# Invalid Traffic > Understanding traffic that should not influence advertising systems, analytics, or business decisions. --- ## Overview Invalid traffic describes interactions that do not represent trusted user activity and should not be treated as meaningful engagement. In digital advertising and analytics systems, traffic quality matters. A request may come from a real browser, an automated client, a script, or an infrastructure source with a history of abuse. Understanding the origin and behaviour of traffic is essential before deciding whether it should influence advertising optimisation, attribution, or reporting. Invalid traffic is not limited to simple bots. Modern traffic analysis must account for a wide range of behaviours, from basic automated requests to advanced browser automation designed to resemble legitimate visitors. --- # Why Invalid Traffic Matters Advertising and analytics systems learn from incoming interactions. Signals such as: * clicks * conversions * page views * engagement * session behaviour can influence automated decisions. When invalid traffic is included, it can create inaccurate signals that affect: * campaign optimisation * attribution * conversion analysis * audience modelling * reporting accuracy The objective is not simply to block traffic. The objective is to understand whether an interaction represents meaningful activity. --- # Categories of Invalid Traffic Invalid traffic can be grouped by the behaviour and characteristics of the traffic source. --- ## Request Bots Request bots generate automated traffic without behaving like a normal browser session. Examples include: * scripted HTTP requests * automated clients * simple crawlers * API-based automation * scanning tools Characteristics may include: * unusual request patterns * missing browser behaviour * repeated actions * abnormal request timing * automated infrastructure Request bots are often easier to identify because they do not attempt to fully reproduce a human browsing environment. --- ## Basic Automation Basic automation uses browser automation tools or scripts to perform actions through a browser environment. Examples include: * scripted browsing * repetitive page interactions * simple automation frameworks * automated form submissions These systems may execute JavaScript and maintain sessions, making them more difficult to distinguish from legitimate visitors. Detection may require analysing: * browser behaviour * execution patterns * interaction timing * consistency between browser signals and observed behaviour --- ## Advanced Bots Advanced bots are designed to imitate legitimate users and avoid traditional detection methods. Characteristics may include: * real browser execution * headless browser technology * fingerprint manipulation * proxy usage * human-like interaction patterns * adaptive behaviour Advanced bots can combine multiple techniques to appear similar to genuine visitors. Detection requires looking beyond individual signals and analysing the relationship between multiple observations. --- ## Untrusted Traffic Sources Some traffic sources may require additional scrutiny based on infrastructure characteristics. Examples include: * suspicious IP addresses * proxy networks * hosting providers * known risky infrastructure * unusual geographic patterns An IP address alone does not determine whether traffic is valid. Legitimate users can share infrastructure, and attackers can change network locations. Infrastructure signals are most useful when combined with behavioural and technical evidence. --- # Why Simple Blocking Approaches Fail ## IP Blocking IP-based blocking can identify some unwanted traffic but has limitations. Challenges include: * changing IP addresses * residential proxies * shared networks * legitimate users behind common infrastructure An IP address is a signal, not an identity. --- ## User-Agent Filtering User-agent strings can provide useful context but are easy to modify. Attackers can: * imitate popular browsers * rotate user agents * hide automation tools --- ## Single Fingerprint Decisions Browser fingerprints provide useful information, but they are not perfect identifiers. They can be: * spoofed * modified * replayed * shared Reliable classification requires combining multiple signals. --- # Signals Used for Analysis Understanding invalid traffic requires analysing multiple layers. --- ## Network Signals Examples: * IP reputation * hosting information * proxy indicators * geographic patterns --- ## Protocol Signals Examples: * HTTP characteristics * TLS fingerprints * request behaviour * connection patterns --- ## Browser Signals Examples: * JavaScript execution * browser consistency * available APIs * rendering behaviour * automation indicators --- ## Behavioural Signals Examples: * navigation patterns * timing * interaction sequences * repeated actions * conversion behaviour --- # Invalid Traffic and Bot Detection Bot detection is an important part of invalid traffic analysis, but the concepts are not identical. A bot describes how traffic was generated. Invalid traffic describes whether that traffic should be trusted for a particular purpose. Examples: | Traffic Source | Automated | Potentially Invalid | | --------------------------- | --------: | ------------------: | | Search crawler | Yes | Depends on context | | Website monitoring service | Yes | Depends on purpose | | Customer browsing a website | No | Usually no | | Fraud automation | Yes | Yes | | Security scanner | Yes | Depends on context | The correct classification depends on the purpose of the analysis. --- # Relationship to Other Topics | Topic | Relationship | | ---------------------- | --------------------------------------------------------------- | | Ad Fraud | Invalid traffic can reduce advertising quality and waste spend. | | Click Fraud | Fraudulent clicks are a type of invalid interaction. | | Bot Detection | Identifies automated traffic sources and behaviours. | | Traffic Classification | Determines how traffic should be categorized. | | Automation Analytics | Provides visibility into automated behaviour and signals. | --- # Key Takeaways * Invalid traffic is broader than simple bot activity. * Request bots, basic automation, and advanced bots require different detection approaches. * Untrusted infrastructure signals are useful but should not be used alone. * Advanced automation attempts to reproduce legitimate browser behaviour. * No single signal can reliably classify all traffic. * Understanding traffic behaviour is more valuable than simply blocking requests. --- # Related Documentation * `ad-fraud.md` * `click-fraud.md` * `bot-detection.md` * `browser-fingerprinting.md` * `traffic-classification.md` * `trust-and-false-positives.md` * `automation-analytics.md`