Sourced Traffic

UpdatedOctober 19, 2026

Definition & Explanation

Sourced traffic is any visit a publisher pays a third party to deliver, as opposed to visits that arrive on their own through direct navigation, organic search, or an existing audience. The publisher is buying visitors in order to sell the impressions those visitors generate.

The term covers a wide range of practices, and the quality of the resulting audience varies with the method:

Paid distribution: promoted posts on social platforms, paid search, and placements in content recommendation widgets. The visitor makes a choice to click and arrives on a page they intended to see.
Traffic brokers and audience extension vendors: intermediaries that sell visits in bulk, often at a fixed price per thousand sessions, with limited disclosure of where those sessions originate.
Pop-under and redirect networks: the publisher’s page is opened in a new tab or window behind the user’s active browser, or the user is forwarded to it mid-navigation. The visit is recorded, but the user never chooses it and often never sees it.

What separates these methods is intent. A reader who clicks a promoted headline is a real person with some interest in the content. A session opened by a pop-under behind another window has no interest at all, and a session bought from an opaque broker at a fraction of a cent may not have a person behind it.

The economics are the same in every case. A publisher sources traffic when the ad revenue earned per session exceeds the cost of acquiring that session. That arbitrage is the business model of MFA sites, and it explains why the cheapest traffic sources attract the heaviest use: the lower the acquisition cost, the wider the margin.

Why It Matters

Sourced traffic is where most bot activity enters a legitimate website. Bots generally arrive because someone paid a traffic source to send them, with three consecutive ANA studies finding that purchased visits carry several times the IVT rate of organic ones.

The advertiser pays for this without seeing it. A bid request describes the page and the user, not how the user got there, so an impression served to an organic reader and one served to a session bought from a broker look identical at the point of purchase. Whatever share of that sourced session is invalid becomes spend with no audience behind it.

Valid sourced traffic still underperforms. A visitor who arrived through a clickbait placement or a forced redirect has a weaker connection to the content than one who sought it out, which shows up as shorter sessions, lower user engagement, and fewer conversions. Pop-under traffic is the extreme case. The page loads and the ads render in a window the user is not looking at, so impressions are counted with no opportunity to be seen. Viewability measurement may or may not catch it, depending on how the hidden window reports its state.

The cost of acquisition also shapes the page itself. A publisher who pays for every visit has to earn that money back within the session, which pushes toward higher ad density, faster ad refresh, and slideshow layouts that multiply pageviews. Sourced traffic is rarely the only quality problem on a site that depends on it.

For publishers, the risk is concentrated in the source. Paid distribution through reputable platforms is an ordinary audience development practice, and many premium publishers use it. Buying from brokers who cannot account for where their sessions come from exposes the publisher to IVT clawbacks, demand partner removal, and inclusion on buyer exclusion lists.

Sourced Traffic Across the Ecosystem

The ANA and White Ops Bot Baseline studies put numbers on the problem. The 2014 study found a bot rate of 52% on traffic that publishers had bought from third parties (1). The 2015 study found sourced traffic carried more than three times the bot percentage of the study average (2), and the 2016 to 2017 edition measured 3.6 times as much fraud in sourced traffic as in non-sourced traffic (3). That last report also identified the competitive dynamic underneath: publishers paying full price for legitimate search traffic compete against publishers paying far less for bot traffic.

The MRC addressed sourcing directly in its Invalid Traffic Detection and Filtration Standards Addendum, finalized on June 25, 2020 (4). It defines sourced traffic as anything that did not originate from direct URL entry, site search, or app download and initiation, and divides it into four categories: Affiliate, Referral, Search, and Purchased. Purchased traffic is the category held to the strictest treatment. It must be segmented in reporting, the ultimate source must be known to at least the intermediary on a per-impression basis, and it must pass IVT detection and filtration by either the purchaser or the originator. Buying traffic from a third party does not transfer responsibility for its validity.

Sourcing is also written into the industry definition of MFA. The September 2023 definition published by the ANA, 4A’s, WFA, and ISBA lists a high percentage of paid traffic sourcing among the core characteristics of an MFA site and names traffic acquisition as the primary cost of running one (5). The ANA study that preceded it found MFA sites accounted for 21% of impressions and 15% of spend.

Disclosure remains the weak point. The MRC requirements bind accredited measurement organizations, and they depend on publishers and intermediaries declaring their purchased traffic. No field in the bid request carries that declaration to the buyer. A DSP evaluating an impression has no native way to know whether the session behind it was earned or bought, which leaves pre-bid filtering on third-party domain signals as the practical control.

Sourced Traffic in DeepSee.io Metrics

We flag traffic delivered by pop-under and redirect networks, and traffic volume that moves in ways an organic audience does not.

The first is the pop_sourced flag, one of our high risk signals this flag is set when a site sources traffic from pop-under or redirect networks. Sites that receive this traffic tend to open out of the user’s view, in a new tab or a new window, so the ads on them load for an audience that did not ask to be there. This is the receiving side of a behavior we also track at its origin: the pop_creator flag identifies sites that expose their visitors to unwanted pop-ups and redirects, and avg_pop_ups and avg_redirects report how often that happens during our visits.

The second is the big_mover_flag. It is true when a site’s global ranking is highly irregular, marked by large spikes and troughs. Organic audiences grow and decline gradually. A site that jumps and falls sharply in rank is usually one whose traffic is switched on and off with a media budget.

Both fields are Boolean and are available in the domain export and via API. Read alongside the MFA flag, newly registered status, ad density, and ad refresh timing, they provide an overview of the domain’s audience and the user experience on a site.

Sources

Tags: