What is the difference between the Anonymous and Anonymous-Residential feeds?
The Anonymous+Residential feed includes everything in the Anonymous feed plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure — so it's larger and broader in scope. The Anonymous feed on its own is more focused on datacenter-centric anonymizing services.
Similar questions
What are the exact boundary semantics of the Anonymous +Residential Realtime feed's 5-minute window?
The window is inclusive of the start time and exclusive of the end time. For example, the file at /v2/anonymous-residential/realtime/<YYYYMMDD>/1300.json.gz covers detections from 12:55:00 up to and including 12:59:59 UTC — 13:00:00 is not included and appears in the next file (1305.json.gz) instead. When consuming consecutive 5-minute files, each detection belongs to exactly one file, so there's no gap or double-processing at the boundary between files.
What is the difference between the data feeds and the Context API?
Data feeds are slices of IP Context data designed for bulk ingestion — the most interesting subsets of Spur's data. The Context API is a hosted, queryable version of all of Spur's IP data.
When should I use the Exports API?
The Exports API is designed for environments where pre-processing isn't possible — for example, direct integration into a SIEM, IPS, or firewall. If you need full feed data, download the entire feed and perform your own transformation locally.
Why are many IP addresses based in the United States?
Many foreign threat actors use US-based infrastructure to obfuscate their true location. The US has the largest number of VPN and proxy exit IPs.
Why did a feed file change size or filename?
Feed files can change in size or filename when Spur makes a planned change to a feed's publication — for example, an updated data source or schema version. If an automated ingestion process depends on a specific filename, use the documented stable download mechanism rather than relying on a fixed filename pattern. If a change looks unexpected, contact support with the feed name, version, and the date you noticed the difference.
Related guides & explainers
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.