What does "client count" mean in Spur's data?

What does "Client Proxies" mean in Spur's data?

It refers to proxy client ecosystems or networks observed interacting through an IP, based on Spur telemetry. It does not mean the IP is owned or operated by the named provider — only that related activity was observed from it.

Why doesn't Spur provide a single risk or reputation score for an IP?

Risk tolerance varies significantly by use case — a bank, an ad network, and an ecommerce platform each weigh the same signal differently. Rather than compress this into one score, Spur exposes the underlying signals so customers can build risk models suited to their own use case.

Why might a feed result differ from an API lookup for the same IP?

Data feeds are point-in-time snapshots, while the API can return more current, near-real-time data. A timestamp gap between feed generation and your API query is the most common cause of a difference.

How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?

Spur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.

What is CGNAT, and why does it complicate IP-based fraud detection?

CGNAT (Carrier-Grade NAT) lets a mobile carrier or ISP route many customers' traffic through a single public IP address. That means one IP can represent thousands of different devices and a mix of legitimate and malicious users, which makes IP-based signals alone less reliable — additional context is needed to distinguish individual users sharing that address.