What does the risks field represent?
The Context API's risks field is an array of specific risk-factor tags observed for an IP, rather than a single composite score. Current values include AD_FRAUD, CALLBACK_PROXY, GEO_MISMATCH, LOGIN_BRUTEFORCE, TUNNEL, and WEB_SCRAPING — an IP can carry more than one, or none.
Each value in the risks array corresponds to a specific observed behavior or signal:
AD_FRAUD— the IP has exhibited signs of committing ad fraudCALLBACK_PROXY— the network can route traffic for residential or malware proxiesGEO_MISMATCH— the datacenter or hosting location differs from the location of its usersLOGIN_BRUTEFORCE— persistent login attempts against web forms have been detectedTUNNEL— the IP is an exit point for an anonymizing VPN, proxy, or tunnel, and traffic is likely associated with that serviceWEB_SCRAPING— automated or headless web scraping activity has been observed
risks is deliberately a list of independent signals rather than a single composite score — see why Spur doesn't provide a single risk or reputation score for the reasoning.
Similar questions
Why doesn't Spur provide a single risk or reputation score for an IP?
Risk tolerance varies significantly by use case — a bank, an ad network, and an ecommerce platform each weigh the same signal differently. Rather than compress this into one score, Spur exposes the underlying signals so customers can build risk models suited to their own use case.
What information does Spur provide about an IP address?
Depending on the product and integration, Spur may provide intelligence related to VPN usage, residential proxy usage, ISP proxy usage, hosting provider identification, ASN information, risk indicators, network classifications, geographic context, and additional enrichment signals.
Do you have a bulk lookup endpoint?
No. Each IP must be submitted individually to the Context API.
Does the Context API offer historical search?
Enterprise API subscriptions can add historical lookups to their API subscription. Contact your Spur sales rep or sales@spur.us to add this.
How far back does the Historical Context API go?
The Historical Context API covers approximately the past 2 years of data, available as an add-on subscription on Enterprise plans.
Related guides & explainers
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.