For AI agents: a documentation index is available at the root level at /llms.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
The previous version of Pixalate’s invalid traffic (IVT) taxonomy, kept for reference. IVT Taxonomy 2.0 is current.
This is the previous version of Pixalate’s IVT taxonomy. The current version is IVT Taxonomy 2.0, which gives every IVT type a four-digit code and groups it into GIVT and SIVT categories. Use 2.0 for new work, including the codes returned by the Fraud API.
IVT Taxonomy 1.0 lists the types of invalid traffic detection, as defined by Pixalate, reported in Pixalate’s Analytics and Threat Intelligence products. Each type is classed as general invalid traffic (GIVT) or sophisticated invalid traffic (SIVT).
For the IVT types shown in Analytics reports today, see Reported IVT types.
IVT class
IVT type
Definition
Recommendation
SIVT
App Spoofing
Traffic where the app identifier (for example, bundle ID) reported to the exchange does not match the characteristics of the app detected by Pixalate.
Tends to aggregate at the source or seller ID. The source can usually be identified using Analytics dashboard reports.
GIVT
Auto Reloader
Impressions with very periodic patterns that cannot be generated by a human.
Best addressed by Pixalate’s IP, data center or device filtration lists.
GIVT
Blank User Agent
The impression has an empty user agent field.
Do not bid on inventory where a user agent field is not available.
SIVT
Click Farm
An impression originating from a user who has been flagged as being associated with human click farm activity.
Best addressed by Pixalate’s IP, data center or device filtration lists.
SIVT
Cookie Stuffing
Activity from a cookie that has connected to the internet via a statistically significant inflated number of different IP addresses.
Best addressed by Pixalate’s IP filtration list.
GIVT
Datacenter
The user’s IP has a match in Pixalate’s known data center list.
Best addressed by Pixalate’s data center filtration list.
SIVT
Datacenter Proxy
The impression is from an intermediary proxy device, running in a data center, that exists to manipulate traffic counts, pass non-human or invalid traffic, or fails to comply with protocol.
Best addressed by Pixalate’s IP risk lists, filtering IPs flagged as datacenterProxy.
SIVT
Defased App
Traffic sourced from mobile apps that have been delisted from their respective app stores.
Best addressed by Pixalate’s delisted app filtration list.
SIVT
Device Id Stuffing
Activity from a unique device ID that presents itself as a statistically significant inflated number of different IP addresses, unique apps, branded platforms, or locations.
Best addressed by Pixalate’s device ID filtration list.
SIVT
Display Click Fraud
Clicks that are generated from the same browser or device at a statistically significant inflated rate.
Best addressed by Pixalate’s IP and device ID filtration lists.
SIVT
Display Impression Fraud
Impressions that are generated from the same browser or device at a statistically significant inflated rate.
Apply frequency capping. Best addressed by Pixalate’s IP and device ID filtration lists.
SIVT
Doorway Site
A user who has been flagged for accessing a given page or domain via multiple spoofed page referrers.
Best addressed by Pixalate’s IP filtration lists.
GIVT
Duplicate Clicks
High volumes of duplicate clicks may indicate an integration issue.
Activity originating from users who generate clicks less than one second after their respective impression.
Best addressed by IP, data center or device filtration lists.
SIVT
High CTR Traffic
Traffic associated with domains or apps demonstrating high-risk click-through rate (CTR) behavior.
Best addressed by high-risk domain, high-risk mobile app or IP lists.
SIVT
High Risk SCO Node
Flagged when a supply chain object (SCO) includes a node that has been flagged for a high risk of invalid traffic.
The Supply Path Optimization data feed can help identify problematic nodes for pre-bid blocking. Your Pixalate account manager can also help you identify problematic nodes through SCO reports in the Analytics dashboard, where applicable.
SIVT
High Risk Developer
An app that belongs to a developer that has created one or more blocklisted apps, and which also generates a large volume of invalid traffic.
Best addressed by high-risk mobile app or high-risk CTV app lists.
SIVT
High Risk Device ID
The impression is from a device ID that has been flagged for a high risk of invalid traffic.
Best addressed by the device filtration list.
SIVT
High Risk Domain
The impression is from a domain that has been flagged for a high risk of invalid traffic.
Best addressed by the domain filtration list.
SIVT
High Risk IP
The impression is from an IP address that has been flagged for a high risk of invalid traffic.
Best addressed by the IP filtration list.
SIVT
Hijacked Session
Activity originating from a device or browser that has a statistically significant inflated number of user sessions.
Best addressed by IP or device filtration lists.
GIVT
IAB Crawler
Activity originating from bots that use a user agent string matching a user agent on the list of IAB known crawlers. This type also includes self-announced prefetch traffic (see notes).
Pixalate’s user agent data feed contains known crawlers.
GIVT
IAB Dummy Bot
Activity originating from bots that use a user agent string that does not match any existing browser.
Pixalate’s user agent data feed contains known dummy bots.
GIVT
idioBots
Bots (or users) that change their user agent string (spoofing) while keeping the same cookie. This type also includes illogical placement dimensions (see notes).
Best addressed by user-based data feeds (IP, data center or device). User agents might be valid (not crawlers) but spoofed.
SIVT
IP Obfuscation
An IP that has been spoofed so that the impression is rendered to a different IP address than the one originally offered.
This can be a misapplication of cookie storing at the proxy level, and can be resolved by rejecting the Pixalate cookies being set at the proxy level.
SIVT
Location Obfuscation
Activity originating from an IP where multiple impressions deviate from the geographic location reported in the advertising transaction.
Usually aggregates at the publisher level, or the publisher and traffic source (for example, seller ID) level. Device ID and IP blocklists can also help.
SIVT
Malware
The impression is from domains or pages known to host malware.
The malware domain list can mitigate this.
SIVT
Masked IP
The IP of a user does not match the IP and the associated ISP reported in the advertising transaction.
Can be mitigated using publisher-level identifiers that are high risk.
SIVT
Masked iCloud Relay IP
The IP of a user does not match the IP and the associated ISP reported in the advertising transaction, and the reported IP was claimed to be an iCloud Private Relay IP address.
Best addressed by Pixalate’s high-risk IP list and by blocking sellers where this traffic type is aggregating.
SIVT
Phishing
The impression is from domains or pages associated with phishing tactics.
The phishing domain list can mitigate this.
GIVT
Private IP
The IP address associated with the ad impression is from the private network space.
Indicates an integration issue (for example, server to server).
SIVT
Proxy
The impression is from an intermediary proxy device that exists to manipulate traffic counts, pass non-human or invalid traffic, or fails to comply with the protocol.
Review proper implementation of proxy services, including SSAI. Pixalate’s IP data feeds can also address this.
SIVT
Publisher Fraud
Publishers operating domains or apps that violate standard ad serving practices, including, for example, stacked ads, high ad density and inflated impression counts.
Can be mitigated using publisher-level blocklists.
SIVT
SCO Unauthorized Direct Seller
Flagged when the supply chain object (SCO) includes an unauthorized direct seller: the publisher’s ads.txt or app-ads.txt file does not list the seller in the first node of the SCO as DIRECT.
Ensure that the seller on the first node is identified as a DIRECT seller in the publisher’s ads.txt or app-ads.txt. If unresolved, optimize away from these nodes, as they could also indicate other underlying traffic quality issues, especially at substantial IVT volumes.
SIVT
SCO Unauthorized Direct Seller Publisher Missing
Flagged when the first node of the SCO does not point to a publisher.
Work with the seller to check they are passing the correct information, and that their sellers.json correctly identifies their relationship with the publisher as direct. If unresolved, optimize away from these nodes, as they could also indicate other underlying traffic quality issues, especially at substantial IVT volumes.
SIVT
Smartbot
Bots (or users) that change their browser agent string (spoofing) and cookies very often under the same IP, creating low-volume or high-volume traffic under a configuration that looks like a busy enterprise network.
Best addressed by Pixalate’s IP and device ID data feeds.
GIVT
TOR
Traffic originating from a TOR network node.
Best addressed by Pixalate’s IP data feed.
SIVT
Video Click Fraud
Video ad clicks that are generated from the same browser or device at a statistically significant inflated rate.
Best addressed by Pixalate’s IP and device ID data feeds.
SIVT
Video Impression Fraud
Video ad impressions that are generated from the same browser or device at a statistically significant inflated rate.
Best addressed by Pixalate’s IP and device ID data feeds. Frequency capping can also be applied.
Notes on IAB Crawler and idioBots
Self-announced prefetch traffic. Pixalate’s detection logic accounts for both pre-render and prefetch traffic, and reports impressions using a “begin-to-render” impression recording approach. Pixalate’s IAB Crawler (iabCrawler) GIVT type includes any instances of self-announced prefetch activity (for example, X-moz: prefetch, X-purpose: preview).
Illogical placement dimensions. GIVT detection logic includes mechanisms to detect and account for illogical placement dimensions, which are inappropriate for trafficked ad creatives under the IAB Standard Ad Portfolio (July 2017, version 1.1). Measured traffic with illogical placement dimensions (for example, 0x0 or 1x1) is flagged and reported under Pixalate’s idioBots GIVT type.
In IVT Taxonomy 2.0, these have their own types: Invalid Prefetch Traffic (1109) and Invalid Placement Traffic (1401).
IVT designations reflect Pixalate’s opinions, not facts or guarantees. See the Pixalate disclaimer.