Traffic spikes from Singapore exploiting recommended product URL parameters (Search & Discovery)

I am just wondering if Shopify are aware of bot traffic bombarding their network from Singapore currently? It is affecting thousands of merchants and there appears to be no acknowledgement from Shopify of the issue at all.

There have been numerous recent reports of this in the community forums (example 1 / example 2). There is a lot of other threads from years ago as well. That first example though contains the exact scenario we’re seeing on multiple Shopify stores right now where all of the hits are to product URLs containing every variation of the Search & Discovery parameters.

Shopify isn’t even detecting much of this traffic as bots in Shopify Analytics. They are simulating a real human as best as they can but is essentially an attack and every day, Shopify Analytics is just showing thousands of hits from countries that we don’t even sell to (largely Singapore).

I know there are workarounds such as using a third party app or even writing a script but it is just more bloat-ware being added to our themes.

Surely Shopify can just tackle the problem with Cloudflare? I am just not sure whether this feedback has actually reached anyone in the company that is able to investigate this…

It appears to have been a major issue since the end of last year.

If there is someone at Shopify that can respond so we know if they are dealing (or care) and we can figure out how to move forward because it will take a lot of time to come up with solutions to minimise or fully mitigate ourselves and/or configure analytics systems with segmentation and exclusions etc so that all of our data is not completely skewed.

@Liam-Shopify @Gray-Shopify sorry to tag you guys, not sure how to catch someone’s attention at Shopify :sweat_smile:

@GeoffJacksonAJP we’re getting 6-7k sessions from Singapore per day

However, in our standalone Cloudflare account, its shows around 20 events per day from Singapore. Looks as though the thousands in Shopify are considered non-malicious by Cloudflare (hence why the built-in Shopify Cloudlfare doesnt block them).

However, its causing a huge issue with our LCP stats so affecting our loas times for real customers

We had the same issue with China and USA Bot traffic recently but the separate Cloudflare account solved that but it hasnt worked for Singapore traffic - Im still trying to figure out why

@GeoffJacksonAJP all sorted! Had to change some DNS settings in Cloudflare to make sure it was properly configured to O2O but working now and no more Singapore bots!

@Paul_Vale are you on Shopify Plus? I think that is the only way we can use O2O with another Cloudflare in front of Shopify’s?