What does the risks field represent?
The Context API's risks field is an array of specific risk-factor tags observed for an IP, rather than a single composite score. Current values include AD_FRAUD, CALLBACK_PROXY, GEO_MISMATCH, LOGIN_BRUTEFORCE, TUNNEL, and WEB_SCRAPING — an IP can carry more than one, or none.
Each value in the risks array corresponds to a specific observed behavior or signal:
AD_FRAUD— the IP has exhibited signs of committing ad fraudCALLBACK_PROXY— the network can route traffic for residential or malware proxiesGEO_MISMATCH— the datacenter or hosting location differs from the location of its usersLOGIN_BRUTEFORCE— persistent login attempts against web forms have been detectedTUNNEL— the IP is part of an anonymizing VPN, proxy, or tunnel service, as an entry point or an exit point depending on the operator. Traffic from an exit point is likely associated with that service.tunnels[].entriesandtunnels[].exitslist the other end of each tunnel and may be empty or absentWEB_SCRAPING— automated or headless web scraping activity has been observed
risks is deliberately a list of independent signals rather than a single composite score — see why Spur doesn't provide a single risk or reputation score for the reasoning.
Similar questions
Why doesn't Spur provide a single risk or reputation score for an IP?
Risk tolerance varies significantly by use case — a bank, an ad network, and an ecommerce platform each weigh the same signal differently. Rather than compress this into one score, Spur exposes the underlying signals so customers can build risk models suited to their own use case.
What information does Spur provide about an IP address?
Depending on the product and integration, Spur may provide intelligence related to VPN usage, residential proxy usage, ISP proxy usage, hosting provider identification, ASN information, risk indicators, network classifications, geographic context, and additional enrichment signals.
Do you have a bulk lookup endpoint?
No. Each IP must be submitted individually to the Context API.
Does the Context API offer historical search?
Enterprise API subscriptions can add historical lookups to their API subscription. Contact your Spur sales rep or sales@spur.us to add this.
What IP addresses does the Context API use?
The Context API is served from api.spur.us over HTTPS on port 443, so the simplest firewall rule is to allow that hostname. If your firewall can only allow IP addresses, allow Spur's fixed addresses: 136.82.115.246 (IPv4) and 2600:1901:0:448b:: (IPv6). api.spur.us used to be served from Google's shared IP addresses, which change. If you allowed those instead of the hostname and Context API requests now time out or can't connect, add the two addresses above. See Network and firewall in the Context API docs: https://docs.spur.us/context-api#network-and-firewall
Related guides & explainers
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.