules that held combined several signals at once, like a frozen browser version plus an empty referrer plus a single page, and sent most of them to a Cloudflare challenge rather than a hard block. That's the kind of setup putting Cloudflare in front of your site makes possible. Some fleets now solve challenges, which is when a narrow, exact-match block becomes worth it.
The cost of skipping all this isn't only server load. If you report traffic to an ad network, a sponsor, or an investor, fake visitors make your numbers wrong, and it's far better to be the one who finds that out.
Sources
MDN: Sec-Fetch-Site - The definitions of the none and cross-site values, with none describing user-originated requests such as typing a URL or opening a bookmark.
Analytics, Search Console, and server logs from sites the author works on, September and October 2026 - The census-site comparison of GA4 google / organic sessions against Search Console clicks, and the lottery-site fleet of about 800 requests from 773 addresses in 14 hours.
