How do I report a false positive or other error in feed data?

When should I use the Exports API?

The Exports API is designed for environments where pre-processing isn't possible — for example, direct integration into a SIEM, IPS, or firewall. If you need full feed data, download the entire feed and perform your own transformation locally.

How do I dispute an incorrect IP or ASN geolocation?

If you believe an IP, CIDR, or ASN is geolocated incorrectly, open it in the Spur app and select the Report button (the warning-triangle icon) on its IP or ASN page. Choose Incorrect Labels, and under Additional information give the location Spur reports, the location you expect, and the evidence behind it. For a range, report one IP from it and list the full CIDR in your message. Your own measurements, such as traceroute or latency results from a known location, are the most useful. Registration records and other providers' results are helpful context, but Spur locates IPs from observed network measurement, so our research team reviews each report against that before making any correction. If you don't have access to the Spur app, email support@spur.us with the same details.

Why did a feed file change size or filename?

Feed files can change in size or filename when Spur makes a planned change to a feed's publication — for example, an updated data source or schema version. If an automated ingestion process depends on a specific filename, use the documented stable download mechanism rather than relying on a fixed filename pattern. If a change looks unexpected, contact support with the feed name, version, and the date you noticed the difference.

How can I download data on all IPv4 and IPv6 addresses?

IP location, routing, and ownership information is produced at the network level and presented into netblocks. Other data such as client fields or service attributions are produced on an individual IP address basis. For our API customer this coverage is automatically merged to produce full IPv4 and IPv6 coverage. For on-prem services, a combination of these two granularities must be used to cover all IP space.

What are the exact boundary semantics of the Anonymous +Residential Realtime feed's 5-minute window?

The window is inclusive of the start time and exclusive of the end time. For example, the file at /v2/anonymous-residential/realtime/<YYYYMMDD>/1300.json.gz covers detections from 12:55:00 up to and including 12:59:59 UTC — 13:00:00 is not included and appears in the next file (1305.json.gz) instead. When consuming consecutive 5-minute files, each detection belongs to exactly one file, so there's no gap or double-processing at the boundary between files.