Cloudflare Bot Protection isn't stopping aggressive bot traffic (mostly Singapore). Any ideas?

Hi everyone,

I'm hoping someone has dealt with this before.

Over the past few weeks, my website has been receiving increasingly aggressive bot traffic. Google Analytics Realtime constantly shows around 300 active users from Singapore, while my actual audience is from a completely different region.

Some observations:

Around 300 active users almost all the time.

Almost all of them appear to come from Singapore.

I've already blocked the region, but the traffic keeps coming back.

I'm using Cloudflare's Bot Protection with WAF rules enabled.

Despite that, these sessions continue to appear every day and seem to be increasing.

I'm trying to figure out whether this is:

Sophisticated bots using residential proxies?

GA4 Measurement Protocol spam?

Scrapers that are bypassing Cloudflare?

Or something else entirely.

Has anyone experienced something similar?

What additional Cloudflare rules or security settings helped you stop this kind of traffic?

Should I be looking at Bot Scores, ASN blocking, rate limiting, JA3 fingerprinting, or something else?

Any advice would be greatly appreciated. Thanks!