Downloading Spur data feeds
Access and Setup
Spur data feed APIs provide bulk download access to large newline-separated JSON files. All files are delivered in gzip format. The feeds are updated at least daily, typically by 0500 UTC. Some feeds and tiers may be updated more frequently.
All feed authentication is performed with a Token header.
HTTP clients must follow redirects to storage.googleapis.com to directly pull files from the feed CDN.
https://feeds.spur.us
Don't have a token yet?
Visit the Spur dashboard and request access to your enterprise organization. Otherwise, please contact your Spur sales representative.
Response Codes
| Code | Description |
|---|---|
200 | The request succeeded. |
403 | Access is denied, your token is most likely invalid. |
500 | An error occurred. |
Anonymous feed
The Anonymous feed includes all infrastructure relating to anonymous VPNs, datacenter proxies, ISP proxies, virtual desktops, and other datacenter-centric anonymizing infrastructure. Each line contains an IP Context Object, indexed by IPv4 or IPv6 Address. An IP Context Object summarizes all available information about the queried IP Address. Some fields are optional and will be excluded if not available.
Fetch the most recent Anonymous feed
Returns a newline-separated JSON file of IP Context Objects.
curl "https://feeds.spur.us/v2/anonymous/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
Fetch Anonymous feed metadata
Returns a Feed Metadata Object pointing to the current Anonymous feed release.
curl "https://feeds.spur.us/v2/anonymous/latest" \-H "Token: $SPUR_TOKEN" -L
{"json": {"location": "20250324/feed.json.gz","date": "20250324","generated_at": "2025-03-24T00:59:41Z","available_at": "2025-03-24T00:59:56Z","filesize": 89553131}}
Fetch historical Anonymous feeds
Historical access to the Anonymous feed is available by date. The date must be in the format YYYYMMDD. Returns a newline-separated JSON file of IP Context Objects for that feed date.
curl "https://feeds.spur.us/v2/anonymous/20250323/feed.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o feed.json.gz
Fetch Anonymous IPv6 feeds
The Anonymous feed is also available for IPv6 network blocks. Returns a newline-separated JSON file of IPv6 Context Objects for that feed date. The Anonymous IPv6 feed also supports feed metadata and historical lookups using the same pattern as the default feed.
curl "https://feeds.spur.us/v2/anonymous-ipv6/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
Anonymous +Residential feed
The Anonymous +Residential data feed includes all IP addresses in the Anonymous data feed, plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure. Each feed line is an IP Context Object, indexed by IPv4 or IPv6 Address.
Fetch the most recent Anonymous +Residential feed
Returns a newline-separated JSON file of IP Context Objects.
curl "https://feeds.spur.us/v2/anonymous-residential/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
Fetch Anonymous +Residential feed metadata
Returns a Feed Metadata Object pointing to the current anonymous-residential feed release.
curl "https://feeds.spur.us/v2/anonymous-residential/latest" \-H "Token: $SPUR_TOKEN" -L
{"json": {"location": "20250325/feed.json.gz","date": "20250325","generated_at": "2025-03-25T01:13:08Z","available_at": "2025-03-25T01:13:22Z","filesize": 632147242}}
Fetch historical Anonymous +Residential feeds
Historical access to the Anonymous +Residential feed is available by date. The date must be in the format YYYYMMDD. Returns a newline-separated JSON file of IP Context Objects for that feed date.
curl "https://feeds.spur.us/v2/anonymous-residential/20250323/feed.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o feed.json.gz
Fetch Anonymous +Residential IPv6 feeds
The Anonymous feed is also available for IPv6 network blocks. Returns a newline-separated JSON file of IPv6 Context Objects for that feed date. The Anonymous IPv6 feed also supports feed metadata and historical lookups using the same pattern as the default feed.
curl "https://feeds.spur.us/v2/anonymous-residential-ipv6/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
Anonymous +Residential Realtime feed
The Anonymous +Residential Realtime feed builds on the daily releases and provides a sliding 5-minute observation window of new detections. Each 5-minute file is de-duplicated by IP address. Each feed line is an IP Context Object. Please note that Realtime-generated Context Objects may lack some fields that are present in the daily feed.
Fetch the most recent Anonymous +Residential Realtime observations
Returns a newline-separated JSON file of IP Context Objects for the latest 5-minute window.
curl "https://feeds.spur.us/v2/anonymous-residential/realtime/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
Fetch the most recent Anonymous +Residential Realtime metadata
Returns a Feed Metadata Object pointing to the current Anonymous +Residential Realtime feed update.
curl "https://feeds.spur.us/v2/anonymous-residential/realtime/latest" \-H "Token: $SPUR_TOKEN" -L
{"json": {"date": "2025-03-25T13:00:04Z","location": "realtime/20250325/1300.json.gz"}}
Fetch historical Anonymous +Residential Realtime observations
Access to historical Anonymous +Residential feed updates is available by date YYYYMMDD and minute HHMM. Returns a newline-separated JSON file of IP Context Objects for that 5-minute window. All times are in UTC.
curl "https://feeds.spur.us/v2/anonymous-residential/realtime/20250323/0000.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o feed.json.gz
Service Metrics Feed
A feed of statistics and metadata for all of the services Spur tracks. This is updated daily. This feed contains newline-separated JSON of the Tag Metadata object. History and metadata are available using the same pattern as the other feeds.
Fetch the most recent Service Metrics feed
Returns newline-separated JSON of Tag Metadata Objects pointing to the current Anonymous +Residential Realtime feed update.
curl "https://feeds.spur.us/v2/service-metrics/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
Datacenter Hosting feed (DCH)
The Datacenter Hosting feed (DCH) is a netblock-organized feed of all IPv4 and IPv6 addresses belonging to datacenter infrastructure. These networks are specifically for leased or cloud infrastructure, typically in a hosting or server facility. If user traffic is observed from these networks, it is likely distinct from the physical location of the IP.
Fetch the most recent DCH feed
Returns a newline-separated JSON of DCH Objects:
Attributes
The autonomous system number.
The IPv4 or IPv6 network address in CIDR notation.
The registered organization for this block.
curl "https://feeds.spur.us/v2/dch/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
{"asn": 396982,"network": "34.32.0.0/11","organization": "Google LLC"}
IP Geo feed
The NEW Spur IP Geo feed (currently in early release/beta) is a netblock-organized feed of all IPv4 and IPv6 addresses and their corresponding IP geolocation. See our announcement blog for more information.
Fetch the most recent IP Geo feed as mmdb
Returns an mmdb file of IP indexed IP Geo objects
curl "https://feeds.spur.us/v2/ipgeo/latest.mmdb" \-H "Token: $SPUR_TOKEN" -L \-o latest.mmdb
Fetch the most recent IP Geo feed as JSON
Returns an new line separated json file of IP Geo objects
curl "https://feeds.spur.us/v2/ipgeo/latest.json.gz" \-H "Token: $SPUR_TOKEN" -L \-o latest.json.gz
The IP Geo object
Attributes
The IP network in CIDR notation (IPv4 or IPv6).
The autonomous system number responsible for the prefix.
The name of the organization that owns the ASN.
The city associated with the prefix, based on geolocation data.
The state, province, or region associated with the prefix.
Two-letter ISO 3166-1 alpha-2 country code.
The subnet mask length (e.g., 24 for a /24).
{"prefix": "190.103.9.0/24","asn": 13316,"asn_name": "SES Sistemas Electrónicos S.A.","city": "Buenos Aires","state": "Buenos Aires F.D.","country_code": "AR","mask": 24}
The IP Context object
The IP Context object summarizes all available information for an IP Address. It is provided as a single dictionary. All fields not explicitly marked as required may be omitted when the value is null.
Attributes
Container for BGP autonomous system information.
Descriptive data about the connecting client.
Infrastructure type.
IPv4 address associated with the connection.
Location information of the IP or user.
List of identified risk factors or behaviors.
List of services or protocols in use (e.g., OPENVPN, IPSEC).
Information about tunneling methods (VPN, TOR, etc.) used.
{"as": {"number": 30083,"organization": "AS-30083-GO-DADDY-COM-LLC"},"client": {"behaviors": ["TOR_PROXY_USER"],"concentration": {"city": "Weldon Spring","country": "US","density": 0.202,"geohash": "9yz","skew": 45,"state": "Missouri"},"count": 14,"countries": 1,"proxies": ["LUMINATI_PROXY", "SHIFTER_PROXY"],"spread": 4941431,"types": ["MOBILE", "DESKTOP"]},"infrastructure": "DATACENTER","ip": "148.72.164.186","location": {"city": "St Louis","country": "US","state": "Missouri"},"risks": ["WEB_SCRAPING", "TUNNEL"],"services": ["IPSEC", "OPENVPN"],"tunnels": [{"anonymous": true,"entries": ["148.72.164.179"],"exits": ["148.72.164.177"],"operator": "NORD_VPN","type": "VPN"}]}
The IPv6 Context object
The IPv6 Context object summarizes all available information for a network block of IPv6 Addresses. The network field replaces the ip field from the IP Context Object. All fields not explicitly marked as required may be omitted when the value is null.
Attributes
Container for BGP autonomous system information.
Descriptive data about the connecting client.
Infrastructure type, e.g., DATACENTER, MOBILE, SATELLITE, etc.
IPv6 network in CIDR notation associated with the data.
Location information of the netblock.
List of identified risk factors or behaviors.
List of services or protocols in use (e.g., OPENVPN, IPSEC).
Information about tunneling methods (VPN, TOR, etc.) used.
{"network": "2a02:6ea0:d802:5517::15/128","organization": "Datacamp Limited","as": {"number": 60068,"organization": "Datacamp Limited"},"client": {"proxies": ["NETNUT_PROXY"]},"tunnels": [{"operator": "PROTON_VPN","type": "VPN","anonymous": true}],"infrastructure": "DATACENTER","location": {"city": "Seattle","state": "Washington","country": "US"},"risks": ["CALLBACK_PROXY", "TUNNEL"]}
The Feed Metadata object
Attributes
Container for information about a JSON feed release.
{"json": {"location": "20250324/feed.json.gz","date": "20250324","generated_at": "2025-03-24T00:59:41Z","available_at": "2025-03-24T00:59:56Z","filesize": 89553131}}
The Tag Metadata object
The Tag Metadata object includes analysis, statistics, and metrics for a service tag.
Attributes
Whether the service supports or facilitates crypto-based payments or platforms.
Whether the service is available for free usage.
Whether the service offers multi-hop or chaining functionalities.
Whether the service permits torrent or P2P file-sharing traffic.
Indicates whether white-label or rebranded versions of the service exist.
Product categories for bandwidth reselling and routing.
A free-text description of the service or entity.
Whether the service or infrastructure primarily aims to anonymize user traffic.
Whether the service includes callback or reverse-proxy functionalities.
Whether the service or platform is oriented toward enterprise usage.
Whether the service is currently inactive or defunct.
Whether the service claims a 'no logging' policy.
Human-readable name of the service or entity.
Operating systems and environments supported by this service.
Protocols or services used for network traffic.
Unique identifier or tag for this service or entity.
Possible granularities for configuring a service exit or route.
Primary website or homepage for the service.
{"allowsCrypto": "false","allowsFreeAccess": "false","allowsMultihop": "false","allowsTorrents": "false","allowsWhiteLabel": "true","categories": ["RESIDENTIAL_PROXY", "DATACENTER_PROXY", "MOBILE_PROXY", "ISP_PROXY"],"description": "OxyLabs is the second largest proxy provider tracked. Their users are sourced through SDKs embedded in mobile applications and browser extensions. These users are likely unaware that they agreed to contribute to this proxy network.","isAnonymous": "true","isCallbackProxy": "true","isEnterprise": "false","isInactive": "false","isNoLog": "true","metrics": {"averageDeviceCount": "37.20332478669546","churnRate": "0.08675012801772562","distinctASNs": "25334","distinctCountries": "235","distinctIPs": "6367903","distinctISPs": "67413"},"name": "Oxylabs","platforms": ["ROUTER"],"protocols": [],"tag": "OXYLABS_PROXY","targetingTypes": ["CITY", "STATE", "COUNTRY", "ASN"],"website": "https://oxylabs.io"}
Frequent Questions
How do I download the feed in mmdb or csv format?
We have a feed export utility available to all feed customers. See the integrations page for more information.
Can an IP Address be repeated in each feed?
No. An IP Address will only appear once per feed in a single line.
What is the difference between the Anonymous and Anonymous-Residential feeds?
The Anonymous +Residential feed is about twice the size of the Anonymous feed and includes IPs with residential proxies, malware proxies, or other device-based proxy services. The Anonymous feed is more focused on datacenter-centric anonymizing services.
How do I get access to the feeds?
Contact your Spur data point of contact or our sales team at sales@spur.us.
How do I report a false positive or other error?
Please search for the entity in the Spur Dashboard and use the "Report" button to submit a report.
Why are many IP Addresses based in the United States?
Many foreign threat actors seek to use US-based infrastructure to obfuscate their true location. The US has the largest number of VPN and proxy exit IPs.
What about IPv6?
Our feeds do include IPv6 identifications for a full /128 IP. We also have netblock-based IPv6-specific versions of our primary feeds.
What is the difference between the data feeds and the Context API?
The data feeds are slices of IP Context data designed to be ingested internally by your organization for bulk use. The feeds are the most interesting subsets of Spur's data. Our Context API is a hosted version of all of our IP data.