Why doesn't Spur provide a single risk or reputation score for an IP?

What does "client count" mean in Spur's data?

It's Spur's count of instances or connections observed from a given IP. As a general signal, a high count often points to shared infrastructure such as carrier-grade NAT, where many users' traffic passes through the same address, while a low count is more consistent with dedicated, single-tenant infrastructure. Treat it as a supporting signal alongside other data rather than a definitive classification on its own.

Should Spur data be used as a blocking list?

Generally, no. Spur is designed to provide context and intelligence rather than a simple allow/block decision. Most organizations achieve the best results when Spur data is incorporated into broader risk models and decisioning workflows.

How can Spur IP intelligence help prevent payment fraud?

Spur IP intelligence adds context about the infrastructure behind a transaction, including VPN usage, proxy activity, network type, geographic consistency, and historical risk indicators. These signals can be incorporated into fraud models to improve decision-making and reduce both false positives and false negatives.

Can Spur IP intelligence help reduce account takeover risk without creating friction for legitimate users?

Rather than blocking traffic solely based on IP addresses, organizations can use Spur IP intelligence as a risk signal within adaptive authentication workflows. Signals such as VPN usage, proxy activity, infrastructure type, and geographic inconsistencies can help determine when additional verification is appropriate while allowing low-risk users to proceed normally.

Does Spur identify legitimate privacy-focused users as well as malicious actors?

Spur identifies infrastructure characteristics and anonymization technologies, not intent. Organizations determine how to use those signals based on their business requirements, risk tolerance, and policies.