Changelog · Oct 7, 2026 — Monocle Assess & Enforce, policy decision logging, and Install with AI.

FAQs

Q: What is the difference between the Anonymous and Anonymous-Residential feeds?

The Anonymous+Residential feed includes everything in the Anonymous feed plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure — so it's larger and broader in scope. The Anonymous feed on its own is more focused on datacenter-centric anonymizing services.

Q: What is a residential proxy?

A residential proxy routes traffic through a real consumer device or home network — often without the device owner's knowledge — rather than a data center server, making the traffic look like it comes from an ordinary home internet connection. See our blog posts "What is a Residential Proxy?" and "Residential Proxies: The Legal Botnet Nobody Talks About" for more detail.

Q: Why are many IP addresses based in the United States?

Many foreign threat actors use US-based infrastructure to obfuscate their true location. The US has the largest number of VPN and proxy exit IPs.

Q: Why is my traffic marked as a VPN or proxy?

Monocle identifies traffic based on known infrastructure, behavior, and network signals. In some cases, shared networks or ISP routing may appear similar to anonymized traffic.

Q: Why is a Cloudflare IP address classified as Anonymizing?

Some IPs belonging to a CDN like Cloudflare are classified as Anonymizing because they're used as the TLS entry point for an anonymizing tunnel service. The connecting client's TLS handshake names a legitimate-looking hostname, and the CDN routes the traffic to unrelated tunnel infrastructure behind it — the named domain and the CDN provider itself aren't involved in or aware of the proxying. In Spur's data this is reflected in the `tunnels` field, which distinguishes an IP's role as a tunnel entrance from its role as an exit. If your use case depends specifically on identifying egress points, you can filter out entrance-only IPs, since these are rarely also used as an exit for other services.

Q: How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?

Spur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.

Q: Is a reverse proxy classified as anonymizing?

Not automatically. Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. When Spur detects a tunnel or proxy, the anonymous flag indicates which: false for corporate or ZTNA infrastructure attributed as a tunnel but not anonymizing, and true for an anonymizing proxy service. Methodology can vary slightly by product — contact support if you need product-specific detail.

Q: What Proxy or VPN services are known bad?

Some services tend to be more abuse than others. It is important to remember that because abuse is ultimately driven by the users of a service, this can ebb and flow depending on different threat actors, techniques, and targets. We recommend looking for services that explicitly enable anonymous purchases without logging and services that are frequently sourced by malware.

Q: Can a single IP address be associated with more than one proxy or anonymization service?

Yes. Shared infrastructure, reseller arrangements, and overlapping proxy ecosystems can result in an IP being associated with multiple services. Determining the exact service responsible for a specific event often requires additional context and investigation.

Q: How quickly can Spur identify and classify newly discovered VPN or proxy infrastructure?

Spur continuously researches emerging infrastructure and updates classifications as new intelligence becomes available. New infrastructure is often identified and incorporated rapidly, allowing customers to benefit from current intelligence through the API and data products.

Quick answers to common questions about Spur products and data.

150 questions total · page 1 of 8

Anonymizing Infrastructure(19)

Spur Platform & Data(1)

Showing 1–20 of 150

1 / 8