What are the exact boundary semantics of the Anonymous +Residential Realtime feed's 5-minute window?
The window is inclusive of the start time and exclusive of the end time. For example, the file at /v2/anonymous-residential/realtime/<YYYYMMDD>/1300.json.gz covers detections from 12:55:00 up to and including 12:59:59 UTC — 13:00:00 is not included and appears in the next file (1305.json.gz) instead. When consuming consecutive 5-minute files, each detection belongs to exactly one file, so there's no gap or double-processing at the boundary between files.
Similar questions
What is the difference between the Anonymous and Anonymous-Residential feeds?
The Anonymous+Residential feed includes everything in the Anonymous feed plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure — so it's larger and broader in scope. The Anonymous feed on its own is more focused on datacenter-centric anonymizing services.
How do I verify the integrity of a downloaded feed file?
Checksum information is provided in the download response headers — look for a header such as x-goog-hash and use the algorithm and value it specifies to verify. Don't treat the ETag as an MD5 checksum; it isn't one.
Why did a feed file change size or filename?
Feed files can change in size or filename when Spur makes a planned change to a feed's publication — for example, an updated data source or schema version. If an automated ingestion process depends on a specific filename, use the documented stable download mechanism rather than relying on a fixed filename pattern. If a change looks unexpected, contact support with the feed name, version, and the date you noticed the difference.
When should I use the Exports API?
The Exports API is designed for environments where pre-processing isn't possible — for example, direct integration into a SIEM, IPS, or firewall. If you need full feed data, download the entire feed and perform your own transformation locally.
Why might a feed result differ from an API lookup for the same IP?
Data feeds are point-in-time snapshots, while the API can return more current, near-real-time data. A timestamp gap between feed generation and your API query is the most common cause of a difference.
Related guides & explainers
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
Understanding Monocle Application Health Status
Each Monocle application shows a health status badge indicating whether it's actively sending traffic. Learn what each color means and what to check if an application goes quiet.