Invalid traffic, GIVT, SIVT — the vocabulary of the IAB and the MRC, written for enterprise display and video buyers with verification contracts. Almost none of it is written for the person buying pop or push on a $50 daily budget, even though that person is exposed to the same problem with none of the tooling.
This is the affiliate translation, plus a category the standard definitions miss entirely.
The two official tiers, in plain language
GIVT — General Invalid Traffic. The obvious stuff, catchable from lists and simple rules: known data-centre IP ranges, declared crawlers and spiders, headless browsers announcing themselves, activity from published bot lists. If your filter cannot catch GIVT, it is not a filter.
SIVT — Sophisticated Invalid Traffic. Traffic engineered to look human: residential proxy networks, hijacked devices, automation that mimics real interaction, and device farms with plausible fingerprints. SIVT is where budgets actually die, because it passes every list-based check.
The practical difference for a media buyer: GIVT is a solved problem you should never pay for, and SIVT is an ongoing arms race where your only real defence is corroborating evidence rather than any single signal.
Why the enterprise framing fails on pop and push
- It assumes a foregrounded tab. Viewability standards were built for display slots on pages a human is looking at. A popunder is backgrounded by design, so a foreground-tab standard scores an ordinary human visit as suspicious.
- It assumes verification vendors. Enterprise IVT reporting comes from a paid measurement contract. Most affiliates have no such thing and must build evidence from their own logs.
- It stops at “was it a human?” which turns out to be the wrong question at the moment you are actually losing money.
The missing category: unrendered delivery
Standard IVT taxonomy sorts traffic into valid and invalid. On pop and push there is a third population that is neither, and it is large:
Real humans whose browsers never loaded your page.
In our own measurement, a third of accepted clicks never issued a request to the destination — and when profiled, those visits were high-trust, residential, on distinct networks, with no repeated fingerprints. Calling them invalid traffic would be wrong. They were not fraud. They were a delivery failure, much of it caused by an interstitial page in our own chain that required the browser to act.
This matters commercially. If you classify unrendered delivery as IVT, you will file a fraud complaint that gets rejected, blocklist zones that were never bad, and leave the real cause — your redirect architecture — untouched.
| Population | What it is | Correct response |
|---|---|---|
| GIVT | Declared bots, data-centre IPs, crawlers | Block on sight, never pay |
| SIVT | Residential proxies, farms, human-like automation | Corroborated detection, zone-level scoring |
| Unrendered delivery | Real users whose browser never loaded the page | Fix delivery architecture, do not block |
| Valid rendered | Reached and displayed your page | The only traffic worth optimising |
What to measure when nobody sells you a verification report
- Arrival rate: destination requests divided by accepted clicks, joined on one identifier. This separates delivery failure from everything else.
- Render evidence: DOM or first-contentful-paint on the same visit — and never treat its absence as proof of fraud, because a suspended tab produces the same silence as a bot.
- Repetition: repeated IP and user-agent pairs across visits. Fraud is cheap only when it repeats; repetition is the most honest SIVT signal a solo buyer can compute.
- Network concentration: data-centre and hosting ASNs where you expect consumer ISPs.
- Zone-level aggregation: individual visits are noisy, zones are not. Judge sources at the zone level, where the evidence accumulates.
The honest position
Nobody can prove a single visit was fraudulent from server logs alone, and any vendor claiming per-visit certainty is selling confidence rather than evidence. What you can do is accumulate corroborating signals at the zone level, refuse to act on any single weak one, and keep the three populations above separate so each gets the response that actually fixes it.
Related reading: ghost traffic on pop and push covers the unrendered-delivery category in depth, and why “no render” is not a bot signal explains why the most tempting SIVT inference is usually wrong.