| 11 | MSISDN Injection | Header contains fake MSISDN | Header Injections |
| 13 | WASPA List | Comes from an App known for being malware | Harmful applications |
| 16 | IP flagged as Unrouteable | IP is known for being Unrouteable | Non-reputable IP addresses |
| 17 | IP flagged as Organization | IP is known for being from an Organization | Non-reputable IP addresses |
| 18 | IP flagged for low reputation | IP is known for having a low reputation | Non-reputable IP addresses |
| 19 | IP flagged for Spam | IP is known for being a source of spam | Non-reputable IP addresses |
| 20 | IP flagged for Abuse | IP is known for abusing | Non-reputable IP addresses |
| 21 | IP flagged for Attacks | IP is known for doing attacks | Non-reputable IP addresses |
| 22 | IP flagged as Anonymizer | IP is known for being an anonymizer | Non-reputable IP addresses |
| 23 | IP flagged as Malware | IP is known for being malware | Non-reputable IP addresses |
| 25 | VPN proxy | IP is known for being a vpn or tor proxy | Proxy Traffic |
| 26 | Web proxy | IP is known for being a web or public proxy | Proxy Traffic |
| 27 | Hosting/CDN proxy | IP is known for being a hosting proxy | Proxy Traffic |
| 31 | Non-PlayStore APK | Comes from an App that is not in the Play Store | Suspicious acquisition |
| 32 | Adult keywords in headers | Referer URL contains adult keywords | Adult acquisition |
| 33 | Click to conversion time anomaly | Time anomaly between user interactions and conversion. | Suspicious conversion patterns |
| 34 | CR above low threshold | Conversion rate of subpublisher for that offer and traffic source is bigger than the low threshold (default 5%) in the last 2 hours | Suspicious conversion patterns |
| 35 | CR above high threshold | Conversion rate of subpublisher for that offer and traffic source is bigger than the high threshold (default 15%) in the last 2 hours | Suspicious conversion patterns |
| 36 | Subpublisher CR Anomaly | Conversion rate of subpublisher for that offer and traffic source compared with the subpublisher general distribution in the last 2 hours has too much difference | Suspicious conversion patterns |
| 51 | Request tampering | Communication between our sensor and servers has been altered | Header Injections |
| 60 | Automated Software | Visitor is performing an automated task | Harmful applications |
| 62 | OS tampering | Visitor's operating system it's not the one it claims to be. | Browser/Device/OS/App Tampering |
| 65 | User Agent tampering | Visitor's User Agent it's not the one it claims to be. | Browser/Device/OS/App Tampering |
| 69 | Google Proxy | IP is known for being a Google proxy | Proxy Traffic |
| 70 | Opera Mini Proxy | IP is known for being an Opera Mini proxy | Proxy Traffic |
| 87 | Invalid App Name | The App name has been manually modified | Header Injections |
| 92 | Bypass attempt | Integrity checksums are broken, revealing attempts to bypass our security measures. | Header Injections |
| 101 | Browser does not support javascript | Browser does not support javascript | Browser/Device/OS/App Tampering |
| 102 | Old generation browser | Browser version is very old and lacks basic capabilities. | Browser/Device/OS/App Tampering |
| 109 | FacebookBot | Visitor is identified as Facebook Bot | GoodBot |
| 110 | GoogleBot | Visitor is identified as Google Bot | GoodBot |
| 111 | YandexBot | Visitor is identified as Yandex Bot | GoodBot |
| 112 | PinterestBot | Visitor is identified as Pinterest Bot | GoodBot |
| 113 | BingBot | Visitor is identified as Bing Bot | GoodBot |
| 115 | OutbrainBot | Visitor is identified as Outbrain Bot | GoodBot |
| 116 | TaboolaBot | Visitor is identified as Taboola Bot | GoodBot |
| 118 | GenericBot | Visitor identifies as a bot by itself but doesn't fall in any of the other categories | GoodBot |
| 119 | GoodBotConversion | Visitor is a good bot but converted | Suspicious conversion patterns |