> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.pixalate.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server. # High Risk Mobile Apps 2.0 > High Risk Mobile Apps 2.0 (Standard and Enterprise) feed reference. Risk types including newApp and vpnApp, file name, schema, matching rules and how to filter by risk type pre-bid. High Risk Mobile Apps 2.0 is a daily list of iOS and Android apps for pre-bid blocking. It combines historical invalid traffic (IVT) rates, app store compliance, app-ads.txt compliance, privacy risk and inventory quality signals into one feed. Each app carries one or more risk type codes, so you can see why it's listed and choose which risks to block. Apps are listed when app-level blocking is the appropriate control, meaning impression-level filtering can't reliably separate valid traffic from invalid traffic. Inclusion is deterministic: an app either meets the threshold for a risk type or it doesn't. > **Note** > > High Risk Mobile Apps 2.0 Standard and Enterprise are currently labeled beta. *Video (2 min): the High Risk Mobile Apps 2.0 risk types and how to block on them.* ## Standard and Enterprise The two versions differ in how much detail the `riskType` column carries. | | Standard | Enterprise | | --------------------------------------------------------------------------------------------------------------------- | -------------------- | -------------------------------------------------------------------------------------- | | `riskType` when an app has one risk type | The risk type code | The risk type code | | `riskType` when an app has several risk types | The string `various` | Every code, comma-separated (for example `highSivt,abandonedApp,missingPrivacyPolicy`) | | `probability` column | Yes, always `1` | No | | High Risk App data points in Analytics scheduled reports and the [Analytics Reports API](/apis/analytics-reports-api) | No | Yes | Standard keeps the column layout that existing integrations expect. Enterprise lets you build blocking rules on specific combinations of risk types. Access to Standard requires acceptance of Pixalate's updated subscription terms. Enterprise requires a subscription upgrade. Contact your Pixalate account manager for either. ## Risk types | Risk type | Code | What it means | | ---------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | High GIVT | `highGivt` | General invalid traffic (GIVT) rate above Pixalate's threshold. | | High SIVT | `highSivt` | Sophisticated invalid traffic (SIVT) rate above Pixalate's threshold. | | Missing privacy policy | `missingPrivacyPolicy` | The app has no privacy policy, which Google Play and the Apple App Store require. | | Abandoned app | `abandonedApp` | The developer hasn't updated the app for 3 or more years. It may be unmaintained, insecure or out of line with current app store requirements. | | Missing app-ads.txt | `noAdsTxt` | The app generates ad impressions without a valid app-ads.txt file, which indicates unauthorized inventory. | | Developer anonymity | `developerAnonymity` | The developer's contact information is missing or can't be verified. | | VPC bypass risk | `vpcBypass` | A child-directed app transmits IP address or location data without verifiable parental consent (VPC), creating COPPA compliance exposure. | | Delisted app | `delistedApp` | The app was removed from its app store but still generates ad traffic. | | Made for advertising | `mfaApp` | The app is designed mainly to generate ad impressions rather than to serve users, including apps that use ad stacking and other manipulative ad placement. | | Known threat actor | `knownThreatActor` | Pixalate's fraud investigations confirmed the app as a fraudulent source. | | New app | `newApp` | The app was published within the past six months and hasn't built enough of a track record to be fully evaluated. This flag isn't based on invalid traffic; it reflects the higher likelihood of future misbehavior from an app with no established history. | | VPN app | `vpnApp` | The app is used to hide the device's IP address and real location. | `highGivt` and `highSivt` are the only IVT-based risk types. The others flag app store compliance, developer transparency, privacy and inventory quality risk, so an app on this list isn't necessarily flagged for IVT. ## File format and cadence | | | | ---------------- | ------------------------------------- | | Format | CSV | | File name | `MobileHighRiskAppSelection_YYYYMMDD` | | Update frequency | Daily | For access, delivery and polling, see [Delivery and integration](/data-feeds/delivery). ## Schema | Column | Type | Standard | Enterprise | Description | | -------------- | ------ | -------- | ---------- | ------------------------------------------------------------------------------------------------------------------ | | `appId` | string | Yes | Yes | The app's store identifier, for example `310633997` (iOS) or `com.whatsapp` (Android). | | `bundleId` | string | Yes | Yes | The app's bundle ID. Null when no bundle ID is available. | | `osName` | string | Yes | Yes | The operating system: iOS or Android. | | `riskType` | string | Yes | Yes | Standard: one risk type code, or `various` when several apply. Enterprise: every applicable code, comma-separated. | | `probability` | float | Yes | No | Always `1`. | | `appStoreUrl` | string | Yes | Yes | URL of the app's store listing. | | `appStoreName` | string | Yes | Yes | Name of the app store. | Example rows from a Standard file, with placeholder IDs: ```csv appId,bundleId,osName,riskType,probability,appStoreUrl,appStoreName 123456789,com.sampleapp.1,ios,abandonedApp,1,http://itunes.apple.com/lookup?id=123456789,iTunes 234567890,com.sampleapp.2,ios,various,1,http://itunes.apple.com/lookup?id=234567890,iTunes ``` In an Enterprise file, the second app would list each of its codes instead of `various` (for example `abandonedApp,vpcBypass`), and there's no `probability` column. ## Apply it pre-bid ### Match on app ID and OS Match on `appId` + `osName` at minimum. When `bundleId` is populated, match on `appId` + `bundleId` + `osName` for more precision. OS matters because the same app usually has different IDs on each platform. Say the app XYZ uses `com.company.xyz` on iOS and `com.xyz.app` on Android. If the list contains `com.company.xyz` with `osName` Android, that entry is likely a spoofed or deceptively named app. Block `com.company.xyz` on Android only, so you don't block real users of the official iOS app. ### Filter by risk type Use `riskType` to block according to your risk tolerance. For example, you might block apps flagged for `highSivt` or `mfaApp` but allow apps flagged only for `abandonedApp`. If you work directly with a publisher on the list and can see its traffic quality, you can use the codes the same way to decide which risks you accept. * **Standard:** filter on single-code rows. Rows marked `various` have more than one risk type, so decide whether to block all of them, or use Enterprise to see the codes. * **Enterprise:** split `riskType` on commas and block when any code is in your block set. * **Don't filter on `probability`.** It's `1` for every row. * **Cover every code.** Check that your ingestion and filters handle all twelve codes above, including `newApp` and `vpnApp`. ## Why apps join and leave the list Apps are evaluated over a rolling look-back window. * **IVT-based risk types** (`highGivt`, `highSivt`): an app ages off when its IVT rates fall below the thresholds over the look-back period. * **Compliance-based risk types** (for example `missingPrivacyPolicy` or `abandonedApp`): an app is removed when it resolves the underlying issue. An app leaves the list automatically when it no longer meets the criteria for any risk type. It can be added again later, for the same or a different risk type. Pixalate compiles the list from traffic data, third-party data and app store metadata. ## How the list relates to IVT reporting Impressions from apps on this list aren't automatically classified as IVT in Analytics. This follows the MRC's Invalid Traffic Detection and Filtration Interim Update Memo, which separates impression-level IVT measurement from app-level risk assessment. To see how much of your traffic comes from listed apps, Analytics reports **Traffic from High Risk Apps (%)** and a **High Risk App (Yes/No)** flag in app-level reports. ## Moving from 1.0 High Risk Mobile App Lists 1.0 was deprecated on September 23, 2026, and its documentation is retired. If you still have a 1.0 integration, update it for 2.0: * **Filter on risk types, not probability.** 1.0 scored apps with a probability between 0.5 and 1. In 2.0, `probability` is always `1`. * **Replace hard-coded 1.0 risk type names** with the 2.0 codes in the [risk types](#risk-types) table. * **New and VPN apps are risk types now.** 1.0 offered separate New App and VPN App lists. In 2.0, these apps are in the main list as `newApp` and `vpnApp`. Contact your Pixalate account manager to set up 2.0 access. ## Related feeds * [High Risk CTV Apps 2.0](/data-feeds/high-risk-ctv-apps): the same model for connected TV apps. * [Delisted apps (DEFASE)](/data-feeds/defase): apps removed from Google Play and the Apple App Store, including apps not yet seen with impressions. * [MFA data feeds](/data-feeds/mfa): made-for-advertising risk for mobile apps, CTV apps and websites. * [Mobile device ID feed](/data-feeds/mobile-device-ids): block invalid devices rather than whole apps. * [Enrichment API](/apis/enrichment-api): look up an individual app's risk signals. Questions? Email [support@pixalate.com](mailto:support@pixalate.com).