Why doesn't Spur provide a single risk or reputation score for an IP?
Risk tolerance varies significantly by use case — a bank, an ad network, and an ecommerce platform each weigh the same signal differently. Rather than compress this into one score, Spur exposes the underlying signals so customers can build risk models suited to their own use case.
Similar questions
What does "client count" mean in Spur's data?
It's Spur's count of instances or connections observed from a given IP. As a general signal, a high count often points to shared infrastructure such as carrier-grade NAT, where many users' traffic passes through the same address, while a low count is more consistent with dedicated, single-tenant infrastructure. Treat it as a supporting signal alongside other data rather than a definitive classification on its own.
Should Spur data be used as a blocking list?
Generally, no. Spur is designed to provide context and intelligence rather than a simple allow/block decision. Most organizations achieve the best results when Spur data is incorporated into broader risk models and decisioning workflows.
How can Spur IP intelligence help prevent payment fraud?
Spur IP intelligence adds context about the infrastructure behind a transaction, including VPN usage, proxy activity, network type, geographic consistency, and historical risk indicators. These signals can be incorporated into fraud models to improve decision-making and reduce both false positives and false negatives.
Can Spur IP intelligence help reduce account takeover risk without creating friction for legitimate users?
Rather than blocking traffic solely based on IP addresses, organizations can use Spur IP intelligence as a risk signal within adaptive authentication workflows. Signals such as VPN usage, proxy activity, infrastructure type, and geographic inconsistencies can help determine when additional verification is appropriate while allowing low-risk users to proceed normally.
Does Spur identify legitimate privacy-focused users as well as malicious actors?
Spur identifies infrastructure characteristics and anonymization technologies, not intent. Organizations determine how to use those signals based on their business requirements, risk tolerance, and policies.
Related guides & explainers
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Quick Search: Finding an IP, ASN, or Service Tag
Use quick search to jump straight to any IP, ASN, or service tag from anywhere in the app, without navigating through menus.
Switching Between Organizations
If your account belongs to more than one Spur organization, use the Organization Switcher to move between them and manage each organization's plan and settings separately.