Pixalate’s IVT Taxonomy 2.0

Overview

Pixalate detects invalid traffic (IVT) using various ad fraud signals and detection techniques, classifying each invalid impression or click into one of 46 distinct IVT types. Each type is categorized under 4 General Invalid Traffic (GIVT) categories and 6 Sophisticated Invalid Traffic (SIVT) categories, in alignment with MRC IVT Guidelines and the TAG IVT Taxonomy v2.0.

General Invalid Traffic (GIVT)

General Invalid Traffic (GIVT) is identified through routine filtration, such as blocklists and standard parameter checks. It includes self-declared bots and crawlers, known data center traffic, and duplicate or malformed transactions.

Sophisticated Invalid Traffic (SIVT)

Sophisticated Invalid Traffic (SIVT) is more complex to detect, requiring advanced behavioral analysis, statistical modeling, machine learning, multi-signal corroboration, or human review. It includes automated devices masquerading as legitimate users, falsified app, device, or location data, invalid proxy traffic, and incentivized human activity.

Detected Environments

Pixalate analyzes ad traffic across various environments and devices, including mobile in-app, Connected TV (CTV), and web traffic.

Known Dangerous or Fraudulent Sources

Beyond impression and click fraud, Pixalate also identifies high-risk entities based on their associated IVT and compliance risks:

• IP addresses (IPv4 and IPv6)
• Device IDs (Mobile and CTV)
• App and Bundle IDs (Mobile and CTV)
• Domains (Web)
• Supply Chains

IVT Categories and IVT Types

All 46 IVT types are listed under 4 GIVT categories and 6 SIVT categories.

General Invalid Traffic (GIVT)

1. Irregular Pattern

General invalid traffic identified by MRC's activity-based techniques applied to transaction-level data and parameters: speed of transactions (such as a click less than one second after its impression), repeat transactions, interval testing (machine-regular periodicity), outlier identification, missing values or user agents, transaction protocol verification, and inconsistencies between transaction and browser/agent parameters.

This includes user agents that are blank, that match no known browser or app pattern on the IAB Tech Lab/ABC International Spiders & Bots List (include list), or that change under one cookie, and IP addresses in private or reserved network space. It also includes requests self-declared as prefetch or preview, and traffic from devices that cannot render ad content. Classified as GIVT under the MRC IVT Guidelines.

2. Known Crawlers

Traffic from bots, spiders and other crawlers that declare themselves as non-human, as identified by a user-agent string that matches the IAB Tech Lab/ABC International Spiders & Bots List. This also includes a new GIVT type, Declared AI Agents, which extends this to AI crawlers, fetchers and agents that identify themselves as automated.

3. Data Center

Traffic whose IP address is on Pixalate's known data-center list: hosting and cloud IP ranges that are a consistent source of invalid traffic. The list includes at minimum the Amazon AWS, Google and Microsoft ranges MRC requires, plus other significant hosting providers (e.g., Oracle) and reputable industry sources (e.g., the TAG Data Center IP List).

Proxies in data-center space that pass invalid traffic are reported separately as Data Center Proxy Traffic (SIVT, False Representation).

4.. Invalid Placements

Measured traffic on placements whose dimensions are illogical for the trafficked creative under the IAB Standard Ad Portfolio (July 2017, v1.1), such as 0x0 or 1x1. MRC's requirement covers small, barely visible or invisible ad delivery as delivered on the client side, and asks that declared sizes be checked for whether they reflect the actual placement or are for request purposes only.

Sophisticated Invalid Traffic (SIVT)

1. Automated Browsing

Traffic generated from programs or scripts that request content or ads without user involvement and without declaring themselves as crawlers inclusive of traffic generated by LLM crawlers, AI browsers operating in agent mode and AI agents that visit sites or apps, or click on ads, without genuine human intent, and that do not declare themselves as automated or that spoof a human user agent. Covers automation on dedicated devices (automation tools, headless browsers, emulators, device farms) and on non-dedicated devices that are infected or hijacked, including hijacked sessions.

2. False Representation

Transactions where the declared inventory, device, user or measurement data differs from what was actually delivered or observed: misrepresented apps, domains, bundle IDs and operating systems; falsified device IDs, IP addresses, X-Forwarded-For headers, Private Relay claims, locations and referrers; SDK and SSAI spoofing; invalid proxies; and stuffed cookies.

All False Representation types are SIVT. GIVT parameter checks (blank, unknown or rotating user agents; private IP addresses) sit in Irregular Pattern.

3. Incentivized Human Invalid Activity

Activity by real people who are paid, directed or otherwise incentivized to generate ad views, clicks or other engagement for the reward, or to benefit themselves or harm others, such as click farms where activity is organized across many users or devices. Per MRC, disclosed self-directed activity without the express purpose of manipulating measurement, such as reward programs, is excluded and, when known, should be considered discretely for reporting as a subset of valid ad activity.

4. Misleading User Interface

Ads served in ways that keep them from being seen or that deceive the user: hidden, stacked, covered, transparent or invisible ads, banner stuffing and similar obfuscated ad serving. MRC also lists adware and malware that inject ads or add unauthorized overlays; Traffic from Pixalate’s malware and phishing domain lists is reported under Known Dangerous Sources.

5. Known Dangerous Sources

Traffic from sources on Pixalate's specifically identified risk lists: device IDs and IPv4/IPv6 addresses flagged by Pixalate's rule-based and machine-learning risk models as high-risk sources of invalid traffic; apps delisted from their app stores; domains associated with malware, adware, phishing, and/or elevated risk profiles based on observed IVT signatures.

6.Supply Chain

Transactions whose declared supply path fails validation against the publisher's ads.txt or app-ads.txt and the OpenRTB SupplyChain object (schain): the first node does not identify a publisher (SCO Publisher is Null), or the first-node seller is not listed as DIRECT (SCO Unauthorized Seller).