Mobile device ID feed | Pixalate Docs

The mobile device ID feed lists mobile advertising IDs that have been used for nefarious or malicious activity. Use it to avoid bidding on or serving ads to those devices.

Pixalate builds the feed from data collected through its network of partners that serve in-app ads on mobile worldwide. It covers IDs from all the major mobile device vendors. Each row tells you the type of ID (for example Apple IDFA or Google ADID), the operating system, the type of invalid traffic (IVT) behind it, and a probability from 0.5 to 1 that the device is compromised or performing malicious activity.

What’s in the feed

Spoofed device IDs are included. Spoofed IDs are often short-lived because they get reset quickly, so blocking them has limited effect. Use the IP block lists or app-level block lists to catch these sources too.
Zeroed-out IDFAs (the Do-Not-Track format) aren’t included, because one such value is shared by many users and not all of them generate invalid traffic. To block IVT from users with Do-Not-Track enabled, use other identifiers: the IPv6 block list, which targets individual devices, IPv4 addresses, or app IDs when an app aggregates large volumes of invalid traffic.

At a glance


Update cadence	Hourly
File format	CSV
File name	`DeviceIdBlacklist_YYYYMMDD`
Columns	`deviceID`, `fraudType`, `os`, `idType`, `probability`
File size	Up to 5 GB

The file name carries a date only, not a time or version, and a newer file can reuse an earlier file’s name and replace it. Don’t use the file name to find the newest file; check its last-modified time instead. See Delivery and integration.

Schema

Column	Type	Description
`deviceID`	string	The device ID that has shown suspicious traffic characteristics or is potentially malicious.
`fraudType`	string	The name of the IVT type linked to the device ID. See Reported Invalid Traffic (IVT) Types.
`os`	string	The operating system linked to the device ID, for example `Android`.
`idType`	string	The type of device ID, for example `ADID` or `IDFA`.
`probability`	float	How likely it is that the device ID is linked to this fraud type, from 0.5 to 1. For example, 0.7 means a 70% probability. Higher means riskier.

Example rows (made-up IDs and values):

00000000-0000-4000-8000-000000000001,<fraudType>,Android,ADID,1.0
00000000-0000-4000-8000-000000000002,<fraudType>,Android,ADID,0.78

Choose a probability threshold

Every listed device ID has a probability of at least 0.5, calculated by Pixalate’s machine learning models. You decide where to set your threshold, based on the quality and scale of your supply. As a general guide:

Threshold	What you filter out
Probability = 1	Only the worst offenders (deterministic).
Probability ≥ 0.90	Users that are fraudulent beyond reasonable doubt.
0.75 ≤ probability < 0.90	Users with clear and convincing evidence of fraud.
0.5 ≤ probability < 0.75	Users that are more likely than not to be fraudulent (preponderance of the evidence).

Lowering the threshold can reduce the number of impressions you deliver. Each time you change it, check the effect on impression delivery.

Apply it pre-bid

Load the latest file on the servers that make your bid or serving decisions.
For each mobile request, look up the device ID.
If it’s listed at or above your threshold, don’t bid or serve.

Check for new files

The feed updates hourly. Poll for it like this:

Start checking at the top of the hour.
Check every 15 minutes.
Download only when a new file is available, then stop checking.
Start again at the next hour.

Use the file’s last-modified time, not its name, to tell when a new file has arrived. For access, file locations and how to read the last-modified time, see Delivery and integration.

CTV device ID feed

Device IDs for connected TV inventory, also updated hourly.

IP block lists (IPv4 and IPv6)

Catch IVT sources that reset or hide their device IDs.

Delivery and integration

Access, file locations and polling for every feed.