Spur
IP context, Monocle session assessments, and investigation tools in the Spur platform.
Synthient vs Spur
Identify proxy and VPN providers, enrich live decisions, and power your warehouse with Synthient. Get provider and behavior intelligence through the Lookup API, hourly Parquet snapshots, and continuous Firehose streams.
Choose Synthient to put provider intelligence directly into your detection workflow. Connect IP lookups, warehouse analysis, and live observations with data your team can use in its own systems.
IP context, Monocle session assessments, and investigation tools in the Spur platform.
Identify providers, investigate observed behavior, and feed your own rules and warehouse through API, Parquet, and Firehose delivery.
Published provider coverage across Synthient’s intelligence platform.
Unique tags counted September 28: 934 VPN, 329 proxy, and 35 other tags.
Included in the Researcher plan. Pricing is tailored to your workload.
See how Synthient fits your detection, investigation, and data workflows.
| Capability | Synthient | SpurDocumented offering |
|---|---|---|
| IP enrichment | IPv4 and IPv6 lookups with provider, network, behavior, and risk fields. | IPv4 and IPv6 context with infrastructure, clients, risks, and tunnels. |
| Provider attribution | Provider records alongside device and behavior observations. | Named tunnel operators and client proxy services; 1,298 unique tags in the public service directory. |
| Bulk delivery | Hourly Parquet snapshots and daily rollups, with checksums and schema metadata. | Daily gzip-compressed JSON feeds and Realtime files with five-minute observation windows. |
| Live updates | Continuous NDJSON over a long-lived HTTP connection. | Real-time Context API and streaming updates. The Realtime file feed uses five-minute windows, deduplicated by IP. |
| Published API access | Researcher includes 4M monthly lookups. Plans are priced for your volume and delivery requirements. | Teams: 50k calls from $200/month. Pro: 1M calls from $1,600/month, billed monthly. |
| Evaluation | Scoped evaluations for qualified teams; public live lookup available. | Community: 250 manual lookups and 100k Monocle assessments; no Context API calls. |
Capabilities and included volumes reflect the plans and products named above.
Put Synthient’s observations where your team makes decisions. Enrich individual IPs, analyze bulk data, and consume new events through the delivery method your workflow needs.
Identify the provider behind an IP and use observed behavior to inform your risk rules.
Feed your analysis with hourly Parquet snapshots. Row counts, schemas, and checksums help you verify every import.
Bring new observations into your detection pipeline through Firehose’s continuous NDJSON stream.
Bring your use case to our team. Evaluate the data on your traffic and choose the access your integration needs.
Bring a sample of your traffic. Inspect the providers, devices, and behavior Synthient returns for the IPs that matter to your team.
Evaluate lookup responses and feed samples against your integration requirements. Choose API, Parquet, or Firehose access for your pipeline.
Tell us your volume, delivery, and support needs. Get a scoped commercial quote for putting Synthient into production.
Synthient’s lookup response combines attributed proxy and VPN providers, observation timestamps, device observations, behavior signals, and a risk score. Use the available evidence to investigate an IP and inform your rules.
Synthient quotes access around your lookup volume, delivery methods, licensing, and support. The Researcher plan includes 4M monthly lookups. Bring your requirements to get a scoped quote.
Use our Spur migration guide to map authentication and response fields. Run Synthient alongside your existing integration, validate your risk rules, and switch after testing. Request a demo to discuss your rollout.
We counted 1,298 unique tag identifiers in Spur’s public Service Tags directory on September 28, 2026, removing two duplicate entries. Of these, 934 end in _VPN, 329 in _PROXY, and 35 have other names. This measures published service tags, not unique IPs or detection accuracy.
See provider intelligence on your traffic. Talk to our team about API, Parquet, and Firehose access, and get a plan for your integration.