> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pixalate.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server.

# App spoofing

> App spoofing in mobile and connected TV (CTV) apps. How Pixalate detects mismatched bundle IDs and user agents, where spoofing shows in the Media Ratings Terminal (MRT) and the Enrichment API, and how to reduce your exposure.

**App spoofing** is a form of invalid traffic (IVT) in which traffic from one app is misrepresented as traffic from another, usually to make the inventory look more valuable. It affects both mobile apps and connected TV (CTV) apps.

Spoofed traffic can come from:

* real devices used as a botnet
* real devices that are unaware of spoofing happening in the background
* artificial impressions generated by fake devices

## How Pixalate detects app spoofing

Pixalate flags app spoofing when the app identifier reported in the bid request, such as the bundle ID, doesn't match the characteristics of the app that Pixalate detects directly.

Pixalate's IVT detection technology identifies the true bundle ID, user agent and other properties of an impression, even when the bidstream declares something else. When these don't match, the impression is flagged as IVT with the `AppSpoofing` SIVT type. Spoofing can also correlate with heavily overlapping traffic and other measured signals.

Pixalate is MRC-accredited for sophisticated invalid traffic (SIVT) detection and filtration. For the exact scope of the accreditation, see [MRC accreditation](/trust/mrc-accreditation). For every IVT type Pixalate reports, see the [IVT taxonomy](/trust/ivt-taxonomy).

> **Note**
>
> On CTV, legitimate apps often use several bundle IDs, so a bundle ID that doesn't match the store's ID isn't necessarily spoofing. Pixalate maps bundle IDs to app store IDs so that legitimate traffic isn't wrongly flagged. See [CTV bundle IDs](/mrt/ctv-bundle-ids).

## Where to see app spoofing in the MRT

An app's Insight page in the Media Ratings Terminal (MRT) shows the breakdown of the bundle IDs Pixalate detected for that app across its global data. Use it to separate traffic that's misrepresented as this app (the `AppSpoofing` SIVT type) from other IVT on the app when it isn't misrepresented.

On both mobile and CTV app reports, **Potential Bundle Id Spoofing Risk** appears under **Traffic Trends** > **Traffic Overview**.

![Potential Bundle Id Spoofing Risk](/_fern-img/a19788d33267ae4f315d1ce74995d5256e67322caf3a73877f7a145ecb26623c.webp)

CTV app reports also have an **App Spoofing** section. Its Spoofing Overview shows **Apparent Victim of Spoofing** and **Potential Bundle Id Spoofing Risk**, and its tables show user agent, device and bundle ID obfuscation: the declared bundle ID, the bundle ID Pixalate detected, and the share of voice. An **Include Spoofing** toggle at the top of CTV app reports includes or leaves out spoofed inventory.

The spoofing labels are:

| Label                             | What it means                                                                                                                                             |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| App Spoofing                      | Traffic where the app identifier (for example, the bundle ID) reported to the exchange doesn't match the characteristics of the app detected by Pixalate. |
| Apparent Victim of Spoofing       | Whether a significant number of impressions detected for the app may be misrepresented in advertising transactions.                                       |
| Potential Bundle Id Spoofing Risk | The risk that the app is misrepresented in advertising transactions and ads are delivered to a different app or site.                                     |
| Impression Volume Obfuscation     | The app's traffic is associated with potential background activity that fires multiple impressions at once.                                               |
| Device Obfuscation                | The app's traffic comes from obfuscated device identifiers.                                                                                               |
| User Agent Obfuscation            | The user agent detected by Pixalate doesn't match the user agent passed in the bid request.                                                               |

For the full list of labels, see the [Glossary](/mrt/glossary).

For CTV apps, Pixalate also reports a spoofing percentage for each seller of the app, based on the app's app-ads.txt file. It's the share of spoofed inventory for that app that a buyer may encounter when buying from that seller. It applies to that seller and that app only, not to the seller overall. In the Enrichment API, it's `authorizedSellers[].spoofingRate`.

## App spoofing in the Enrichment API

For CTV apps, the Enrichment API returns spoofing data in the `appSpoofing` widget, including whether the app is a victim of spoofing, its spoofing risk, and the declared and detected bundle IDs by fraud type. The `includeSpoofing` parameter works like the **Include Spoofing** toggle: it's on by default, and `includeSpoofing=false` leaves spoofed traffic out of the IVT figures. See [`appSpoofing`](/apis/enrichment-api-ctv-fields#appspoofing) in the CTV field reference.

## Pixalate's app spoofing reports

Pixalate publishes app spoofing reports at [pixalate.com/reports](https://www.pixalate.com/reports). They list apps whose app spoofing rate, as measured by Pixalate, meets a materiality threshold, so they focus on apps significantly affected by spoofing. The filtered list is ranked by the total number of app spoofing impressions measured for each app.

To keep the data accurate, Pixalate:

1. manually reviews apps with high app spoofing rates, to confirm that the automated detection is finding clear IVT and not tag implementation errors
2. reviews apps whose spoofing involves mismatched bundle IDs or unusual user agents, to confirm the mismatch
3. cross-checks the data across Pixalate's global data, to cancel out bias from any single source

## How to reduce your exposure

* **Validate app-ads.txt and sellers.json strictly**, not just for presence, so you buy only from sellers authorized for the app.
* **Measure your exposure** with Pixalate's [Analytics](/analytics/overview) and the MRT, and block high-risk supply with Pixalate's [pre-bid data feeds](/data-feeds/overview).

For more background, read Pixalate's blog post on [mobile app laundering](https://www.pixalate.com/blog/mobile-ad-fraud-what-is-mobile-app-laundering-sivt).

## Related

#### [CTV bundle IDs](/mrt/ctv-bundle-ids)

Why CTV bundle IDs are unreliable, and how Pixalate maps them.

#### [Glossary](/mrt/glossary)

Definitions for every label and tooltip in the MRT.

#### [IVT taxonomy](/trust/ivt-taxonomy)

Every IVT type Pixalate measures.

Questions? Email [support@pixalate.com](mailto:support@pixalate.com).