Risk types and codes | Pixalate Docs

Fraud API v3 returns a riskTypes field next to probability. Each entry is a four-digit integer code for a type of invalid traffic (IVT) in Pixalate’s IVT Taxonomy 2.0. The codes tell you why an IP address, device ID or user agent is flagged, and you can use them in blocking rules.

{
  "probability": 0.92,
  "riskTypes": [2502, 2201]
}

For the request itself, see the Fraud API guide and the API reference.

How riskTypes behaves

It lists the risk types associated with all the values you sent (ip, deviceId, userAgent) during the look-back period, so it can contain more than one code.
It’s null when probability is 0 (not flagged) or -1 (whitelisted).
It’s null when a value is flagged but no risk type is available for it.
It’s never an empty array, and each code appears at most once.

Code format

Each code follows the format T C NN:

Part	Meaning	Values
T	IVT class	`1` = GIVT (general invalid traffic), `2` = SIVT (sophisticated invalid traffic)
C	Category within the class	See the tables below
NN	Type within the category	`01`, `02`, …

For example, 2201 is Invalid Proxy Traffic: class 2 (SIVT), category 2 (False Representation), type 01.

Block by class, category or type

Because the code is structured, you can match at any level:

Rule	Matches	Check
All SIVT	`2xxx`	`code // 1000 == 2`
One category, such as Known Dangerous Sources	`25xx`	`code // 100 == 25`
One type, such as Known Dangerous or Fraudulent IPv4 Addresses	`2502`	`code == 2502`

You can use these rules on their own or together with a probability threshold. See Decide when to block.

Code prefix	Class	Category
`11xx`	GIVT	Irregular Pattern
`12xx`	GIVT	Known Crawlers
`13xx`	GIVT	Data Center
`14xx`	GIVT	Invalid Placements
`21xx`	SIVT	Automated Browsing
`22xx`	SIVT	False Representation
`23xx`	SIVT	Incentivized Human Invalid Activity
`24xx`	SIVT	Misleading User Interface
`25xx`	SIVT	Known Dangerous Sources
`26xx`	SIVT	Supply Chain

Codes

The tables list every type in IVT Taxonomy 2.0. Types marked Upcoming are defined in the taxonomy but aren’t live yet. A lookup returns only the codes associated with the values you sent.

GIVT: Irregular Pattern (11xx)

Code	Name	Definition
`1101`	Repeat Transactions	Impressions with the same ID and attributes generated multiple times; usually an integration issue.
`1102`	Repeat Click Transactions	Clicks with the same ID and attributes generated multiple times; usually an integration issue.
`1103`	Spoofed User Agents	Traffic from a browser identifier that presents more than two user agents within 24 hours.
`1104`	Fraudulent User Agents	Traffic from user agents that match no known browser or app.
`1105`	Missing User Agents	Impressions whose request carries no user agent.
`1106`	Auto Refresh Fraud	Impressions from a single source arriving at intervals too regular to be human.
`1107`	Reserved Network IPs	Impressions whose IP address is in private or reserved network space.
`1108`	Fraudulent Clicks	Clicks recorded too soon after their impression for a person to have reacted.
`1109`	Invalid Prefetch Traffic	Impressions from requests self-declared as prefetch or preview.
`1110`	Non-Rendering Device Traffic	Traffic from devices that can’t render ad content.

GIVT: Known Crawlers (12xx)

Code	Name	Definition
`1201`	IAB Crawlers	Traffic from user agents on the IAB/ABC International Spiders & Bots List.
`1202`	Declared AI Agents (Upcoming)	Traffic from AI agents and LLM crawlers that self-identify in the user agent.

GIVT: Data Center (13xx)

Code	Name	Definition
`1301`	Data Center Traffic	Traffic from known data centers and hosting providers that generate invalid traffic, excluding legitimate human activity routed through VPNs or virtual machines.

GIVT: Invalid Placements (14xx)

Code	Name	Definition
`1401`	Invalid Placement Traffic	Impressions served to illogical placement sizes, such as 0x0 or 1x1.

SIVT: Automated Browsing (21xx)

Code	Name	Definition
`2101`	Infected Device Traffic	Impressions generated by a single device at a statistically inflated rate.
`2102`	Infected Device Sessions	Traffic from devices with a statistically inflated number of sessions per hour.
`2103`	Headless Browsers or Emulators (Upcoming)	Traffic from headless browsers or emulated devices posing as physical hardware.
`2104`	Known Automation Systems (Upcoming)	Traffic from CTV devices whose behavior matches a device farm.

SIVT: False Representation (22xx)

Code	Name	Definition
`2201`	Invalid Proxy Traffic	Traffic from intermediary proxies that inflate traffic counts, pass invalid traffic, or break protocol.
`2202`	Data Center Proxy Traffic	Traffic from proxies on data center or hosting IPs that inflate counts, pass invalid traffic, or break protocol, excluding validated SSAI.
`2203`	IP Address Mismatch	Impressions whose declared IP and ISP differ from the IP and ISP Pixalate detects.
`2204`	Spoofed iCloud Private Relay	Impressions whose declared IP claims iCloud Private Relay but differs from the IP and ISP Pixalate detects.
`2205`	Fraudulent XFF	Impressions whose X-Forwarded-For header reports a user IP that differs from the IP the ad renders to.
`2206`	Fraudulent Device IDs	Traffic from device IDs seen across a statistically inflated number of IPs, apps, platforms, or locations.
`2207`	App Misrepresentation	Impressions whose declared bundle ID differs from the app detected by Pixalate.
`2208`	OS Misrepresentation	Impressions whose declared operating system differs from the OS detected by Pixalate.
`2209`	Domain Misrepresentation	Impressions whose declared domain differs from the domain detected by Pixalate.
`2210`	User Agent Bundle ID Device Mismatch	Impressions whose declared operating system is inconsistent with the bundle ID format, user agent, or device.
`2211`	Falsified Geolocation	Impressions whose declared GPS location deviates significantly from the IP reverse location.
`2212`	Cookie Stuffing	Traffic from a single browser identifier recycled across a statistically inflated number of IP addresses.
`2213`	Spoofed Referrer	Traffic from a single source reaching one domain through a statistically inflated number of referrer domains.
`2214`	Reserved (Upcoming)	Not yet live.
`2215`	SDK Spoofing (Upcoming)	Impressions whose ad request claims an SDK that didn’t initiate the transaction.
`2216`	Reserved (Upcoming)	Not yet live.

SIVT: Incentivized Human Invalid Activity (23xx)

Code	Name	Definition
`2301`	Click Farms	Traffic from IPs where a statistically inflated number of devices generate coordinated clicks.
`2302`	Infected Device Clicks	Clicks generated by one device at a statistically inflated rate.
`2303`	Falsified Clicks (Upcoming)	Clicks recorded after an app download has begun but before the install completes.

SIVT: Misleading User Interface (24xx)

Code	Name	Definition
`2401`	Obfuscated Ad Serving	Traffic from domains or apps Pixalate identified for stacked, hidden, or invisible ad placements.

SIVT: Known Dangerous Sources (25xx)

Code	Name	Definition
`2501`	Known Dangerous or Fraudulent Devices	Traffic from device IDs Pixalate identified as dangerous or fraudulent.
`2502`	Known Dangerous or Fraudulent IPv4 Addresses	Traffic from IPv4 addresses Pixalate identified as dangerous or fraudulent.
`2503`	Known Dangerous or Fraudulent IPv6 Addresses (Upcoming)	Traffic from IPv6 addresses Pixalate identified as dangerous or fraudulent.
`2504`	Known Dangerous or Fraudulent Domains	Traffic from domains Pixalate identified as dangerous or fraudulent.
`2505`	Defased Apps	Traffic from apps delisted from their respective app stores but still serving ads.
`2506`	Adware, Malware or Phishing	Traffic from domains associated with adware, malware, or phishing.

SIVT: Supply Chain (26xx)

Code	Name	Definition
`2601`	SCO Publisher is Null	Impressions whose first SupplyChain node doesn’t identify as a publisher.
`2602`	SCO Unauthorized Sellers	Impressions whose first SupplyChain node isn’t listed as DIRECT in ads.txt or app-ads.txt.

Handle new codes

Pixalate may add types to the taxonomy. Write your rules so that an unfamiliar code doesn’t break your integration: match on the class or category prefix where you can, and log codes you don’t recognize.