Scoring Report

Category

Description

Bot/Virus

Computer programs/viruses designed to run on large-scale and simulate human users to create a virtual audience, which can achieve the advertising goal with minimum effort. 

Hostile Tools

Advertising bots range from simple script to advanced impersonating bots, which may elude many security measures. Tools that mask the user, thus tricking the measurement into counting ad access as if coming from a different device. 

Tunneled Traffic

This can be accomplished using a virtual machine, cell phone emulators, plug-in, or extension. A method used by fraudsters to mask the geolocation of the user by using a proxy or VPN to mask the IP address.  Sophisticated methods include peer-to-peer proxies, which allow the fraudster to use a real PC with a real residential IP address that would not generally be black-listed.

Non-malicious bots

This method is typically used by click-farms, which employ people to click on ads and install applications while impersonating users from the desired locations. Legitimate and self-declared non-humans, for example, Google’s search bot. This transaction category is usually classified as suspicious. 

View Fraud

Ads deliberately displayed in a manner that is invisible to the human eye, such as being stacked below other ads on a page or within an invisible iFrame. This transaction category is usually classified as suspicious.

Publisher Fraud

Ads displayed on a website, location, or application different from the one reported to the advertiser. This transaction category is usually classified as suspicious.

Reputation 

An indicator of whether a web entity, such as a Publisher, Website, or a User ID, is suspected of having engaged in fraudulent behavior.  The higher the rate of detection, the greater the potential risk.  

Automated and Emulated Activity

Events generated by bots, viruses, and auEvents generated by bots, viruses, and automated tools that mimic user behavior and falsify user and device info (such as emulating mobile and connected TV devices).

Common Causes of IVT:

Events generated by virtual machines (e.g., Android VMs running on Desktop).

Automation tools (e.g., Selenium, Headless Chrome, Puppeteer, and various custom tools and JS scripts) that are purported to be real devices and users. A common non-malicious source is web crawlers designed to bypass conventional scraping detection.

Signals that suggest an illegitimate device or user environment.

Automated tools that mimic user behavior and falsify user and device info (such as emulating mobile and connected TV devices).

Known Crawlers

Are events generated by known crawlers (like Google, Meta...) and automated tools that are legitimate or self-declared automated services. We detect but do not flag it as IVT

GIVT 

‘General Invalid Traffic,’ consist[s] of traffic identified through routine means of filtration executed through the application of lists or with other standardized parameter checks.

SIVT

“Sophisticated Invalid Traffic,’ consists of more difficult to detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify.