> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.pixalate.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server. # Reported IVT types > The invalid traffic (IVT) type names shown in Pixalate Analytics reports, their GIVT or SIVT class, the matching IVT Taxonomy 2.0 type and code, and recommended ways to reduce each type. Analytics classifies each invalid impression or click under one IVT type. This page explains where those types appear in your reports and how the names in your reports relate to [IVT Taxonomy 2.0](/trust/ivt-taxonomy), Pixalate's canonical list of IVT types and codes. ## Where IVT types appear ![By Fraud Type results](/_fern-img/f696a07f56b5dca896c6d3901ff725f635dd8db11c01b8f54e9ee1cee8d5f10d.webp) * **Fraud Type dimension.** Add it to a report to break your IVT down by type. In the [Analytics Reports API](/apis/analytics-reports-api) and in exports, it's the `fraudType` dimension, and each type is a short camelCase value such as `maskedIp`. The By Fraud Type report in the dashboard shows these short values too. * **Pre-set reports.** The **By Fraud Type** and **Invalid Traffic** reports break your traffic down by IVT type, grouped as GIVT and SIVT. See [Pre-set reports](/analytics/pre-set-reports). Each row with a fraud type value is 100% IVT, and a row with no fraud type value is IVT-free. Fraud types are calculated based on the worst fraudulent activity that each IP has performed globally. This means a report can show click fraud types even if you haven't implemented Pixalate click trackers. For the metrics that count filtered traffic, such as GIVT Ad Counts and SIVT %, see [Metrics: IVT](/analytics/metrics#ivt). ## Reported types and IVT Taxonomy 2.0 The type names used in Analytics reports predate IVT Taxonomy 2.0, and many of them differ from the taxonomy's names. The table maps each reported name to the taxonomy type that describes the same activity. For each type's full definition, use the code to look it up in the [IVT Taxonomy](/trust/ivt-taxonomy). GIVT is General Invalid Traffic and SIVT is Sophisticated Invalid Traffic. The API value is shown where Pixalate has published it. | Reported type | API value | Class | Taxonomy 2.0 type (code) | What it flags | | ------------------------------------------------ | --------------------------------------------- | ----- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | App Spoofing | | SIVT | App Misrepresentation (2207) | The app identifier (such as the bundle ID) reported to the exchange doesn't match the characteristics of the app Pixalate detects. | | Auto Reloader | | GIVT | Auto Refresh Fraud (1106) | Impressions with periodic patterns too regular to be generated by a human. | | Blank User Agent | | GIVT | Missing User Agents (1105) | The impression has an empty user-agent field. | | Click Farm | | SIVT | Click Farms (2301) | Impressions from a user flagged as associated with human click farm activity. | | Cookie Stuffing | | SIVT | Cookie Stuffing (2212) | A cookie that has connected through a statistically inflated number of different IP addresses. | | Datacenter | | GIVT | Data Center Traffic (1301) | The user's IP matches Pixalate's known data center list. | | Datacenter Proxy | `datacenterProxy` | SIVT | Data Center Proxy Traffic (2202) | An intermediary proxy running in a data center that manipulates traffic counts, passes non-human or invalid traffic, or fails to comply with protocol. | | Defased App | `defasedApp` | SIVT | Defased Apps (2505) | Traffic from apps that were delisted from their app stores. See [Defased apps](#defased-apps). | | Device Id Stuffing | | SIVT | Fraudulent Device IDs (2206) | A device ID that presents itself across a statistically inflated number of IP addresses, apps, branded platforms or locations. | | Display Click Fraud | | SIVT | Infected Device Clicks (2302) | Clicks generated from the same browser or device at a statistically inflated rate. | | Display Impression Fraud | | SIVT | Infected Device Traffic (2101) | Impressions generated from the same browser or device at a statistically inflated rate. | | Doorway Site | | SIVT | Spoofed Referrer (2213) | A user flagged for reaching a page or domain through multiple spoofed page referrers. | | Duplicate Clicks | | GIVT | Repeat Click Transactions (1102) | High volumes of duplicate clicks, which may indicate an integration issue. | | Duplicate Impressions | `duplicateImpressions` | GIVT | Repeat Transactions (1101) | High volumes of duplicate impressions, which may indicate an integration issue. See the [FAQ](/analytics/faq#why-does-pixalate-report-duplicate-impressions). | | Fast Clicker | | GIVT | Fraudulent Clicks (1108) | Clicks less than one second after their impression. | | High Risk Device ID | `highRiskDeviceId` | SIVT | Known Dangerous or Fraudulent Devices (2501) | A device ID flagged for a high risk of invalid traffic. | | High Risk Domain | | SIVT | Known Dangerous or Fraudulent Domains (2504) | A domain flagged for a high risk of invalid traffic. | | High Risk IP | | SIVT | Known Dangerous or Fraudulent IPv4 Addresses (2502) | An IP address flagged for a high risk of invalid traffic. | | Hijacked Session | | SIVT | Infected Device Sessions (2102) | A device or browser with a statistically inflated number of user sessions. | | IAB Crawler | `iabCrawler` | GIVT | IAB Crawlers (1201); self-announced prefetch: Invalid Prefetch Traffic (1109) | Bots whose user agent matches the IAB list of known crawlers. In reports, this type also includes self-announced prefetch activity (for example, `X-moz: prefetch` or `X-purpose: preview`). | | IAB Dummy Bot | | GIVT | Fraudulent User Agents (1104) | Bots whose user agent doesn't match any existing browser. | | idioBots | `idioBots` | GIVT | Spoofed User Agents (1103); illogical placements: Invalid Placement Traffic (1401) | Bots or users that change their user agent (spoofing) while keeping the same cookie. In reports, this type also includes traffic on illogical placement dimensions, such as 0x0 or 1x1, under the IAB Standard Ad Portfolio. | | Location Obfuscation | | SIVT | Falsified Geolocation (2211) | An IP where multiple impressions deviate from the geographic location reported in the transaction. | | Malware | | SIVT | Adware, Malware or Phishing (2506) | Impressions from domains or pages known to host malware. | | Masked IP | `maskedIp` | SIVT | IP Address Mismatch (2203) | The user's IP doesn't match the IP and ISP reported in the transaction. | | Masked iCloud Relay IP | `maskediCloudRelayIP` | SIVT | Spoofed iCloud Private Relay (2204) | As Masked IP, where the reported IP was claimed to be an iCloud Private Relay address. See [iCloud Private Relay](/analytics/icloud-private-relay). | | Phishing | | SIVT | Adware, Malware or Phishing (2506) | Impressions from domains or pages associated with phishing. | | Private IP | | GIVT | Reserved Network IPs (1107) | The IP address is in private network space. | | Proxy | `proxy` | SIVT | Invalid Proxy Traffic (2201) | An intermediary proxy that manipulates traffic counts, passes non-human or invalid traffic, or fails to comply with protocol. | | SCO Unauthorized Direct Seller | `SCOunauthorizedDirectSeller` | SIVT | SCO Unauthorized Sellers (2602) | The publisher's ads.txt or app-ads.txt doesn't list the seller in the first node of the supply chain object (SCO) as DIRECT. | | SCO Unauthorized Direct Seller Publisher Missing | `SCOunauthorizedDirectSellerPublisherMissing` | SIVT | SCO Publisher is Null (2601) | The first node of the SCO doesn't point to a publisher. | | Video Click Fraud | | SIVT | Infected Device Clicks (2302) | Video ad clicks generated from the same browser or device at a statistically inflated rate. | | Video Impression Fraud | | SIVT | Infected Device Traffic (2101) | Video ad impressions generated from the same browser or device at a statistically inflated rate. | ### Types without a published taxonomy match These reported types have no single matching type in IVT Taxonomy 2.0 that Pixalate has published. If you need to reconcile them with taxonomy codes, contact [support@pixalate.com](mailto:support@pixalate.com). | Reported type | API value | Class | What it flags | | ------------------- | ------------- | ----- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | High CTR Traffic | `highCTR` | SIVT | Traffic from domains or apps with high-risk click-through rate behavior. See the [FAQ](/analytics/faq#what-does-the-highctr-ivt-type-mean). | | High Risk App | `highRiskApp` | SIVT | An app flagged for a high risk of invalid traffic. See [High risk apps](#high-risk-apps). | | High Risk Developer | | SIVT | An app from a developer that has created one or more blocklisted apps, and that generates a large volume of invalid traffic. | | High Risk SCO Node | | SIVT | The SCO includes a node flagged for a high risk of invalid traffic. | | IP Obfuscation | | SIVT | An IP that has been spoofed, so the impression renders to a different IP address than the one originally offered. | | Publisher Fraud | | SIVT | Publishers whose domains or apps violate standard ad serving practices, for example with stacked ads, high ad density or inflated impression counts. | | Smartbot | | SIVT | Bots or users that change their user agent and cookies very often under the same IP, at low volume or at high volume that looks like a busy enterprise network. | | TOR | | GIVT | Traffic from a Tor network node. | ## High risk apps Impressions from apps on the [High Risk Mobile Apps 2.0](/data-feeds/high-risk-mobile-apps) and [High Risk CTV Apps 2.0](/data-feeds/high-risk-ctv-apps) lists are no longer classified under the High Risk App IVT type. This separates app-level structural risk from impression-level IVT detection, in line with the MRC's Invalid Traffic Detection and Filtration Interim Update Memo. To see how much of your traffic comes from listed apps, use the [Traffic from High Risk Apps (%)](/analytics/metrics#high-risk-apps) metric and the [High Risk App (Yes/No)](/analytics/dimensions#high-risk-app) dimension. For when this changed, see the [changelog](/changelog). ## Defased apps Defased App is SIVT. It's in the Known Dangerous Sources category of IVT Taxonomy 2.0. Not every delisted app is flagged: Pixalate looks at how an app behaved before it was delisted when deciding whether its traffic is IVT, and traffic from a delisted app can be labeled with other IVT types first. For the delisted app lists you can block pre-bid, see [Delisted apps (DEFASE)](/data-feeds/defase). ## How to address each type | Reported types | What to do | | ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Datacenter | Use the [data center feeds](/data-feeds/data-center). | | Datacenter Proxy, Proxy, High Risk IP, TOR, Cookie Stuffing, Doorway Site | Use the [IP block lists](/data-feeds/ip-block-lists). For Datacenter Proxy, filter IPs flagged as `datacenterProxy`. For Proxy, also review how proxy services, including SSAI, are implemented. | | High Risk Device ID, Device Id Stuffing | Use the [mobile device ID](/data-feeds/mobile-device-ids) and [CTV device ID](/data-feeds/ctv-device-ids) feeds. | | Auto Reloader, Click Farm, Fast Clicker, Hijacked Session, Smartbot, Display Click Fraud, Video Click Fraud | Use the IP, data center and device ID feeds. | | Display Impression Fraud, Video Impression Fraud | Apply frequency capping, and use the IP and device ID feeds. | | Blank User Agent | Don't bid on inventory where the user-agent field isn't available. | | IAB Crawler, IAB Dummy Bot | Use the [user-agent feed](/data-feeds/user-agents), which contains known crawlers and dummy bots. | | idioBots | Use the user-based feeds (IP, data center or device ID). The user agents may be valid, not crawlers, but spoofed. | | Defased App | Use the [DEFASE lists](/data-feeds/defase). | | High Risk App, High Risk Developer | Use the [High Risk Mobile Apps](/data-feeds/high-risk-mobile-apps) and [High Risk CTV Apps](/data-feeds/high-risk-ctv-apps) lists. | | High Risk Domain, Malware, Phishing | Use the [High Risk Domains](/data-feeds/high-risk-domains) lists, including the malware and phishing list. | | High CTR Traffic | Use the High Risk Domains, High Risk Mobile Apps or IP lists. | | Publisher Fraud | Use publisher-level block lists. | | App Spoofing | This tends to concentrate at the source or seller ID. Find the source with Analytics reports by seller. | | Location Obfuscation | This usually concentrates at the publisher, or publisher and seller ID, level. The device ID and IP block lists can also help. | | Masked IP | Use high-risk publisher-level identifiers. | | Masked iCloud Relay IP | Use the IP block lists, and block sellers where this traffic concentrates. | | IP Obfuscation | This can be caused by cookies being stored at the proxy level. Reject Pixalate cookies set at the proxy level. | | Private IP | This indicates an integration issue, for example in a [server-to-server integration](/analytics/server-to-server). | | Duplicate Impressions, Duplicate Clicks | Check your integration. Contact [support@pixalate.com](mailto:support@pixalate.com) for help. | | SCO Unauthorized Direct Seller | Make sure the publisher's ads.txt or app-ads.txt lists the seller in the first node as DIRECT. If it isn't resolved, optimize away from these nodes: they can also indicate other traffic quality issues, especially at high IVT volumes. | | SCO Unauthorized Direct Seller Publisher Missing | Ask the seller to check they pass the correct information and that their sellers.json identifies their relationship with the publisher as direct. If it isn't resolved, optimize away from these nodes. | | High Risk SCO Node | Use the [SPO feed](/data-feeds/spo) to block problematic nodes pre-bid, and the [SCO reports](/analytics/sco-reports) to find them. | For how often Pixalate's crawler refreshes ads.txt, app-ads.txt and sellers.json data, see the [Analytics FAQ](/analytics/faq#supply-chain-sco-reports). ## Related * [IVT Taxonomy 2.0](/trust/ivt-taxonomy) * [Fraud API risk types and codes](/apis/fraud-api-risk-types) * [Metrics](/analytics/metrics) * [Dimensions](/analytics/dimensions) * [Pre-set reports](/analytics/pre-set-reports) Questions? Contact [support@pixalate.com](mailto:support@pixalate.com).