Banner / DisplayWhich Criteo publisher domains send bot traffic?
Judge every Criteo visit Valid or Invalid by publisher domain and slot size, and see which domains carry the invalid share before you deny them.
publisher domain in CriteoIn Commerce Growth the buyer types the bad websites or apps into the deny list or imports a .txt/.csv file (a new file overwrites the current list); it takes effect within one hour. In Commerce Max the buyer builds a domain or app list (one domain per line, no http/https, up to 100,000 domains, 255 chars/entry) and applies it to each line item as a block list.
How bot traffic slips in through Criteo publisher domains.
Criteo runs retargeting and acquisition campaigns: personalised product ads, in display and video, shown to visitors who left your site without buying and to new shoppers likely to be interested. The ads appear on publisher websites and apps, some of them reached through supply vendors. Criteo’s Supply Partner Guidelines prohibit sites generated solely to drive advertising revenue — the made-for-advertising (MFA) sites its trust pages name — along with stacked ads and auto-refresh it has not approved. Criteo can pass {{domain}} (the publisher the ad rendered on), {{width}} (the slot), {{adid}} and {{creative_type}}. With each visit’s verdict attributed to its {{domain}} and slot, you can separate a domain that merely converts poorly from one with a structural invalid-traffic problem.
Criteo’s Supply Partner Guidelines define invalid activity as clicks, impressions or conversions generated without legitimate human intent, and they count accidental clicks as well as deliberately fraudulent ones. Two parts of those guidelines describe what can sit behind a paid visit.
Prohibited traffic sources. Publishers may not send Criteo traffic from botnets or crawlers, data centers and hosting facilities, virtual machines, emulators, or proxies that mask where a visitor comes from. Criteo says its own protections and partners defend against invalid traffic. ValidVisit judges each visit that still arrives on its own facts and counts the Invalid ones against the {{domain}} that served them.
Prohibited ad rendering. Stacked ads, hidden ads and auto-refresh without Criteo’s permission are banned, as are placements where people click by mistake and any reward for clicking. These produce clicks from real people who never meant to visit. The remedy sits at the domain: Criteo’s allow and deny controls take websites and apps, not individual slots.
What to watch on Criteo
{{domain}} IVT concentrationSegment your report by {{domain}}. Domains driving a disproportionate share of visit volume alongside Invalid verdicts are the ones to act on. A {{domain}} well below your campaign baseline is a candidate for your Placement Targeting deny list (Commerce Growth) or Domain List (Commerce Max). Criteo fills {{domain}} on web supply only; on app supply it arrives empty, and {{bundle_id}} carries the publisher app instead.
{{width}} invalid share within a domainCompare invalid shares across {{width}} values on the same publisher. {{width}} is the impression slot’s width in pixels — 160 for a 160 by 600 banner — and {{height}} gives the other dimension. A domain that looks acceptable overall but has one slot size whose quality collapses points to a placement problem on that publisher. Criteo’s deny list works by website or app, so the decision is whether to keep the domain or deny it.
What Criteo lets you judge by.
Invalid share broken down by:
- Publisher Domain
{{domain}}
Invalid share broken down by:
- Slot Width
{{width}}
See your own Criteo sub-sources judged this way.
How ValidVisit attributes Criteo traffic
Each Criteo macro maps to a normalized parameter, so every judged visit is pinned to the right campaign, creative and publisher.
https://yoursite.com/landing?utm_source=criteo&utm_medium=banner&vv_campaign_id={{criteo_campaign_id}}&vv_publisher_id={{domain}}&vv_placement_id={{width}}&vv_ad_id={{adid}}&vv_creative_id={{creative_type}}| Token | Criteo macro | Maps to | Identifies |
|---|---|---|---|
| Campaign ID | {{criteo_campaign_id}} | campaign_id | campaign |
| Publisher Domain | {{domain}} | publisher_id | publisher |
| Slot Width | {{width}} | placement_id | placement |
| Ad ID | {{adid}} | ad_id | ad |
| Creative Type | {{creative_type}} | creative_id | creative |
- Criteo macro
{{criteo_campaign_id}}- Maps to
- campaign_id
- Identifies
- campaign
- Criteo macro
{{domain}}- Maps to
- publisher_id
- Identifies
- publisher
- Criteo macro
{{width}}- Maps to
- placement_id
- Identifies
- placement
- Criteo macro
{{adid}}- Maps to
- ad_id
- Identifies
- ad
- Criteo macro
{{creative_type}}- Maps to
- creative_id
- Identifies
- creative
Macros checked against Criteo’s own documentation on 2026-10-02. Criteo docs
The verdict works the same way on every network. ValidVisit never changes your Criteo account: you make the exclusion there yourself. How the verdict works →
Criteo traffic quality, answered.
How do I block a publisher domain in Criteo?
In Commerce Growth: ad set > Refine your targeting > Placement Targeting, where you allow or deny websites and apps (there is also a Supply Vendors toggle). Type the entries in or import a .txt or .csv file; a new file overwrites the current list, and the block takes effect within one hour. In Commerce Max: build the list under Shared Library > Domain/App Lists, then apply it in the line item’s Targeting step under Domain Lists and App Bundle Lists, where the cross icon makes it a block list. Enter domains one per line without http or https.
Is there a limit on blocked domains in Criteo?
For Commerce Max domain lists, an upload takes up to 100,000 domains, with each entry up to 255 characters, and a list has to be added to each line item it should apply to. Criteo’s own blocklists for domains and app bundles are applied to every line item by default, and yours run alongside them.
Retargeting audiences are supposed to be real returning shoppers — how does invalid traffic get in at all?
The audience definition is real, but the supply it renders across is open: publisher websites and apps, some reached through supply vendors. Criteo’s guidelines say a click must come from a human with genuine interest, and they list what breaks that: automated clicking tools, repeated clicks on the same ad unit, and ad implementations that cause accidental clicks. A session can carry your retargeting creative without belonging to a returning shopper; those visits are judged Invalid against the {{domain}} that served them.
Which Criteo values give the most useful segmentation in ValidVisit?
{{domain}} is the highest-leverage value: it maps to the publisher a visit rendered on and is the same dimension Placement Targeting and Domain Lists act on. {{width}} adds slot-level resolution, separating a bad publisher from a bad placement on an acceptable one. {{adid}} and {{creative_type}} show whether a weak pattern is domain-wide or tied to one unit, and {{criteo_campaign_id}} ties each judged visit back to its campaign. Add them in the ad set’s tracking settings, where the suffix option appends parameters to your landing page URLs.
Detect fraud on other banner / display networks
TrafficFactory
TrafficJunky
TwinRed
BIGO Ads
7Search PPC
ExoClickWeighing a blocker for banner / display traffic? How ValidVisit compares to Adscore, TrafficGuard and Opticks.
Find the bots in your Criteo spend.
See which publishers and placements send real buyers vs bots — every visit judged Valid or Invalid, worst first.
Join the waitlist with just your email · 7-day trial at launch
One script · no cookies · no device IDs · raw IP never stored