Anonymizing Infrastructure
21 articles
How VPNs, residential proxies, ISP proxies, and related infrastructure work—and how Spur classifies them.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag MeansExplainerNot every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.What is the difference between the Anonymous and Anonymous-Residential feeds?FAQThe Anonymous+Residential feed includes everything in the Anonymous feed plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure — so it's larger and broader in scope. The Anonymous feed on its own is more focused on datacenter-centric anonymizing services.What is a residential proxy?FAQA residential proxy routes traffic through a real consumer device or home network — often without the device owner's knowledge — rather than a data center server, making the traffic look like it comes from an ordinary home internet connection. See our blog posts "What is a Residential Proxy?" and "Residential Proxies: The Legal Botnet Nobody Talks About" for more detail.Why are many IP addresses based in the United States?FAQMany foreign threat actors use US-based infrastructure to obfuscate their true location. The US has the largest number of VPN and proxy exit IPs.Why is my traffic marked as a VPN or proxy?FAQMonocle identifies traffic based on known infrastructure, behavior, and network signals. In some cases, shared networks or ISP routing may appear similar to anonymized traffic.Why is a Cloudflare IP address classified as Anonymizing?FAQSome IPs belonging to a CDN like Cloudflare are classified as Anonymizing because they're used as the TLS entry point for an anonymizing tunnel service. The connecting client's TLS handshake names a legitimate-looking hostname, and the CDN routes the traffic to unrelated tunnel infrastructure behind it — the named domain and the CDN provider itself aren't involved in or aware of the proxying. In Spur's data this is reflected in the `tunnels` field, which distinguishes an IP's role as a tunnel entrance from its role as an exit. If your use case depends specifically on identifying egress points, you can filter out entrance-only IPs, since these are rarely also used as an exit for other services.Entrance IPs vs. Exit IPs for Anonymizing TunnelsExplainerSome anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?FAQSpur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.Is a reverse proxy classified as anonymizing?FAQNot automatically. Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. When Spur detects a tunnel or proxy, the anonymous flag indicates which: false for corporate or ZTNA infrastructure attributed as a tunnel but not anonymizing, and true for an anonymizing proxy service. Methodology can vary slightly by product — contact support if you need product-specific detail.What Proxy or VPN services are known bad?FAQSome services tend to be more abuse than others. It is important to remember that because abuse is ultimately driven by the users of a service, this can ebb and flow depending on different threat actors, techniques, and targets. We recommend looking for services that explicitly enable anonymous purchases without logging and services that are frequently sourced by malware.Can a single IP address be associated with more than one proxy or anonymization service?FAQYes. Shared infrastructure, reseller arrangements, and overlapping proxy ecosystems can result in an IP being associated with multiple services. Determining the exact service responsible for a specific event often requires additional context and investigation.How quickly can Spur identify and classify newly discovered VPN or proxy infrastructure?FAQSpur continuously researches emerging infrastructure and updates classifications as new intelligence becomes available. New infrastructure is often identified and incorporated rapidly, allowing customers to benefit from current intelligence through the API and data products.Does Spur identify legitimate privacy-focused users as well as malicious actors?FAQSpur identifies infrastructure characteristics and anonymization technologies, not intent. Organizations determine how to use those signals based on their business requirements, risk tolerance, and policies.How does Spur detect VPNs, residential proxies, and ISP proxies?FAQSpur classifies an IP from the activity it observes on it, not from who owns the IP. It combines several kinds of evidence, including infrastructure and routing data, behavior over time, and ongoing research into VPN and proxy services, and evaluates them together to decide whether an IP belongs to a VPN, residential proxy network, ISP proxy, hosting provider, or other category.Why are residential proxies more difficult to detect than traditional VPNs?FAQResidential proxies route traffic through real consumer internet connections, causing activity to appear as if it originates from legitimate users. Because the IP addresses belong to trusted ISPs rather than known hosting providers, traditional reputation and geolocation controls are often less effective.Why might a residential IP be classified as a proxy?FAQSome residential IPs participate in proxy-sharing networks, malware-based proxy networks, commercial residential proxy services, or other infrastructure that causes them to exhibit proxy-like behavior. Spur evaluates multiple indicators before making classifications.Does the use of a VPN always indicate malicious activity?FAQNo. Many users rely on VPNs for privacy, remote work, travel, or security. VPN detection should be viewed as an additional signal that helps organizations better understand the context of a connection rather than as evidence of malicious intent.What should an ISP, hoster, or ASN owner do if they discover residential proxy activity within their address space?FAQOrganizations should investigate affected customers or devices, review acceptable-use policies, validate indicators, notify impacted parties when appropriate, and coordinate remediation efforts. Infrastructure owners are often in the best position to disrupt abuse occurring within their networks.What should I do when I detect a VPN or proxy?FAQDetection alone should not automatically trigger a block. VPNs and proxies are used by both legitimate users and attackers. Most organizations incorporate VPN and proxy signals into broader risk-scoring or adaptive decisioning workflows that consider account history, geography, transaction context, and behavioral indicators.Are proxy SDKs primarily found in unofficial or malicious applications?FAQNo. Proxy and bandwidth-sharing SDKs have been observed in both official app stores and less-official distribution channels. Their presence is not limited to free applications and may not always be clearly disclosed to users.What is the difference between a VPN, residential proxy, and ISP proxy?FAQResidential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.
Showing 1–21 of 21