> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pixalate.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server.

# Mobile device ID feed

> Pixalate's hourly mobile device ID block list, with file name, schema, probability thresholds, polling and how to apply it pre-bid.

The mobile device ID feed lists mobile advertising IDs that have been used for nefarious or malicious activity. Use it to avoid bidding on or serving ads to those devices.

Pixalate builds the feed from data collected through its network of partners that serve in-app ads on mobile worldwide. It covers IDs from all the major mobile device vendors. Each row tells you the type of ID (for example Apple IDFA or Google ADID), the operating system, the type of invalid traffic (IVT) behind it, and a probability from 0.5 to 1 that the device is compromised or performing malicious activity.

## What's in the feed

* **Spoofed device IDs** are included. Spoofed IDs are often short-lived because they get reset quickly, so blocking them has limited effect. Use the [IP block lists](/data-feeds/ip-block-lists) or app-level block lists to catch these sources too.
* **Zeroed-out IDFAs** (the Do-Not-Track format) aren't included, because one such value is shared by many users and not all of them generate invalid traffic. To block IVT from users with Do-Not-Track enabled, use other identifiers: the IPv6 block list, which targets individual devices, IPv4 addresses, or app IDs when an app aggregates large volumes of invalid traffic.

## At a glance

|                |                                                        |
| -------------- | ------------------------------------------------------ |
| Update cadence | Hourly                                                 |
| File format    | CSV                                                    |
| File name      | `DeviceIdBlacklist_YYYYMMDD`                           |
| Columns        | `deviceID`, `fraudType`, `os`, `idType`, `probability` |
| File size      | Up to 5 GB                                             |

The file name carries a date only, not a time or version, and a newer file can reuse an earlier file's name and replace it. Don't use the file name to find the newest file; check its last-modified time instead. See [Delivery and integration](/data-feeds/delivery).

## Schema

| Column        | Type   | Description                                                                                                                                      |
| ------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `deviceID`    | string | The device ID that has shown suspicious traffic characteristics or is potentially malicious.                                                     |
| `fraudType`   | string | The name of the IVT type linked to the device ID. See [Reported Invalid Traffic (IVT) Types](/analytics/ivt-types).                              |
| `os`          | string | The operating system linked to the device ID, for example `Android`.                                                                             |
| `idType`      | string | The type of device ID, for example `ADID` or `IDFA`.                                                                                             |
| `probability` | float  | How likely it is that the device ID is linked to this fraud type, from 0.5 to 1. For example, 0.7 means a 70% probability. Higher means riskier. |

Example rows (made-up IDs and values):

```csv
00000000-0000-4000-8000-000000000001,<fraudType>,Android,ADID,1.0
00000000-0000-4000-8000-000000000002,<fraudType>,Android,ADID,0.78
```

## Choose a probability threshold

Every listed device ID has a probability of at least 0.5, calculated by Pixalate's machine learning models. You decide where to set your threshold, based on the quality and scale of your supply. As a general guide:

| Threshold                  | What you filter out                                                                   |
| -------------------------- | ------------------------------------------------------------------------------------- |
| Probability = 1            | Only the worst offenders (deterministic).                                             |
| Probability ≥ 0.90         | Users that are fraudulent beyond reasonable doubt.                                    |
| 0.75 ≤ probability \< 0.90 | Users with clear and convincing evidence of fraud.                                    |
| 0.5 ≤ probability \< 0.75  | Users that are more likely than not to be fraudulent (preponderance of the evidence). |

Lowering the threshold can reduce the number of impressions you deliver. Each time you change it, check the effect on impression delivery.

## Apply it pre-bid

1. Load the latest file on the servers that make your bid or serving decisions.
2. For each mobile request, look up the device ID.
3. If it's listed at or above your threshold, don't bid or serve.

## Check for new files

The feed updates hourly. Poll for it like this:

* Start checking at the top of the hour.
* Check every 15 minutes.
* Download only when a new file is available, then stop checking.
* Start again at the next hour.

Use the file's last-modified time, not its name, to tell when a new file has arrived. For access, file locations and how to read the last-modified time, see [Delivery and integration](/data-feeds/delivery).

## Related

#### [CTV device ID feed](/data-feeds/ctv-device-ids)

Device IDs for connected TV inventory, also updated hourly.

#### [IP block lists (IPv4 and IPv6)](/data-feeds/ip-block-lists)

Catch IVT sources that reset or hide their device IDs.

#### [Delivery and integration](/data-feeds/delivery)

Access, file locations and polling for every feed.