Identify Nation-State Attacks: Expose State-Sponsored Attack Infrastructure.
1 "client": {2 "city": "Weldon Springs"3 "behaviors": ["TOR_PROXY_USER"],4 "concentration": {5 "country": "US",6 "density": 0.202,7 "geohash": "9yz",8 "skew": 45,9 "state": "Missouri",
Nation-state actors rely on shared VPN services, proxy networks, and compromised infrastructure to support reconnaissance, command-and-control, and data exfiltration activity while blending into normal traffic. Spur exposes the infrastructure and routing patterns behind this activity for CTI and threat-hunting teams.
State-Sponsored Campaigns Operate Through Shared Infrastructure.
Advanced and state-sponsored campaigns rarely start on bespoke infrastructure, instead relying on shared networks designed to blend into the open internet. This makes campaign tracking difficult when analysis focuses on malware artifacts or short-lived indicators.
Spur exposes reused infrastructure and routing patterns, helping CTI and threat-hunting teams correlate activity, understand adversary behavior, and track campaigns over time.
How Spur Supports Intelligence-Driven Detection.
Spur provides infrastructure-level intelligence that helps CTI, threat hunting, and incident response teams correlate activity, track adversary infrastructure, and investigate state-sponsored campaigns operating through shared networks.
Evidence You Can Act On.
Spur’s verified IP intelligence helps teams move faster, detect more, and protect what matters – without adding friction for real users.
230M+
Unique anonymized IPs detected every 90 days, distilled into 60M suspect IPs daily
1000+
VPN and proxy services detected
20+
Enrichment attributes for full context (geo, ASN, proxy type, device, tunnel entry/exit, etc.)
Where Spur Strengthens Every Layer of Defense.
Track Campaigns Beyond Fragile Indicators.
Reveal shared infrastructure, correlate activity across targets, and strengthen threat intelligence with durable network-level context.
