SIVT (sophisticated invalid traffic)

SIVT is the part of invalid traffic that tries not to get caught. Instead of announcing itself like a crawler, it copies the look and feel of real people and real publishers, so simple lists cannot stop it.

The MRC IVT guidelines list SIVT types including: bots and browsers that mimic human behaviour, hijacked devices, sessions, ad tags or creatives, adware and malware that load ads users never asked for, invalid proxy traffic such as abused residential proxies, incentivized manipulation of measurements, domain spoofing and app spoofing (misrepresenting where an ad ran), cookie stuffing and cookie harvesting, falsified viewability, manipulated location data and, in streaming TV, SSAI spoofing.

Detecting SIVT means corroborating many signals together: IP reputation, device and browser consistency (device fingerprinting), behavioral analysis of mouse, touch and timing patterns, supply-chain checks via ads.txt and sellers.json, and statistical anomaly detection. MRC requires SIVT detection to use these advanced methods, and accredited vendors combine automation with analyst review. A low SIVT number is only meaningful if the vendor is actually accredited for SIVT.

Think of it like this

If GIVT is a known troublemaker on the banned list, SIVT is a pickpocket in a good suit: you only catch him by noticing that his behaviour, his story and his timing do not add up.

An example

A video campaign looks clean on GIVT checks, but analysis shows 40,000 "viewers" whose devices claim to be iPhones while their screen and rendering traits match a Linux server, all watching from residential IPs in the same few city blocks. That is SIVT.