What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
"Client Proxies" refers to proxy client ecosystems or networks that Spur observed interacting through a given IP, based on Spur telemetry. It is a record of observed activity, not a statement of ownership or operation.
An IP listed with Client Proxies for a given provider does not mean that provider owns, operates, or is directly responsible for the IP. It means activity associated with that provider's proxy network was observed originating from the IP during the observation window.
This distinction matters because proxy networks — particularly residential proxy networks — route traffic through real end-user devices and connections rather than infrastructure the provider directly controls. The same IP can carry both proxy traffic and unrelated legitimate traffic. Client Proxies data should be read as "this network's traffic was observed here," not "this network owns or runs this IP."
Related explainers
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.