GIVT: Known Bots & Crawlers
Search engine spiders, monitoring tools, and other declared bots that identify themselves in their user-agent string. Easily filtered with IAB/ABC bot lists.
Fraud Type Guide
SIVT (Sophisticated Invalid Traffic): The Hardest Fraud to Detect
Basic filters catch the obvious bots. But sophisticated invalid traffic is engineered to look human — and it takes advanced detection to tell the difference.
What Is SIVT?
Quick answer: Sophisticated Invalid Traffic includes advanced threats like click farms, device emulators, behavioural manipulation, and cookie stuffing that require machine learning and behavioural analysis to detect.
SIVT — Sophisticated Invalid Traffic — is a classification defined by the Media Rating Council (MRC) for fraudulent traffic that cannot be identified through routine, list-based filtering. Unlike GIVT (General Invalid Traffic), which includes known bots and data-centre IPs that can be filtered with simple rules, SIVT is specifically designed to evade detection by mimicking genuine human behaviour.
SIVT encompasses a wide range of advanced fraud techniques including hijacked devices, falsified location data, incentivised traffic disguised as organic, cookie stuffing, ad stacking, and bots that simulate realistic browsing patterns with randomised mouse movements and scroll behaviour.
The MRC requires that any traffic measurement solution seeking accreditation must demonstrate the ability to detect and filter SIVT — a significantly higher bar than basic GIVT filtering. This distinction matters because SIVT typically represents the most financially damaging portion of invalid traffic.
GIVT vs. SIVT: Understanding the Spectrum
The MRC divides invalid traffic into two categories. Understanding where each threat falls helps you evaluate whether your current defences are adequate.
GIVT: Data-Centre Traffic
Traffic originating from known data-centre IP ranges rather than residential or mobile networks. Can be flagged using maintained IP-range databases.
SIVT: Click Farms
Real humans or hybrid human-bot operations performing fake clicks and engagements at scale. They use real devices and residential IPs, making list-based detection useless.
SIVT: Device Emulators
Software that simulates thousands of virtual devices, each with unique fingerprints. Modern emulators can mimic specific phone models, OS versions, and browser configurations.
SIVT: Cookie Stuffing
Dropping tracking cookies on users' browsers without their knowledge, then claiming attribution credit when those users later convert organically.
SIVT: Behavioural Manipulation
Bots that replicate human browsing patterns including realistic mouse movements, variable scroll speeds, random page navigation, and natural session durations.
Why SIVT Is So Hard to Detect
Sophisticated invalid traffic is purpose-built to bypass the filters that catch GIVT. Here is what makes it different.
Residential Proxies
SIVT routes through residential IP addresses, bypassing data-centre blocklists. The traffic appears to originate from genuine households in the target geography.
Rotating Fingerprints
Each session presents a different combination of browser, device, screen resolution, and plugins — making it impossible to block based on a single device signature.
Human-Like Behaviour
Advanced bots simulate mouse acceleration, variable scroll speeds, random pauses, and natural click patterns that pass basic behavioural heuristics.
Low-Volume Distribution
Rather than flooding from a single source, SIVT distributes activity across thousands of IPs and sessions, keeping per-source volume low enough to avoid threshold-based alerts.
How to Detect SIVT
Because SIVT is designed to look human, detection requires going beyond surface signals to find the statistical and behavioural anomalies that betray it.
Machine Learning Models
Train models on known-good and known-bad traffic to identify subtle patterns that rule-based systems miss. ML can detect anomalies in timing, engagement sequences, and interaction clusters.
Cross-Session Analysis
Correlate behaviour across sessions, campaigns, and time periods to uncover coordinated activity that appears organic when viewed in isolation.
Entropy Analysis
Measure the randomness of device attributes and behaviour signals. Genuine traffic shows natural variance; SIVT often reveals statistical regularities that betray its automated origin.
Multi-Signal Fingerprinting
Combine dozens of device, network, and behavioural signals into a composite fingerprint. While any single signal can be spoofed, maintaining consistency across 30+ signals simultaneously is extremely difficult.
How Opticks Catches SIVT
30+ Fraud Signals
Every interaction is analysed against device fingerprinting, behavioural patterns, network intelligence, and session dynamics in real time to expose sophisticated threats.
Adaptive ML Engine
Machine-learning models continuously retrain on emerging SIVT patterns, ensuring detection keeps pace with evolving fraud techniques.
Granular Reporting
See SIVT rates by campaign, source, placement, and geography so you can take targeted action where sophisticated fraud concentrates.
Frequently Asked Questions
Keep Exploring
Related Resources
Expose the Fraud Your Filters Miss
See how much sophisticated invalid traffic is hiding in your campaigns. No code changes required — install via Google Tag Manager in under five minutes.
Start Free Trial
No credit card required