> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pixalate.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server.

# Risk types and codes

> Reference for the risk type codes that Pixalate's Fraud API v3 returns in riskTypes, with the code format, IVT classes, categories and types.

Fraud API v3 returns a `riskTypes` field next to `probability`. Each entry is a four-digit integer code for a type of invalid traffic (IVT) in Pixalate's [IVT Taxonomy 2.0](/trust/ivt-taxonomy). The codes tell you why an IP address, device ID or user agent is flagged, and you can use them in blocking rules.

```json
{
  "probability": 0.92,
  "riskTypes": [2502, 2201]
}
```

For the request itself, see the [Fraud API guide](/apis/fraud-api) and the [API reference](/api-reference/fraud/get-fraud).

## How riskTypes behaves

* It lists the risk types associated with all the values you sent (`ip`, `deviceId`, `userAgent`) during the look-back period, so it can contain more than one code.
* It's `null` when `probability` is `0` (not flagged) or `-1` (whitelisted).
* It's `null` when a value is flagged but no risk type is available for it.
* It's never an empty array, and each code appears at most once.

## Code format

Each code follows the format **T C NN**:

| Part | Meaning                   | Values                                                                           |
| ---- | ------------------------- | -------------------------------------------------------------------------------- |
| T    | IVT class                 | `1` = GIVT (general invalid traffic), `2` = SIVT (sophisticated invalid traffic) |
| C    | Category within the class | See the tables below                                                             |
| NN   | Type within the category  | `01`, `02`, …                                                                    |

For example, `2201` is Invalid Proxy Traffic: class `2` (SIVT), category `2` (False Representation), type `01`.

## Block by class, category or type

Because the code is structured, you can match at any level:

| Rule                                                           | Matches | Check               |
| -------------------------------------------------------------- | ------- | ------------------- |
| All SIVT                                                       | `2xxx`  | `code // 1000 == 2` |
| One category, such as Known Dangerous Sources                  | `25xx`  | `code // 100 == 25` |
| One type, such as Known Dangerous or Fraudulent IPv4 Addresses | `2502`  | `code == 2502`      |

You can use these rules on their own or together with a probability threshold. See [Decide when to block](/apis/fraud-api#decide-when-to-block).

## Categories

| Code prefix | Class | Category                            |
| ----------- | ----- | ----------------------------------- |
| `11xx`      | GIVT  | Irregular Pattern                   |
| `12xx`      | GIVT  | Known Crawlers                      |
| `13xx`      | GIVT  | Data Center                         |
| `14xx`      | GIVT  | Invalid Placements                  |
| `21xx`      | SIVT  | Automated Browsing                  |
| `22xx`      | SIVT  | False Representation                |
| `23xx`      | SIVT  | Incentivized Human Invalid Activity |
| `24xx`      | SIVT  | Misleading User Interface           |
| `25xx`      | SIVT  | Known Dangerous Sources             |
| `26xx`      | SIVT  | Supply Chain                        |

## Codes

The tables list every type in IVT Taxonomy 2.0. Types marked *Upcoming* are defined in the taxonomy but aren't live yet. A lookup returns only the codes associated with the values you sent.

### GIVT: Irregular Pattern (11xx)

| Code   | Name                         | Definition                                                                                          |
| ------ | ---------------------------- | --------------------------------------------------------------------------------------------------- |
| `1101` | Repeat Transactions          | Impressions with the same ID and attributes generated multiple times; usually an integration issue. |
| `1102` | Repeat Click Transactions    | Clicks with the same ID and attributes generated multiple times; usually an integration issue.      |
| `1103` | Spoofed User Agents          | Traffic from a browser identifier that presents more than two user agents within 24 hours.          |
| `1104` | Fraudulent User Agents       | Traffic from user agents that match no known browser or app.                                        |
| `1105` | Missing User Agents          | Impressions whose request carries no user agent.                                                    |
| `1106` | Auto Refresh Fraud           | Impressions from a single source arriving at intervals too regular to be human.                     |
| `1107` | Reserved Network IPs         | Impressions whose IP address is in private or reserved network space.                               |
| `1108` | Fraudulent Clicks            | Clicks recorded too soon after their impression for a person to have reacted.                       |
| `1109` | Invalid Prefetch Traffic     | Impressions from requests self-declared as prefetch or preview.                                     |
| `1110` | Non-Rendering Device Traffic | Traffic from devices that can't render ad content.                                                  |

### GIVT: Known Crawlers (12xx)

| Code   | Name                          | Definition                                                                    |
| ------ | ----------------------------- | ----------------------------------------------------------------------------- |
| `1201` | IAB Crawlers                  | Traffic from user agents on the IAB/ABC International Spiders & Bots List.    |
| `1202` | Declared AI Agents (Upcoming) | Traffic from AI agents and LLM crawlers that self-identify in the user agent. |

### GIVT: Data Center (13xx)

| Code   | Name                | Definition                                                                                                                                                        |
| ------ | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `1301` | Data Center Traffic | Traffic from known data centers and hosting providers that generate invalid traffic, excluding legitimate human activity routed through VPNs or virtual machines. |

### GIVT: Invalid Placements (14xx)

| Code   | Name                      | Definition                                                           |
| ------ | ------------------------- | -------------------------------------------------------------------- |
| `1401` | Invalid Placement Traffic | Impressions served to illogical placement sizes, such as 0x0 or 1x1. |

### SIVT: Automated Browsing (21xx)

| Code   | Name                                      | Definition                                                                      |
| ------ | ----------------------------------------- | ------------------------------------------------------------------------------- |
| `2101` | Infected Device Traffic                   | Impressions generated by a single device at a statistically inflated rate.      |
| `2102` | Infected Device Sessions                  | Traffic from devices with a statistically inflated number of sessions per hour. |
| `2103` | Headless Browsers or Emulators (Upcoming) | Traffic from headless browsers or emulated devices posing as physical hardware. |
| `2104` | Known Automation Systems (Upcoming)       | Traffic from CTV devices whose behavior matches a device farm.                  |

### SIVT: False Representation (22xx)

| Code   | Name                                 | Definition                                                                                                                                 |
| ------ | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
| `2201` | Invalid Proxy Traffic                | Traffic from intermediary proxies that inflate traffic counts, pass invalid traffic, or break protocol.                                    |
| `2202` | Data Center Proxy Traffic            | Traffic from proxies on data center or hosting IPs that inflate counts, pass invalid traffic, or break protocol, excluding validated SSAI. |
| `2203` | IP Address Mismatch                  | Impressions whose declared IP and ISP differ from the IP and ISP Pixalate detects.                                                         |
| `2204` | Spoofed iCloud Private Relay         | Impressions whose declared IP claims iCloud Private Relay but differs from the IP and ISP Pixalate detects.                                |
| `2205` | Fraudulent XFF                       | Impressions whose X-Forwarded-For header reports a user IP that differs from the IP the ad renders to.                                     |
| `2206` | Fraudulent Device IDs                | Traffic from device IDs seen across a statistically inflated number of IPs, apps, platforms, or locations.                                 |
| `2207` | App Misrepresentation                | Impressions whose declared bundle ID differs from the app detected by Pixalate.                                                            |
| `2208` | OS Misrepresentation                 | Impressions whose declared operating system differs from the OS detected by Pixalate.                                                      |
| `2209` | Domain Misrepresentation             | Impressions whose declared domain differs from the domain detected by Pixalate.                                                            |
| `2210` | User Agent Bundle ID Device Mismatch | Impressions whose declared operating system is inconsistent with the bundle ID format, user agent, or device.                              |
| `2211` | Falsified Geolocation                | Impressions whose declared GPS location deviates significantly from the IP reverse location.                                               |
| `2212` | Cookie Stuffing                      | Traffic from a single browser identifier recycled across a statistically inflated number of IP addresses.                                  |
| `2213` | Spoofed Referrer                     | Traffic from a single source reaching one domain through a statistically inflated number of referrer domains.                              |
| `2214` | Reserved (Upcoming)                  | Not yet live.                                                                                                                              |
| `2215` | SDK Spoofing (Upcoming)              | Impressions whose ad request claims an SDK that didn't initiate the transaction.                                                           |
| `2216` | Reserved (Upcoming)                  | Not yet live.                                                                                                                              |

### SIVT: Incentivized Human Invalid Activity (23xx)

| Code   | Name                        | Definition                                                                                     |
| ------ | --------------------------- | ---------------------------------------------------------------------------------------------- |
| `2301` | Click Farms                 | Traffic from IPs where a statistically inflated number of devices generate coordinated clicks. |
| `2302` | Infected Device Clicks      | Clicks generated by one device at a statistically inflated rate.                               |
| `2303` | Falsified Clicks (Upcoming) | Clicks recorded after an app download has begun but before the install completes.              |

### SIVT: Misleading User Interface (24xx)

| Code   | Name                  | Definition                                                                                        |
| ------ | --------------------- | ------------------------------------------------------------------------------------------------- |
| `2401` | Obfuscated Ad Serving | Traffic from domains or apps Pixalate identified for stacked, hidden, or invisible ad placements. |

### SIVT: Known Dangerous Sources (25xx)

| Code   | Name                                                    | Definition                                                                         |
| ------ | ------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| `2501` | Known Dangerous or Fraudulent Devices                   | Traffic from device IDs Pixalate identified as dangerous or fraudulent.            |
| `2502` | Known Dangerous or Fraudulent IPv4 Addresses            | Traffic from IPv4 addresses Pixalate identified as dangerous or fraudulent.        |
| `2503` | Known Dangerous or Fraudulent IPv6 Addresses (Upcoming) | Traffic from IPv6 addresses Pixalate identified as dangerous or fraudulent.        |
| `2504` | Known Dangerous or Fraudulent Domains                   | Traffic from domains Pixalate identified as dangerous or fraudulent.               |
| `2505` | Defased Apps                                            | Traffic from apps delisted from their respective app stores but still serving ads. |
| `2506` | Adware, Malware or Phishing                             | Traffic from domains associated with adware, malware, or phishing.                 |

### SIVT: Supply Chain (26xx)

| Code   | Name                     | Definition                                                                                 |
| ------ | ------------------------ | ------------------------------------------------------------------------------------------ |
| `2601` | SCO Publisher is Null    | Impressions whose first SupplyChain node doesn't identify as a publisher.                  |
| `2602` | SCO Unauthorized Sellers | Impressions whose first SupplyChain node isn't listed as DIRECT in ads.txt or app-ads.txt. |

## Handle new codes

Pixalate may add types to the taxonomy. Write your rules so that an unfamiliar code doesn't break your integration: match on the class or category prefix where you can, and log codes you don't recognize.

## Related

* [Fraud API guide](/apis/fraud-api)
* [Fraud API v3 reference](/api-reference/fraud/get-fraud)
* [Migrate from v2 to v3](/apis/fraud-api-v2-to-v3)