How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Spur classifications are based on observed network behavior, not on ASN or IP block ownership records. An IP can be classified as a proxy, VPN, or tunnel endpoint because Spur observed that kind of traffic passing through it — independent of who the registered owner of that IP space is.
This is why an IP that resolves to a well-known, reputable organization in WHOIS or allocation records can still carry a proxy or anonymizing classification: shared infrastructure, misconfigured egress points, or recruited consumer devices can produce that traffic pattern regardless of who holds the registration.
When investigating a classification that looks unexpected, the useful questions are about the observation itself — what activity was seen, and during what time window — rather than about registration records alone. Classifications reflect a point in time; the same IP can carry different classifications, or none, at a different time as the traffic it carries changes.
Related explainers
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.