Reported IVT types | Pixalate Docs

Analytics classifies each invalid impression or click under one IVT type. This page explains where those types appear in your reports and how the names in your reports relate to IVT Taxonomy 2.0, Pixalate’s canonical list of IVT types and codes.

Where IVT types appear

By Fraud Type results — The By Fraud Type report lists each reported IVT type with its SIVT and GIVT counts.

Fraud Type dimension. Add it to a report to break your IVT down by type. In the Analytics Reports API and in exports, it’s the fraudType dimension, and each type is a short camelCase value such as maskedIp. The By Fraud Type report in the dashboard shows these short values too.
Pre-set reports. The By Fraud Type and Invalid Traffic reports break your traffic down by IVT type, grouped as GIVT and SIVT. See Pre-set reports.

Each row with a fraud type value is 100% IVT, and a row with no fraud type value is IVT-free. Fraud types are calculated based on the worst fraudulent activity that each IP has performed globally. This means a report can show click fraud types even if you haven’t implemented Pixalate click trackers.

For the metrics that count filtered traffic, such as GIVT Ad Counts and SIVT %, see Metrics: IVT.

Reported types and IVT Taxonomy 2.0

The type names used in Analytics reports predate IVT Taxonomy 2.0, and many of them differ from the taxonomy’s names. The table maps each reported name to the taxonomy type that describes the same activity. For each type’s full definition, use the code to look it up in the IVT Taxonomy.

GIVT is General Invalid Traffic and SIVT is Sophisticated Invalid Traffic. The API value is shown where Pixalate has published it.

Reported type	API value	Class	Taxonomy 2.0 type (code)	What it flags
App Spoofing		SIVT	App Misrepresentation (2207)	The app identifier (such as the bundle ID) reported to the exchange doesn’t match the characteristics of the app Pixalate detects.
Auto Reloader		GIVT	Auto Refresh Fraud (1106)	Impressions with periodic patterns too regular to be generated by a human.
Blank User Agent		GIVT	Missing User Agents (1105)	The impression has an empty user-agent field.
Click Farm		SIVT	Click Farms (2301)	Impressions from a user flagged as associated with human click farm activity.
Cookie Stuffing		SIVT	Cookie Stuffing (2212)	A cookie that has connected through a statistically inflated number of different IP addresses.
Datacenter		GIVT	Data Center Traffic (1301)	The user’s IP matches Pixalate’s known data center list.
Datacenter Proxy	`datacenterProxy`	SIVT	Data Center Proxy Traffic (2202)	An intermediary proxy running in a data center that manipulates traffic counts, passes non-human or invalid traffic, or fails to comply with protocol.
Defased App	`defasedApp`	SIVT	Defased Apps (2505)	Traffic from apps that were delisted from their app stores. See Defased apps.
Device Id Stuffing		SIVT	Fraudulent Device IDs (2206)	A device ID that presents itself across a statistically inflated number of IP addresses, apps, branded platforms or locations.
Display Click Fraud		SIVT	Infected Device Clicks (2302)	Clicks generated from the same browser or device at a statistically inflated rate.
Display Impression Fraud		SIVT	Infected Device Traffic (2101)	Impressions generated from the same browser or device at a statistically inflated rate.
Doorway Site		SIVT	Spoofed Referrer (2213)	A user flagged for reaching a page or domain through multiple spoofed page referrers.
Duplicate Clicks		GIVT	Repeat Click Transactions (1102)	High volumes of duplicate clicks, which may indicate an integration issue.
Duplicate Impressions	`duplicateImpressions`	GIVT	Repeat Transactions (1101)	High volumes of duplicate impressions, which may indicate an integration issue. See the FAQ.
Fast Clicker		GIVT	Fraudulent Clicks (1108)	Clicks less than one second after their impression.
High Risk Device ID	`highRiskDeviceId`	SIVT	Known Dangerous or Fraudulent Devices (2501)	A device ID flagged for a high risk of invalid traffic.
High Risk Domain		SIVT	Known Dangerous or Fraudulent Domains (2504)	A domain flagged for a high risk of invalid traffic.
High Risk IP		SIVT	Known Dangerous or Fraudulent IPv4 Addresses (2502)	An IP address flagged for a high risk of invalid traffic.
Hijacked Session		SIVT	Infected Device Sessions (2102)	A device or browser with a statistically inflated number of user sessions.
IAB Crawler	`iabCrawler`	GIVT	IAB Crawlers (1201); self-announced prefetch: Invalid Prefetch Traffic (1109)	Bots whose user agent matches the IAB list of known crawlers. In reports, this type also includes self-announced prefetch activity (for example, `X-moz: prefetch` or `X-purpose: preview`).
IAB Dummy Bot		GIVT	Fraudulent User Agents (1104)	Bots whose user agent doesn’t match any existing browser.
idioBots	`idioBots`	GIVT	Spoofed User Agents (1103); illogical placements: Invalid Placement Traffic (1401)	Bots or users that change their user agent (spoofing) while keeping the same cookie. In reports, this type also includes traffic on illogical placement dimensions, such as 0x0 or 1x1, under the IAB Standard Ad Portfolio.
Location Obfuscation		SIVT	Falsified Geolocation (2211)	An IP where multiple impressions deviate from the geographic location reported in the transaction.
Malware		SIVT	Adware, Malware or Phishing (2506)	Impressions from domains or pages known to host malware.
Masked IP	`maskedIp`	SIVT	IP Address Mismatch (2203)	The user’s IP doesn’t match the IP and ISP reported in the transaction.
Masked iCloud Relay IP	`maskediCloudRelayIP`	SIVT	Spoofed iCloud Private Relay (2204)	As Masked IP, where the reported IP was claimed to be an iCloud Private Relay address. See iCloud Private Relay.
Phishing		SIVT	Adware, Malware or Phishing (2506)	Impressions from domains or pages associated with phishing.
Private IP		GIVT	Reserved Network IPs (1107)	The IP address is in private network space.
Proxy	`proxy`	SIVT	Invalid Proxy Traffic (2201)	An intermediary proxy that manipulates traffic counts, passes non-human or invalid traffic, or fails to comply with protocol.
SCO Unauthorized Direct Seller	`SCOunauthorizedDirectSeller`	SIVT	SCO Unauthorized Sellers (2602)	The publisher’s ads.txt or app-ads.txt doesn’t list the seller in the first node of the supply chain object (SCO) as DIRECT.
SCO Unauthorized Direct Seller Publisher Missing	`SCOunauthorizedDirectSellerPublisherMissing`	SIVT	SCO Publisher is Null (2601)	The first node of the SCO doesn’t point to a publisher.
Video Click Fraud		SIVT	Infected Device Clicks (2302)	Video ad clicks generated from the same browser or device at a statistically inflated rate.
Video Impression Fraud		SIVT	Infected Device Traffic (2101)	Video ad impressions generated from the same browser or device at a statistically inflated rate.

Types without a published taxonomy match

These reported types have no single matching type in IVT Taxonomy 2.0 that Pixalate has published. If you need to reconcile them with taxonomy codes, contact support@pixalate.com.

Reported type	API value	Class	What it flags
High CTR Traffic	`highCTR`	SIVT	Traffic from domains or apps with high-risk click-through rate behavior. See the FAQ.
High Risk App	`highRiskApp`	SIVT	An app flagged for a high risk of invalid traffic. See High risk apps.
High Risk Developer		SIVT	An app from a developer that has created one or more blocklisted apps, and that generates a large volume of invalid traffic.
High Risk SCO Node		SIVT	The SCO includes a node flagged for a high risk of invalid traffic.
IP Obfuscation		SIVT	An IP that has been spoofed, so the impression renders to a different IP address than the one originally offered.
Publisher Fraud		SIVT	Publishers whose domains or apps violate standard ad serving practices, for example with stacked ads, high ad density or inflated impression counts.
Smartbot		SIVT	Bots or users that change their user agent and cookies very often under the same IP, at low volume or at high volume that looks like a busy enterprise network.
TOR		GIVT	Traffic from a Tor network node.

High risk apps

Impressions from apps on the High Risk Mobile Apps 2.0 and High Risk CTV Apps 2.0 lists are no longer classified under the High Risk App IVT type. This separates app-level structural risk from impression-level IVT detection, in line with the MRC’s Invalid Traffic Detection and Filtration Interim Update Memo.

To see how much of your traffic comes from listed apps, use the Traffic from High Risk Apps (%) metric and the High Risk App (Yes/No) dimension. For when this changed, see the changelog.

Defased apps

Defased App is SIVT. It’s in the Known Dangerous Sources category of IVT Taxonomy 2.0. Not every delisted app is flagged: Pixalate looks at how an app behaved before it was delisted when deciding whether its traffic is IVT, and traffic from a delisted app can be labeled with other IVT types first. For the delisted app lists you can block pre-bid, see Delisted apps (DEFASE).

How to address each type

Reported types	What to do
Datacenter	Use the data center feeds.
Datacenter Proxy, Proxy, High Risk IP, TOR, Cookie Stuffing, Doorway Site	Use the IP block lists. For Datacenter Proxy, filter IPs flagged as `datacenterProxy`. For Proxy, also review how proxy services, including SSAI, are implemented.
High Risk Device ID, Device Id Stuffing	Use the mobile device ID and CTV device ID feeds.
Auto Reloader, Click Farm, Fast Clicker, Hijacked Session, Smartbot, Display Click Fraud, Video Click Fraud	Use the IP, data center and device ID feeds.
Display Impression Fraud, Video Impression Fraud	Apply frequency capping, and use the IP and device ID feeds.
Blank User Agent	Don’t bid on inventory where the user-agent field isn’t available.
IAB Crawler, IAB Dummy Bot	Use the user-agent feed, which contains known crawlers and dummy bots.
idioBots	Use the user-based feeds (IP, data center or device ID). The user agents may be valid, not crawlers, but spoofed.
Defased App	Use the DEFASE lists.
High Risk App, High Risk Developer	Use the High Risk Mobile Apps and High Risk CTV Apps lists.
High Risk Domain, Malware, Phishing	Use the High Risk Domains lists, including the malware and phishing list.
High CTR Traffic	Use the High Risk Domains, High Risk Mobile Apps or IP lists.
Publisher Fraud	Use publisher-level block lists.
App Spoofing	This tends to concentrate at the source or seller ID. Find the source with Analytics reports by seller.
Location Obfuscation	This usually concentrates at the publisher, or publisher and seller ID, level. The device ID and IP block lists can also help.
Masked IP	Use high-risk publisher-level identifiers.
Masked iCloud Relay IP	Use the IP block lists, and block sellers where this traffic concentrates.
IP Obfuscation	This can be caused by cookies being stored at the proxy level. Reject Pixalate cookies set at the proxy level.
Private IP	This indicates an integration issue, for example in a server-to-server integration.
Duplicate Impressions, Duplicate Clicks	Check your integration. Contact support@pixalate.com for help.
SCO Unauthorized Direct Seller	Make sure the publisher’s ads.txt or app-ads.txt lists the seller in the first node as DIRECT. If it isn’t resolved, optimize away from these nodes: they can also indicate other traffic quality issues, especially at high IVT volumes.
SCO Unauthorized Direct Seller Publisher Missing	Ask the seller to check they pass the correct information and that their sellers.json identifies their relationship with the publisher as direct. If it isn’t resolved, optimize away from these nodes.
High Risk SCO Node	Use the SPO feed to block problematic nodes pre-bid, and the SCO reports to find them.

For how often Pixalate’s crawler refreshes ads.txt, app-ads.txt and sellers.json data, see the Analytics FAQ.

Questions? Contact support@pixalate.com.