Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means

Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.

Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. Detecting that traffic is routed through a tunnel or proxy is not, on its own, a statement about intent — some tunnel infrastructure exists for entirely legitimate operational reasons and isn't meant to hide the user's origin.

When Spur detects a tunnel or proxy, the response's tunnels object may include an anonymous flag:

• "anonymous": false — corporate or Zero Trust Network Access (ZTNA) infrastructure, such as GlobalProtect, that gets structurally attributed as a tunnel but is not intended to anonymize the user
• "anonymous": true — a service intended to anonymize the user's origin, such as a commercial VPN or anonymizing proxy

Use the anonymous flag to decide whether "detected as a tunnel" should factor into a risk or enforcement decision, rather than treating any tunnel detection as inherently suspicious. Detection methodology can differ between Spur products and feeds, so if a specific case needs more detail than this flag provides, it helps to know which product or feed is in use.