Device Anomaly Detection
What it detects
Section titled “What it detects”Fraudulent traffic farms often use old, unpatched devices or emulate outdated OS versions to avoid detection. When a disproportionate share of your traffic comes from devices with outdated OS or browser versions — versions rarely seen in legitimate user populations — it indicates bot or device farm activity. Device Anomaly Detection blocks this traffic once it crosses a configurable threshold.
How it works
Section titled “How it works”Integr8 tracks the distribution of OS and browser versions in your traffic. When the percentage of traffic from devices below your configured minimum version exceeds the threshold within the lookback window, clicks from those devices are blocked.
The filter operates at publisher or sub ID level, so a single fraudulent source doesn’t affect your other publishers.
Configuration
Section titled “Configuration”Navigate to Offers > Fraud Detection Groups > select a filter group > Device Anomaly.
| Parameter | Default | Range | Description |
|---|---|---|---|
threshold_percentage |
65% | 1–100% | Percentage of traffic from old devices before blocking activates |
minimum_request_count |
50 | 1–100,000 | Minimum clicks before threshold is evaluated |
lookback_hours |
12 h | 12, 24, 96, 720 h | Time window for measuring device distribution |
min_os_version |
Android 10, iOS 15, macOS 13, Windows 10 | — | Minimum acceptable OS version per platform |
min_browser_version |
Chrome 105, Firefox 105, Safari 14, Edge 105 | — | Minimum acceptable browser version |
The sub ID-level evaluation option (check_by_sub_id) is managed by administrators. Contact your account admin to review or update that setting.
What happens when triggered
Section titled “What happens when triggered”When the threshold is exceeded:
- Clicks from devices below the minimum version requirement are rejected with
fraud_reason: device_anomaly. - The filter auto-recovers when the traffic distribution returns within bounds.
Review blocked traffic in Reports > Click Reports filtered by fraud_reason: device_anomaly.
Related filters
Section titled “Related filters”- Emulator and Bots — detects traffic from emulators and automated tools
- Device ID Check — validates device ID format on incoming requests