Explainers

Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means

Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.

What "Client Proxies" Means in Spur Data

"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.

How Spur IP Classifications Work: Observed Behavior, Not IP Ownership

Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.

Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds

The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.

Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure

Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.

Entrance IPs vs. Exit IPs for Anonymizing Tunnels

Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.