Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. Detecting that traffic is routed through a tunnel or proxy is not, on its own, a statement about intent — some tunnel infrastructure exists for entirely legitimate operational reasons and isn't meant to hide the user's origin.
When Spur detects a tunnel or proxy, the response's tunnels object may include an anonymous flag:
"anonymous": false— corporate or Zero Trust Network Access (ZTNA) infrastructure, such as GlobalProtect, that gets structurally attributed as a tunnel but is not intended to anonymize the user"anonymous": true— a service intended to anonymize the user's origin, such as a commercial VPN or anonymizing proxy
Use the anonymous flag to decide whether "detected as a tunnel" should factor into a risk or enforcement decision, rather than treating any tunnel detection as inherently suspicious. Detection methodology can differ between Spur products and feeds, so if a specific case needs more detail than this flag provides, it helps to know which product or feed is in use.
Related explainers
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.