Invalid traffic reference: counters, risk levels and Traffic Quality thresholds

Reference for Invalid traffic (IVT) and how Epom flags it: the exact columns, bands, parts and thresholds behind the three surfaces.

Rejected, duplicate and expired counters

Columns of the Advanced report, filled by the network’s Validation settings (Moderation & quality).

Counter	What it holds
Rejected impressions	Impressions flagged invalid
Rejected clicks	Clicks flagged invalid
Rejected conversions	Conversions flagged invalid (also “Conv. fraud” on the General report)
Rejected passbacks	Passback events that missed or were fraudulent
Duplicate impressions / Duplicate clicks	Repeats of an impression or click already counted for the same ad request
Expired impressions / Expired clicks	Impressions whose signature or timestamp was past the validity window, clicks on a link past its lifetime

The rates of the Advanced report are computed on eligible events:

eligible impressions = max(0, deliveries − matched passbacks − rejected impressions)
eligible clicks       = max(0, total clicks − rejected clicks)
eligible conversions  = max(0, total conversions − rejected conversions)

eCPM, the effective CTR, the fill rates, CCR and I2C all divide by the eligible figure. The General report divides by its own impression counter, so the two report types can differ for the same traffic (Analytics pipelines explained). Full formulas: metrics reference.

Rejection reasons

Group the Advanced report, or the Impressions and Clicks logs, by Rejection Reason:

Reason	Applies to
Invalid request	any event
Bot	any event
Blacklisted IP	any event
Suspected IP	any event
Invalid signature	impressions
Expired	impressions (signature or timestamp past its window)
Duplicate	impressions and clicks
Expired click link	clicks
Click fraud	clicks
Sequential conversion	conversions
Conversion per IP time frame	conversions

A check in Monitor mode labels the events it catches with the same reasons but lets them count, so the grouping also shows counted events that enforcing would remove.

Deduplication and click-link lifetime

Every ad request gets a transaction id — a placement’s rotation is a new ad request with a new one — and the impression and click links of the ad it returns carry it, signed together with the placement and the render time. Three checks run on it, each in one of three modes set on Validation settings:

Check	Catches	Window in which a repeat is recognised (default)
Impression deduplication	The same impression arriving twice — a replayed pixel, a double-fired tag	As long as the original could still be accepted: about 11 minutes for a banner impression (its signature window), 5 hours for a video impression
Click deduplication	A click link someone keeps reusing	The click link lifetime
Click link lifetime	A click on a link past its lifetime	24 hours by default

Mode	Effect
Off	Nothing is checked
Monitor	Repeats and expired links are counted as usual but labelled, so the Duplicate and Expired columns show what enforcing would remove before you remove anything
Enforce	They are kept out of the statistics, the delivery limits and billing, and land in the Rejected counters

An admin can change all three windows on Validation settings.

Unique impressions and Unique clicks in the Unique view are not a duplicate count: they count distinct transactions, so an SDK beacon that reports several impressions at once, or several ads from one request, reads as one.

Risk levels

The IP screening service returns a fraud probability per IP; the level is its band.

Level	Probability band
Not scored	below 0.01
Low	0.01 – 0.5
Likely	0.5 – 0.75
High	0.75 – 0.9
Very high	0.9 – 1.0
Certain	1.0 and above

Disabled and Error also exist as system values, for a request the service could not score. The ad server looks the IP up separately for the ad request, its impression, its click and its conversion, so one visit can carry two levels.

The Risk score column is the impression-and-click-weighted average of the probability:

Risk score = risk sum ÷ (eligible impressions + eligible clicks)

Risk categories and the GIVT/SIVT split

The categories are concrete detection reasons. The tier column is an interpretation to bridge the industry vocabulary: Epom stores each detection as a named risk category, not as a GIVT/SIVT tag, so the tier is not a field you can filter on.

Tends toward…	Example risk categories the service reports
GIVT (obvious)	Datacenter, datacenter proxy, IAB-recognized crawlers/bots, IAB dummy bot, blank user agent, TOR
SIVT (sophisticated)	App spoofing, device-ID stuffing, hijacked session, cookie stuffing, click farm, location obfuscation, auto-reloader, fast clicker, publisher fraud

Traffic Quality applies the same split to IP screening’s verdicts, but only when IP screening is sure — Very high or Certain: the first row becomes Bots (IP screening) (routine bots), the second Known fraud (IP screening) (suspicious). The one exception is an IAB-listed crawler, which counts as a declared crawler at any level. Lower levels are shown there as context and never counted.

Traffic Quality parts, reasons and thresholds

The three parts

Each invalid impression sits in exactly one part, so the three add up to the invalid share. An impression with a suspicious signal counts as Suspicious even when it also carries a routine one.

Part on the page	Industry term	What lands there
Suspicious	SIVT	Tampered or unsigned impression pixels, addresses the ad server auto-banned, bots the ad server’s own check caught beyond declared crawlers and headless browsers, and fraud IP screening is sure of
Routine bots	GIVT	Declared bots and crawlers, automated (headless) browsers, data-centre servers another check agrees on, addresses on your blocklist, and bots IP screening is sure of
Counted twice	—	A second or later copy of an ad view (same ad request and creative) that carries no other strong signal: a doubled tag, a cached page or a script firing the pixel again. An integration problem more often than a bot

The reasons behind the parts — shown in plain words on the page, each with its share — can overlap: one impression can carry several. The full list is in Statuses & indicators.

The ad server’s own verdicts — a forged signature, a blocklisted or auto-banned address, a bot — are the firmest evidence, because a check ran and said no. They count the same whether the check refused the impression (Enforce) or let it count with a label (Monitor).

Context-only signals

Shown under Shown for context, not counted as invalid; they never enter the share.

Signal	Why it is context
Other cloud and hosting addresses	Industry practice (MRC) leaves legitimate routing — cloud proxies, privacy relays, corporate gateways — out of data-centre invalid traffic. A hosting address counts as Data-centre servers only when IP screening, the crawler check or the headless check agrees, or for a TOR exit
Late impression pixels	Genuine, but arrived after the signature expired — a slow video, a restored tab, a cached page. A pixel the ad server did not issue for that ad request (forged, replayed, unsigned, rewritten by a tag) is Tampered or unsigned impression pixels instead, which counts. Before release 155 the two were scored together
IP screening Low, Likely, High	Below the level at which the service itself advises blocking
VPN and public proxy users	Travellers and privacy-minded people land there too
IP country differs from the browser’s time zone	Same

What else is on the page

Figure	What it is
Refused before counting	Impressions validation refused (the Advanced report’s Rejected impressions); never billed
Paid for invalid	The exact gross of the invalid impressions that were counted
Network median and the edge of the worst tenth	Among the network’s placements of the same format family that day; of the whole network when fewer than five placements of that family were judged. Context, never what decides the status
Last 7 days	The placement’s own share over the seven days before the day; decides OK and Watch
Checked by IP screening	How much of the day IP screening scored; 0% when it is off for the network
Invalid clicks	Clicks refused as click fraud and clicks less than 100 ms after their impression; shown from 50 clicks, never part of the impression share. A click with no impression that day is not counted as invalid
Likely range	A 95% range computed over the number of independent people behind the impressions — the larger of the unique users and the unique IP addresses, never more than the impressions
What to do	A fixed list keyed to the largest reasons, at most three actions; when invalid clicks reach 10%, one of them is to enforce the click checks. Not AI text
PDF report	Opens with the same verdict, then an AI analyst’s notes: whether it agrees with the status, its findings, a neutral message for the publisher. The AI explains the verdict; it does not score the placement

Status lines and volume thresholds

Act is decided on the day: the low end of the day’s likely range against the Act line of the placement’s format. OK and Watch are decided on the last 7 days against the Watch line. A placement without such a week (a new one, or one scored only before release 155) is judged on the day alone.

Lines for	Placement types	Watch from	Act from
Web and display	Site, Mobile Site, Non-standard, Native, Click-through and Email placements	3%	10%
In-app	Application placements	5%	10%
Video	Video placements	8%	15%

• Watch also applies when suspicious traffic alone reaches 5% over the seven days — the level MRC calls material.
• A Low confidence day never goes past Watch, nor below it when the day itself is over the Act line: a clean week does not turn such a day OK.
• The lines are provisional: they start at the invalid-traffic bands the IP screening service publishes for each channel and may move once they are calibrated on Epom’s own traffic.

Days before release 155

A day scored before release 155 has no exact share. Its status is read from the level it had — Clean as OK, Suspicious as Watch, Fraudulent and Critical as Act — and the page shows the old estimate, marked (estimate). The Critical level is retired.

Over the API

• REST: /rest-api/traffic-quality returns the same verdicts, each placement’s deep analysis and the report’s findings; the invalid share’s parts are givtPct and sivtPct. See the API reference.
• MCP: the AI assistant’s traffic_quality tool reads the same data (MCP).
• Targeting: the Traffic Risk Score rule — a risk level with a relation (default >=) and an optional risk category — is in Targeting dimensions. With IP screening off, or for an IP it has no data on, the rule does not match.