The Spur Relay: Anonymized Threat Briefing - Q4 2025
11.21.2025
The Spur Relay is a quarterly technical briefing from Spur — a must-watch briefing where Spur Intelligence Labs presents the quarter’s most important proxy-driven findings, insights from SDK/app supply chains, and practical detection guidance.
In this edition, we cover:
- KOOKEEY_PROXY: New service we track and its sourcing through a popular Android & iOS app developer.
- ANYIP_PROXY: A sneaky Solitaire app update that injected the AnyIP SDK. • 200M+ proxy IPs: What 90-day counts of 200M+ distinct IPs mean for churn, scoring, and detection.
- NSocks resurgence: What we’re seeing, where it’s coming from, and detection implications.
- Xsocks & white-labeling: Mapping how bigmama is being white-labeled and what that means for attribution.
See the Difference Between Raw Data & Real Intelligence
Start enriching IPs with Spur to reveal the residential proxies, VPNs, and bots hiding in plain sight.