IVT Taxonomy 2.0

Pixalate detects invalid traffic (IVT) using various ad fraud signals and detection techniques, and classifies each invalid impression or click into one of 46 distinct IVT types. Each type sits under one of 4 general invalid traffic (GIVT) categories or 6 sophisticated invalid traffic (SIVT) categories, in alignment with the MRC IVT Guidelines and the TAG IVT Taxonomy v2.0.

This is the current taxonomy. The previous version, IVT Taxonomy 1.0, used named types without codes.

GIVT and SIVT

General invalid traffic (GIVT) is identified through routine filtration, such as blocklists and standard parameter checks. It includes self-declared bots and crawlers, known data center traffic, and duplicate or malformed transactions.

Sophisticated invalid traffic (SIVT) is more complex to detect, requiring advanced behavioral analysis, statistical modeling, machine learning, multi-signal corroboration, or human review. It includes automated devices masquerading as legitimate users, falsified app, device, or location data, invalid proxy traffic, and incentivized human activity.

Environments

Pixalate analyzes ad traffic across mobile in-app, connected TV (CTV) and web environments. The Environment column in each table uses these values:

Known dangerous or fraudulent sources

Beyond impression and click fraud, Pixalate also identifies high-risk entities based on their associated IVT and compliance risks:

• IP addresses (IPv4 and IPv6)
• Device IDs (mobile and CTV)
• App and bundle IDs (mobile and CTV)
• Domains (web)
• Supply chains

Code format

Each IVT type has a four-digit code in the format T C NN:

For example, 2201 is Invalid Proxy Traffic: class 2 (SIVT), category 2 (False Representation), type 01.

The Fraud API returns these codes in its riskTypes field. See Risk types and codes for how to read and block on them. For the IVT types shown in Analytics reports, see Reported IVT types.

Types marked (Upcoming) are defined in the taxonomy but aren’t live yet.

Categories

GIVT categories

Irregular Pattern (11xx)

General invalid traffic identified by MRC’s activity-based techniques applied to transaction-level data and parameters: speed of transactions (such as a click less than one second after its impression), repeat transactions, interval testing (machine-regular periodicity), outlier identification, missing values or user agents, transaction protocol verification, and inconsistencies between transaction and browser/agent parameters.

This includes user agents that are blank, that match no known browser or app pattern on the IAB Tech Lab/ABC International Spiders & Bots List (include list), or that change under one cookie, and IP addresses in private or reserved network space. It also includes requests self-declared as prefetch or preview, and traffic from devices that cannot render ad content. Classified as GIVT under the MRC IVT Guidelines.

Known Crawlers (12xx)

Traffic from bots, spiders and other crawlers that declare themselves as non-human, as identified by a user-agent string that matches the IAB Tech Lab/ABC International Spiders & Bots List. This also includes a new GIVT type, Declared AI Agents, which extends this to AI crawlers, fetchers and agents that identify themselves as automated.

Data Center (13xx)

Traffic whose IP address is on Pixalate’s known data-center list: hosting and cloud IP ranges that are a consistent source of invalid traffic. The list includes at minimum the Amazon AWS, Google and Microsoft ranges MRC requires, plus other significant hosting providers (for example, Oracle) and reputable industry sources (for example, the TAG Data Center IP List).

Proxies in data-center space that pass invalid traffic are reported separately as Data Center Proxy Traffic (2202, SIVT, False Representation).

Invalid Placements (14xx)

Measured traffic on placements whose dimensions are illogical for the trafficked creative under the IAB Standard Ad Portfolio (July 2017, v1.1), such as 0x0 or 1x1. MRC’s requirement covers small, barely visible or invisible ad delivery as delivered on the client side, and asks that declared sizes be checked for whether they reflect the actual placement or are for request purposes only.

SIVT categories

Automated Browsing (21xx)

Traffic generated from programs or scripts that request content or ads without user involvement and without declaring themselves as crawlers. This includes traffic generated by LLM crawlers, AI browsers operating in agent mode and AI agents that visit sites or apps, or click on ads, without genuine human intent, and that do not declare themselves as automated or that spoof a human user agent. It covers automation on dedicated devices (automation tools, headless browsers, emulators, device farms) and on non-dedicated devices that are infected or hijacked, including hijacked sessions.

False Representation (22xx)

Transactions where the declared inventory, device, user or measurement data differs from what was actually delivered or observed: misrepresented apps, domains, bundle IDs and operating systems; falsified device IDs, IP addresses, X-Forwarded-For headers, Private Relay claims, locations and referrers; SDK and SSAI spoofing; invalid proxies; and stuffed cookies.

All False Representation types are SIVT. GIVT parameter checks (blank, unknown or rotating user agents; private IP addresses) sit in Irregular Pattern.

Incentivized Human Invalid Activity (23xx)

Activity by real people who are paid, directed or otherwise incentivized to generate ad views, clicks or other engagement for the reward, or to benefit themselves or harm others, such as click farms where activity is organized across many users or devices. Per MRC, disclosed self-directed activity without the express purpose of manipulating measurement, such as reward programs, is excluded and, when known, should be considered discretely for reporting as a subset of valid ad activity.

Misleading User Interface (24xx)

Ads served in ways that keep them from being seen or that deceive the user: hidden, stacked, covered, transparent or invisible ads, banner stuffing and similar obfuscated ad serving. MRC also lists adware and malware that inject ads or add unauthorized overlays; traffic from Pixalate’s malware and phishing domain lists is reported under Known Dangerous Sources.

Known Dangerous Sources (25xx)

Traffic from sources on Pixalate’s specifically identified risk lists: device IDs and IPv4/IPv6 addresses flagged by Pixalate’s rule-based and machine-learning risk models as high-risk sources of invalid traffic; apps delisted from their app stores; and domains associated with malware, adware, phishing, or elevated risk profiles based on observed IVT signatures.

Supply Chain (26xx)

Transactions whose declared supply path fails validation against the publisher’s ads.txt or app-ads.txt and the OpenRTB SupplyChain object (schain): the first node does not identify a publisher (SCO Publisher is Null), or the first-node seller is not listed as DIRECT (SCO Unauthorized Sellers).

Related

• Risk types and codes: the codes in Fraud API responses
• Reported IVT types: IVT types in Analytics reports
• MRC-accredited metrics
• IVT Taxonomy 1.0 (previous version)