Why does my Monocle assessment count not match my page views?
Monocle usage is counted per request to the assessment endpoint, not per page load — the two figures aren't necessarily one-to-one. Retries, single-page-app navigation triggering re-assessment, multiple frames or iframes each calling the endpoint, and edge/worker assessments running alongside browser assessments can all increase the assessment count relative to page views.
Similar questions
Do you have a confidence score or last seen date?
Spur operates on a "high confidence" only model to reduce the likelihood of false positives ever making it into our data. Our mentality is that our customers should trust us to decide if something is true rather than providing an arbitrary score to constantly adjust higher or lower. Every API request or Monocle session provides the latest true information for that moment in time. On-prem solutions are updated at their purchased cadence (daily or real-time). We actively purge any result that is no longer true and maintain smart age-offs to maintain the most accurate snapshot of data each day.
If Spur identifies a provider such as NetNut, does that mean the traffic originated directly from that provider's customer?
Not necessarily. Proxy ecosystems often involve resellers, downstream providers, SDK operators, and shared infrastructure. A provider label identifies infrastructure associated with the traffic but should not be treated as attribution of a specific end user without additional evidence and investigation.
How can I download data on all IPv4 and IPv6 addresses?
IP location, routing, and ownership information is produced at the network level and presented into netblocks. Other data such as client fields or service attributions are produced on an individual IP address basis. For our API customer this coverage is automatically merged to produce full IPv4 and IPv6 coverage. For on-prem services, a combination of these two granularities must be used to cover all IP space.
How fast does Spur detect a VPN or Proxy?
New VPNs or proxies are typically identified within 24-48 hours depending on where it is hosted and how it is being used. Monocle will detect all new VPNs and proxies on first use. All new identifications are available immediately in our API products. On-prem solutions will be update on their next update cadence or in real-time if that option has been added.
Why aren't CDNs, WAFs, and CAPTCHA solutions enough to stop fraudulent account creation?
These technologies are important security controls, but they primarily focus on traffic patterns, application security, and automation detection. Sophisticated fraud operations often distribute activity across thousands of IPs and use realistic browser behavior. Spur IP and session intelligence provide additional context about the infrastructure behind a request, helping organizations distinguish legitimate users from coordinated abuse.