If Spur identifies a provider such as NetNut, does that mean the traffic originated directly from that provider's customer?
Not necessarily. Proxy ecosystems often involve resellers, downstream providers, SDK operators, and shared infrastructure. A provider label identifies infrastructure associated with the traffic but should not be treated as attribution of a specific end user without additional evidence and investigation.
Similar questions
What does Spur do?
Spur provides IP intelligence that helps organizations identify anonymization technologies to make more informed security, fraud prevention, and trust decisions.
What products does Spur offer?
Spur delivers IP intelligence as bulk daily downloads, through API integration into existing security pipelines, and via real-time session enrichment.
What types of organizations use Spur?
Spur is used by security and threat hunting teams, fraud prevention teams, and trust and safety organizations in cybersecurity vendors, software companies, financial services companies, e-commerce platforms, law enforcement agencies, and organizations that need deeper insight into IP-based activity.
How accurate are Spur's classifications?
Spur continuously updates classifications using automated systems and ongoing research. Accuracy can vary depending on infrastructure changes and evolving proxy technologies, but classifications are designed to provide actionable intelligence rather than relying on a single static signal.
How do I dispute an incorrect IP or ASN geolocation?
If you believe an IP, CIDR, or ASN is geolocated incorrectly, open it in the Spur app and select the Report button (the warning-triangle icon) on its IP or ASN page. Choose Incorrect Labels, and under Additional information give the location Spur reports, the location you expect, and the evidence behind it. For a range, report one IP from it and list the full CIDR in your message. Your own measurements, such as traceroute or latency results from a known location, are the most useful. Registration records and other providers' results are helpful context, but Spur locates IPs from observed network measurement, so our research team reviews each report against that before making any correction. If you don't have access to the Spur app, email support@spur.us with the same details.
Related guides & explainers
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
Quick Search: Finding an IP, ASN, or Service Tag
Use quick search to jump straight to any IP, ASN or service tag, a Monocle app, or a main area of the app, from anywhere, without navigating through menus.