How do I dispute an incorrect IP or ASN geolocation?
If you believe an IP, CIDR, or ASN is geolocated incorrectly, contact support with the affected IP/CIDR, the location Spur reports, the location you expect, and any authoritative allocation evidence (for example, RIR records). Our research team reviews disputes against observed routing, which can differ from allocation records, before any correction is made.
Similar questions
What signals can indicate possible location spoofing?
Potential indicators include VPN usage, proxy activity, mismatches between an IP's expected and observed location, infrastructure classifications that conflict with expected user behavior, unusual location changes, and inconsistencies between geographic, device, and behavioral information.
Can a Spur IP classification be reviewed or corrected?
Yes. Customers who believe a classification is inaccurate can contact Spur for review. Investigations may include validation of infrastructure ownership, routing characteristics, provider relationships, and other relevant signals.
Why did my Monocle assessment volume suddenly drop?
A sudden drop in assessment volume is usually caused by a change on your side — a recent deployment, a Content Security Policy (CSP) update, or a Cloudflare configuration change — rather than a Spur outage. Check your worker logs and recent configuration changes first. If volume still looks incorrect after that, contact support@spur.us with the time the drop started and any recent changes you made.
How can Spur help organizations identify fraudulent remote workers without creating unnecessary friction?
The most effective approach is to use multiple signals rather than relying on any single indicator. Organizations can combine IP intelligence, identity verification, onboarding controls, and behavioral analytics to identify suspicious infrastructure patterns while minimizing disruption for legitimate candidates and employees. Spur intelligence can help identify infrastructure patterns, anonymization tools, proxy services, and geographic inconsistencies that may be associated with certain remote-work fraud schemes. Most organizations combine Spur data with additional identity, behavioral, and investigative signals.
What indicators may suggest a candidate or worker is masking their location?
Potential indicators include repeated VPN usage, residential proxy activity, frequent geographic inconsistencies, remote-access tooling, rapid location changes, and infrastructure patterns inconsistent with the worker's claimed location.
Related guides & explainers
Quick Search: Finding an IP, ASN, or Service Tag
Use quick search to jump straight to any IP, ASN, or service tag from anywhere in the app, without navigating through menus.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.