The table below shows all metrics and their descriptions from the Invalid Traffic Report.
Metrics Name |
Description |
Source |
The source name |
Sub Source |
The sub-source name |
Campaign |
79 |
Domain |
Domain of the traffic |
App ID |
App name/ID of the traffic |
Date |
Date of the traffic |
Country |
Country name based on the IP |
ISP |
Internet Service Provider such as TWC |
Connection |
Internet Connection types such as Cable_DSL |
OS Name |
Operating System Name such as Windows 10 |
OS Family |
Operating System Family such as Windows |
Browser |
Browser type such as Chrome |
Browser Version |
Browser Version number of the browser type used. If browser_name is Chrome and browser_version is 65, it means it’s “Chrome version 65”. |
Device Model |
The Device Model number assigned by the device brand such as 3830 |
Gross Impressions |
All rendered impressions from JS and Image tags. |
Net Impressions |
Gross Impressions - GIVT Impressions |
Total Net Impressions |
Gross Impressions - GIVT Impressions - SIVT Impressions |
Suspect Impressions |
Impressions that have a risk score between 65-79. |
Non Suspect Impressions |
Impressions that have a risk score below 65. |
High Risk Impressions |
Impressions that have a risk score above 79. |
Total Risk Impressions |
Impressions that have a risk score above 64. |
Impression Crawler |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Impression Domain Reputation |
Domain Reputation is the practice of filtering out domains that have been identified through business and technical means to have a high risk of being the origin and/or destination for invalid traffic. |
Impression GIVT |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Impression SIVT |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Impression Ad Placement Risk |
Ad Placement Risk is when ads are obstructed, stuffed, or hidden maliciously. |
Impression Hosting Provider |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Impression IP Reputation |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Impression Proxy |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Impression Automated Traffic |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Impression Spoofing |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Impression Abnormal Activity |
Abnormal Activity is defined as unusual patterns over a certain period of time. |
Impression Inaudible |
The video ad was muted or played in "whisper" mode at a very low volume. |
Impression Inaudible Considered |
The Inaudible ads that are successfully measured by Forensiq. |
Impression Suspect % |
Impressions percentage that has a risk score between 65-79. |
Impression Non Suspect % |
Impressions percentage that has a risk score below 65. |
Impression High Risk % |
Impressions percentage that has a risk score above 79. |
Impression Crawler % |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Impression Domain Reputation % |
Domain Reputation is the practice of filtering out domains that have been identified through business and technical means to have a high risk of being the origin and/or destination for invalid traffic. |
Impression GIVT % |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Impression SIVT % |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Impression Ad Placement Risk % |
Ad Placement Risk is when ads are obstructed, stuffed, or hidden maliciously. |
Impression Hosting Provider % |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Impression IP Reputation % |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Impression Proxy % |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Impression Automated Traffic % |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Impression Spoofing % |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Impression Abnormal Activity % |
Abnormal Activity is defined as unusual patterns over a certain period of time. |
Impression Inaudible % |
The video ad was muted or played in "whisper" mode at a very low volume. |
Impression Risk % |
Impressions percentage that has a risk score above 64. |
Suspect Tracked Ads |
Tracked Ads with a risk score between 65-79. |
Non Suspect Tracked Ads |
Tracked Ads with a risk score below 65. |
High Risk Tracked Ads |
Tracked Ads with a risk score above 79. |
Total Risk Tracked Ads |
Tracked Ads with a risk score above 64. |
Tracked Ad Crawler |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Tracked Ad Domain Reputation |
Domain Reputation is the practice of filtering out domains that have been identified through business and technical means to have a high risk of being the origin and/or destination for invalid traffic. |
Tracked Ad GIVT |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Tracked Ad SIVT |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Tracked Ad Ad Placement Risk |
Ad Placement Risk is when ads are obstructed, stuffed, or hidden maliciously. |
Tracked Ad Hosting Provider |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Tracked Ad IP Reputation |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Tracked Ad Proxy |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Tracked Ad Automated Traffic |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Tracked Ad Spoofing |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Tracked Ad Abnormal Activity |
Abnormal Activity is defined as unusual patterns over a certain period of time. |
Tracked Ad Suspect % |
Tracked Ads percentage that has a risk score between 65-79. |
Tracked Ad Non Suspect % |
Tracked Ads percentage that has a risk score below 65. |
Tracked Ad High Risk % |
Tracked Ads percentage that has a risk score above 79. |
Tracked Ad Crawler % |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Tracked Ad Domain Reputation % |
Domain Reputation is the practice of filtering out domains that have been identified through business and technical means to have a high risk of being the origin and/or destination for invalid traffic. |
Tracked Ad GIVT % |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Tracked Ad SIVT % |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Tracked Ad Ad Placement Risk % |
Ad Placement Risk is when ads are obstructed, stuffed, or hidden maliciously. |
Tracked Ad Hosting Provider % |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Tracked Ad IP Reputation % |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Tracked Ad Proxy % |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Tracked Ad Automated Traffic % |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Tracked Ad Spoofing % |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Tracked Ad Abnormal Activity % |
Abnormal Activity is defined as unusual patterns over a certain period of time. |
Tracked Ad Risk % |
Tracked Ads percentage that has a risk score above 64. |
Suspect Clicks |
Clicks that have a risk score between 65-79. |
Non Suspect Clicks |
Clicks that have a risk score below 65. |
High Risk Clicks |
Clicks that have a risk score above 79. |
Total Risk Clicks |
Clicks that have a risk score above 64. |
Click Crawler |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Click GIVT |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Click SIVT |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Click Hosting Provider |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Click IP Reputation |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Click Proxy |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Click Automated Traffic |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Click Spoofing |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Click Device Reputation |
Device reputation allows us to store reputation for the user's device and identify patterns of repeat device activity on the click and conversion level only. |
Click Suspect % |
Clicks percentage that has a risk score between 65-79. |
Click Non Suspect % |
Clicks percentage that has a risk score below 65. |
Click High Risk % |
Clicks percentage that has a risk score above 79. |
Click Crawler % |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Click GIVT % |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Click SIVT % |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Click Hosting Provider % |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Click IP Reputation % |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Click Proxy % |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Click Automated Traffic % |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Click Spoofing % |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Click Device Reputation % |
Device reputation allows us to store reputation for the user's device and identify patterns of repeat device activity on the click and conversion level only. |
Click Risk % |
Clicks percentage that has a risk score above 64. |
Suspect Actions |
Actions that have a risk score between 65-79. |
Non Suspect Actions |
Actions that have a risk score below 65. |
High Risk Actions |
Actions that have a risk score above 79. |
Total Risk Actions |
Actions that have a risk score above 64. |
Action Crawler |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Action GIVT |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Action SIVT |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Action Hosting Provider |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Action IP Reputation |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Action Proxy |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Action Automated Traffic |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Action Spoofing |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Action Device Reputation |
Device reputation allows us to store reputation for the user's device and identify patterns of repeat device activity on the click and conversion level only. |
Action Suspect % |
Actions percentage that has a risk score between 65-79. |
Action Non Suspect % |
Actions percentage that has a risk score below 65. |
Action High Risk % |
Actions percentage that has a risk score above 79. |
Action Crawler % |
Crawlers are Internet bots and non-browser user agents that systematically browse the internet. Web crawlers may trigger ad impressions or clicks. |
Action GIVT % |
GIVT (General Invalid Traffic) consists of traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks. |
Action SIVT % |
SIVT (Sophisticated Invalid Traffic) consists of more difficult-to-detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc., to analyze and identify. |
Action Hosting Provider % |
Hosting Providers are geo organizations identified as providers of hosting services. Hosting Providers are often used for malicious activities. |
Action IP Reputation % |
IP Reputation is the historical behavior of an IP address over a period of time. Bad reputation IPs are the ones with recent malicious activity. |
Action Proxy % |
Proxies are often used to mask the real location of the user and simulate activity from multiple users. |
Action Automated Traffic % |
Automated Traffic is malicious traffic from botnets and other types of hijacked devices. |
Action Spoofing % |
Spoofing means the user's device and browser are manipulated to resemble a different device or browser. |
Action Device Reputation % |
Device reputation allows us to store reputation for the user's device and identify patterns of repeat device activity on the click and conversion level only. |
Action Risk % |
Actions percentage that has a risk score above 64. |
Device Year |
The Device Year assigned by the device brand such as 2018. |
Tracked Ads |
A “Tracked Ads” is counted when the impression rendered, when JS Tag is incompletely executed, when ad unit not found, or when clients are using the pixel instead of JS Tag. This should be the metric client should use to count the total number of requests. |
Net Tracked Ads |
Tracked Ads - GIVT Tracked Ads |
Total Net Tracked Ads |
Tracked Ads - GIVT Tracked Ads - SIVT Tracked Ads |
Clicks |
When Request Type is passed as click. |
Net Clicks |
Clicks - GIVT Clicks |
Total Net Clicks |
Clicks - GIVT Clicks - SIVT Clicks |
Actions |
When Request Type is passed as action. |
Net Actions |
Actions - GIVT Actions |
Total Net Actions |
Actions - GIVT Actions - SIVT Actions |
Net Viewable |
If the event has "impression=true", "viewable = true", "givt = true", and "sivt = false", it is categorized as "Net Viewable". |
Net Viewable Measured |
The number of impressions Forensiq is able to determine their viewability - GIVT part |
Net Non-Viewable |
Net Viewable Measured - Net Viewable |
Net Viewable Undetermined |
Net Impressions - Net Viewable Measured |
Net Viewable Rate % |
Net Viewable/Net Viewable Measured |
Net Impression Distribution Measured Rate % |
Net Viewable Measured/Net Impressions |
Net Impression Distribution Viewable % |
Net Viewable/Net Impressions |
Net Impression Distribution Non-Viewable % |
Net Non-Viewable/Net Impressions |
Net Impression Distribution Unmeasured % |
Net Viewable Undetermined/Net Impressions |
Net Viewable 1 |
Number of banner impressions viewable for 1 continuous seconds - GIVT part |
Net Viewable 2 |
Number of video impressions viewable for 2 continuous seconds - GIVT part |
Net Viewable 5 |
Number of impressions viewable for 5 continuous seconds - GIVT part |
Net Viewable 10 |
Number of impressions viewable for 10 continuous seconds - GIVT part |
Net Viewable 30 |
Number of impressions viewable for 30 continuous seconds (display only) - GIVT part |
Net Viewable Rate 1 % |
Percentage of banner impressions viewable for 1 continuous seconds - GIVT part |
Net Viewable Rate 2 % |
Percentage of video impressions viewable for 2 continuous seconds - GIVT part |
Net Viewable Rate 5 % |
Percentage of impressions viewable for 5 continuous seconds - GIVT part |
Net Viewable Rate 10 % |
Percentage of impressions viewable for 10 continuous seconds - GIVT part |
Net Viewable Rate 30 % |
Percentage of impressions viewable for 30 continuous seconds (display only) - GIVT part |
Total Net Viewable |
If the event has "impression=true", "viewable = true", "givt = true", and "sivt = true", it is categorized as "Total Net Viewable". |
Total Net Viewable Measured |
The number of impressions Forensiq is able to determine their viewabilities - GIVT part - SIVT part |
Total Net Non-Viewable |
Total Net Viewable Measured - Total Net Viewable |
Total Net Viewable Undetermined |
Total Net Impressions - Total Net Viewable Measured |
Total Net Viewable Rate % |
Total Net Viewable/Total Net Viewable Measured |
Total Net Impression Distribution Measured Rate % |
Total Net Viewable Measured/Total Net Impressions |
Total Net Impression Distribution Viewable % |
Total Net Viewable/Total Net Impressions |
Total Net Impression Distribution Non-Viewable % |
Total Net Non-Viewable/Total Net Impressions |
Total Net Impression Distribution Unmeasured % |
Total Net Viewable Undetermined/Total Net Impressions |
Total Net Viewable 1 |
Number of banner impressions viewable for 1 continuous seconds - GIVT part - SIVT part |
Total Net Viewable 2 |
Number of video impressions viewable for 2 continuous seconds - GIVT part - SIVT part |
Total Net Viewable 5 |
Number of impressions viewable for 5 continuous seconds - GIVT part - SIVT part |
Total Net Viewable 10 |
Number of impressions viewable for 10 continuous seconds - GIVT part - SIVT part |
Total Net Viewable 30 |
Number of impressions viewable for 30 continuous seconds (display only) - GIVT part - SIVT part |
Total Net Viewable Rate 1 % |
Percentage of banner impressions viewable for 1 continuous seconds - GIVT part - SIVT part |
Total Net Viewable Rate 2 % |
Percentage of video impressions viewable for 2 continuous seconds - GIVT part - SIVT part |
Total Net Viewable Rate 5 % |
Percentage of impressions viewable for 5 continuous seconds - GIVT part - SIVT part |
Total Net Viewable Rate 10 % |
Percentage of impressions viewable for 10 continuous seconds - GIVT part - SIVT part |
Total Net Viewable Rate 30 % |
Percentage of impressions viewable for 30 continuous seconds (display only) - GIVT part - SIVT part |
Original Source |
Original unmapped Source ID |
Original Sub Source |
Original unmapped Sub Source ID |
Original Campaign |
Original unmapped Campaign ID |
Conversions |
Same as Actions |
Domain Infraction Considered |
The number of impressions that Forensiq is able to identify for Domain Infraction |
Domain Infraction Total |
The number of impression URL’s that are not matching the top-domain URL’s. |
Domain Infraction % |
Domain Infraction Total / Domain Infraction Considered |
Ad Injection |
The ad was loaded by ad injection software. |
Ad Injection % |
Ad Injection / Domain Infraction Considered |
Cloaked Domains |
There is a mismatch between the domain where the ad appeared and the referring domain. |
Cloaked Domains % |
Cloaked Domains / Domain Infraction Considered |
Domain Spoofing |
The partner reports an inaccurate domain to the exchange. The ad never appeared on the partner-reported domain. |
Domain Spoofing % |
Domain Spoofing / Domain Infraction Considered |
Misconfigured |
The true domain appears in the query string of the referring URL, but was not reported to Forensiq. |
Misconfigured % |
Misconfigured / Domain Infraction Considered |
True Domain |
The real URL that Forensiq identified |