---
title: "What does the risks field represent?"
type: "faq"
url: "https://docs.spur.us/knowledgebase/faqs/what-does-the-risks-field-represent"
category: "Spur Platform & Data"
product: "context-api"
publishedAt: "2026-09-15T00:00:00.000Z"
updatedAt: "2026-09-15T14:28:49Z"
---

# What does the risks field represent?

The Context API's risks field is an array of specific risk-factor tags observed for an IP, rather than a single composite score. Current values include AD_FRAUD, CALLBACK_PROXY, GEO_MISMATCH, LOGIN_BRUTEFORCE, TUNNEL, and WEB_SCRAPING — an IP can carry more than one, or none.

## Extended answer

Each value in the risks array corresponds to a specific observed behavior or signal:

AD_FRAUD — the IP has exhibited signs of committing ad fraud

CALLBACK_PROXY — the network can route traffic for residential or malware proxies

GEO_MISMATCH — the datacenter or hosting location differs from the location of its users

LOGIN_BRUTEFORCE — persistent login attempts against web forms have been detected

TUNNEL — the IP is an exit point for an anonymizing VPN, proxy, or tunnel, and traffic is likely associated with that service

WEB_SCRAPING — automated or headless web scraping activity has been observed

risks is deliberately a list of independent signals rather than a single composite score — see why Spur doesn't provide a single risk or reputation score for the reasoning.