High Risk Mobile Apps 2.0

High Risk Mobile Apps 2.0 is a daily list of iOS and Android apps for pre-bid blocking. It combines historical invalid traffic (IVT) rates, app store compliance, app-ads.txt compliance, privacy risk and inventory quality signals into one feed. Each app carries one or more risk type codes, so you can see why it’s listed and choose which risks to block.

Apps are listed when app-level blocking is the appropriate control, meaning impression-level filtering can’t reliably separate valid traffic from invalid traffic. Inclusion is deterministic: an app either meets the threshold for a risk type or it doesn’t.

High Risk Mobile Apps 2.0 Standard and Enterprise are currently labeled beta.

Video (2 min): the High Risk Mobile Apps 2.0 risk types and how to block on them.

Standard and Enterprise

The two versions differ in how much detail the riskType column carries.

	Standard	Enterprise
`riskType` when an app has one risk type	The risk type code	The risk type code
`riskType` when an app has several risk types	The string `various`	Every code, comma-separated (for example `highSivt,abandonedApp,missingPrivacyPolicy`)
`probability` column	Yes, always `1`	No
High Risk App data points in Analytics scheduled reports and the Analytics Reports API	No	Yes

Standard keeps the column layout that existing integrations expect. Enterprise lets you build blocking rules on specific combinations of risk types.

Access to Standard requires acceptance of Pixalate’s updated subscription terms. Enterprise requires a subscription upgrade. Contact your Pixalate account manager for either.

Risk types

Risk type	Code	What it means
High GIVT	`highGivt`	General invalid traffic (GIVT) rate above Pixalate’s threshold.
High SIVT	`highSivt`	Sophisticated invalid traffic (SIVT) rate above Pixalate’s threshold.
Missing privacy policy	`missingPrivacyPolicy`	The app has no privacy policy, which Google Play and the Apple App Store require.
Abandoned app	`abandonedApp`	The developer hasn’t updated the app for 3 or more years. It may be unmaintained, insecure or out of line with current app store requirements.
Missing app-ads.txt	`noAdsTxt`	The app generates ad impressions without a valid app-ads.txt file, which indicates unauthorized inventory.
Developer anonymity	`developerAnonymity`	The developer’s contact information is missing or can’t be verified.
VPC bypass risk	`vpcBypass`	A child-directed app transmits IP address or location data without verifiable parental consent (VPC), creating COPPA compliance exposure.
Delisted app	`delistedApp`	The app was removed from its app store but still generates ad traffic.
Made for advertising	`mfaApp`	The app is designed mainly to generate ad impressions rather than to serve users, including apps that use ad stacking and other manipulative ad placement.
Known threat actor	`knownThreatActor`	Pixalate’s fraud investigations confirmed the app as a fraudulent source.
New app	`newApp`	The app was published within the past six months and hasn’t built enough of a track record to be fully evaluated. This flag isn’t based on invalid traffic; it reflects the higher likelihood of future misbehavior from an app with no established history.
VPN app	`vpnApp`	The app is used to hide the device’s IP address and real location.

highGivt and highSivt are the only IVT-based risk types. The others flag app store compliance, developer transparency, privacy and inventory quality risk, so an app on this list isn’t necessarily flagged for IVT.

File format and cadence


Format	CSV
File name	`MobileHighRiskAppSelection_YYYYMMDD`
Update frequency	Daily

For access, delivery and polling, see Delivery and integration.

Schema

Column	Type	Standard	Enterprise	Description
`appId`	string	Yes	Yes	The app’s store identifier, for example `310633997` (iOS) or `com.whatsapp` (Android).
`bundleId`	string	Yes	Yes	The app’s bundle ID. Null when no bundle ID is available.
`osName`	string	Yes	Yes	The operating system: iOS or Android.
`riskType`	string	Yes	Yes	Standard: one risk type code, or `various` when several apply. Enterprise: every applicable code, comma-separated.
`probability`	float	Yes	No	Always `1`.
`appStoreUrl`	string	Yes	Yes	URL of the app’s store listing.
`appStoreName`	string	Yes	Yes	Name of the app store.

Example rows from a Standard file, with placeholder IDs:

appId,bundleId,osName,riskType,probability,appStoreUrl,appStoreName
123456789,com.sampleapp.1,ios,abandonedApp,1,http://itunes.apple.com/lookup?id=123456789,iTunes
234567890,com.sampleapp.2,ios,various,1,http://itunes.apple.com/lookup?id=234567890,iTunes

In an Enterprise file, the second app would list each of its codes instead of various (for example abandonedApp,vpcBypass), and there’s no probability column.

Apply it pre-bid

Match on app ID and OS

Match on appId + osName at minimum. When bundleId is populated, match on appId + bundleId + osName for more precision.

OS matters because the same app usually has different IDs on each platform. Say the app XYZ uses com.company.xyz on iOS and com.xyz.app on Android. If the list contains com.company.xyz with osName Android, that entry is likely a spoofed or deceptively named app. Block com.company.xyz on Android only, so you don’t block real users of the official iOS app.

Filter by risk type

Use riskType to block according to your risk tolerance. For example, you might block apps flagged for highSivt or mfaApp but allow apps flagged only for abandonedApp. If you work directly with a publisher on the list and can see its traffic quality, you can use the codes the same way to decide which risks you accept.

Standard: filter on single-code rows. Rows marked various have more than one risk type, so decide whether to block all of them, or use Enterprise to see the codes.
Enterprise: split riskType on commas and block when any code is in your block set.
Don’t filter on probability. It’s 1 for every row.
Cover every code. Check that your ingestion and filters handle all twelve codes above, including newApp and vpnApp.

Why apps join and leave the list

Apps are evaluated over a rolling look-back window.

IVT-based risk types (highGivt, highSivt): an app ages off when its IVT rates fall below the thresholds over the look-back period.
Compliance-based risk types (for example missingPrivacyPolicy or abandonedApp): an app is removed when it resolves the underlying issue.

An app leaves the list automatically when it no longer meets the criteria for any risk type. It can be added again later, for the same or a different risk type. Pixalate compiles the list from traffic data, third-party data and app store metadata.

How the list relates to IVT reporting

Impressions from apps on this list aren’t automatically classified as IVT in Analytics. This follows the MRC’s Invalid Traffic Detection and Filtration Interim Update Memo, which separates impression-level IVT measurement from app-level risk assessment. To see how much of your traffic comes from listed apps, Analytics reports Traffic from High Risk Apps (%) and a High Risk App (Yes/No) flag in app-level reports.

Moving from 1.0

High Risk Mobile App Lists 1.0 was deprecated on September 23, 2026, and its documentation is retired. If you still have a 1.0 integration, update it for 2.0:

Filter on risk types, not probability. 1.0 scored apps with a probability between 0.5 and 1. In 2.0, probability is always 1.
Replace hard-coded 1.0 risk type names with the 2.0 codes in the risk types table.
New and VPN apps are risk types now. 1.0 offered separate New App and VPN App lists. In 2.0, these apps are in the main list as newApp and vpnApp.

Contact your Pixalate account manager to set up 2.0 access.

High Risk CTV Apps 2.0: the same model for connected TV apps.
Delisted apps (DEFASE): apps removed from Google Play and the Apple App Store, including apps not yet seen with impressions.
MFA data feeds: made-for-advertising risk for mobile apps, CTV apps and websites.
Mobile device ID feed: block invalid devices rather than whole apps.
Enrichment API: look up an individual app’s risk signals.

Questions? Email support@pixalate.com.