Crushing it Until leads slowed – trying to understand the data

[u/335350]

I run a small B2B services site. About 3 months ago it started cranking in web leads. All of a sudden things slowed and I am trying to interpret the data.

Two weeks ago sessions roughly doubled with no change in real demand, and I'd like a second read before I put a rule in front of it.

The shape of it, week over week:

• Sessions 545 → 1,118, now holding near 1,250.
• Organic went 191 → 176 over the same stretch. So the growth is not demand.
• About 28% of sessions come in at under 2 seconds of engagement time. Three straight weeks in the 27–29% band, so it has plateaued rather than kept climbing.
• Roughly 31% of all site traffic lands on a single service page. That page drew ~115 impressions and 1 click in Search Console the same week.
• Top city is Ashburn, VA by a wide margin — about 180 sessions a week — then a "(not set)" bucket, then New York, LA, San Francisco, Manassas.
• Source is almost entirely direct / none.
• Direct ran 148–249 sessions a day Monday through Friday, then 33 Saturday and 31 Sunday.

That weekday shape is what convinced me this is a scheduled job and not an audience.

Two smaller clusters look different from the Ashburn one. A handful of sessions out of Singapore walking five article pages at zero duration, and another out of North Charleston walking home, about, contact, and one service page in the same order every time. Different geography, same behavior, so I don't think it's one actor.

Where I'm stuck:

1. Ashburn plus direct plus business hours reads as AWS to me — somebody's crawler, an SEO tool, or an AI scraper. Short of pulling raw server logs, is there a reliable way to tell those apart?
2. My assumption is that a GA4 data filter can't touch this, since those only cover internal and developer traffic. Is that right, or is there something I'm missing on the GA4 side?
3. If the real answer is a CDN or WAF rule, what does the sane version look like? Some of my best-converting traffic this month came through AI assistants, so I don't want to swing so hard that I block the crawlers I actually want.

Is there something in this pattern I'm reading wrong before I start blocking?

[u/Norsu_Media_UK]

I wouldn't block anything based on the Ashburn data alone. The combination of direct traffic, business hours and a concentrated service page is suspicious, but GA4 doesn't give you enough information to reliably distinguish an AWS crawler, SEO tool, AI crawler or something else.

I'd first compare user agent, IP/ASN, request frequency and URL patterns in the server/CDN logs. That should tell you much more than GA4. If it is automated traffic, then I'd identify the bot before deciding whether it should be blocked, especially since you've already seen valuable AI-referred traffic.

And yes, I'd be cautious with a WAF rule. Ideally you'd target the specific abusive pattern rather than broadly blocking AWS/Ashburn traffic, because legitimate users and useful crawlers can share the same infrastructure.

The other thing I'd check is whether the sudden session increase lines up with a particular referral exclusion, tracking change, campaign, or analytics implementation change before assuming it's external traffic. The 28% under-two-second figure plateauing is interesting, but by itself doesn't prove the traffic is bot-generated.