Spur provides a cohesive and comprehensive IP intelligence service that is simple to use, understand, parse, and integrate into your SOC workflows, security product, or even just monitoring your home network (I use it for all three). Depending on your needs, Spur will match it. Just need basic IP attributes? Want deep knowledge about proxies and tunnels? What to see what the connected clients are doing on the network? It's there. The API responses are easy to integrate into your workflows, and we had no issues implementing a system for 100k+ lookups-per-day (with some caching) that met all of our needs. Interestingly, searching for a bogon doesn't use up query quota, which was a nice surprise and only threw a _small_ spanner in our process. The amount of threat intelligence, infrastructure, client behaviors, and more is just so complete that we are _still_ underutilizing the data now. Review collected by and hosted on G2.com.

My two main hurdles are that you don't know _when_ a particular attribute (or anything on a given IP address) changes, and you need to make sure you don't exhaust your quota on IPv6 addresses. We "handle" both with periodic polling/cache invalidation, and only sending IPv6/64 addresses. Both cases might cause us to miss rapidly-changing threats, but work well for the bulk case. Review collected by and hosted on G2.com.