What does the risks field represent?
The Context API's risks field is an array of specific risk-factor tags observed for an IP, rather than a single composite score. Current values include AD_FRAUD, CALLBACK_PROXY, GEO_MISMATCH, LOGIN_BRUTEFORCE, TUNNEL, and WEB_SCRAPING — an IP can carry more than one, or none.
Each value in the risks array corresponds to a specific observed behavior or signal:
AD_FRAUD— the IP has exhibited signs of committing ad fraudCALLBACK_PROXY— the network can route traffic for residential or malware proxiesGEO_MISMATCH— the datacenter or hosting location differs from the location of its usersLOGIN_BRUTEFORCE— persistent login attempts against web forms have been detectedTUNNEL— the IP is an exit point for an anonymizing VPN, proxy, or tunnel, and traffic is likely associated with that serviceWEB_SCRAPING— automated or headless web scraping activity has been observed
risks is deliberately a list of independent signals rather than a single composite score — see why Spur doesn't provide a single risk or reputation score for the reasoning.
Similar questions
Why doesn't Spur provide a single risk or reputation score for an IP?
Risk tolerance varies significantly by use case — a bank, an ad network, and an ecommerce platform each weigh the same signal differently. Rather than compress this into one score, Spur exposes the underlying signals so customers can build risk models suited to their own use case.
What information does Spur provide about an IP address?
Depending on the product and integration, Spur may provide intelligence related to VPN usage, residential proxy usage, ISP proxy usage, hosting provider identification, ASN information, risk indicators, network classifications, geographic context, and additional enrichment signals.
Can Spur enrich large volumes of IP addresses?
Yes. Organizations commonly use the Spur Context API and data feeds to enrich IP addresses at scale, enabling proxy detection, VPN identification, infrastructure classification, and geolocation analysis across large datasets.
Do you have a confidence score or last seen date?
Spur operates on a "high confidence" only model to reduce the likelihood of false positives ever making it into our data. Our mentality is that our customers should trust us to decide if something is true rather than providing an arbitrary score to constantly adjust higher or lower. Every API request or Monocle session provides the latest true information for that moment in time. On-prem solutions are updated at their purchased cadence (daily or real-time). We actively purge any result that is no longer true and maintain smart age-offs to maintain the most accurate snapshot of data each day.
How frequently is Spur data updated?
The Context API reflects new intelligence in real time as it becomes available. Data feeds are updated daily, and organizations can also consume updates in real-time through streaming or feed-based workflows depending on operational requirements.