Are proxy SDKs primarily found in unofficial or malicious applications?
No. Proxy and bandwidth-sharing SDKs have been observed in both official app stores and less-official distribution channels. Their presence is not limited to free applications and may not always be clearly disclosed to users.
Similar questions
What is the difference between a VPN, residential proxy, and ISP proxy?
Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.
What should I do when I detect a VPN or proxy?
Detection alone should not automatically trigger a block. VPNs and proxies are used by both legitimate users and attackers. Most organizations incorporate VPN and proxy signals into broader risk-scoring or adaptive decisioning workflows that consider account history, geography, transaction context, and behavioral indicators.
What should an ISP, hoster, or ASN owner do if they discover residential proxy activity within their address space?
Organizations should investigate affected customers or devices, review acceptable-use policies, validate indicators, notify impacted parties when appropriate, and coordinate remediation efforts. Infrastructure owners are often in the best position to disrupt abuse occurring within their networks.
What is CGNAT, and why does it complicate IP-based fraud detection?
CGNAT (Carrier-Grade NAT) lets a mobile carrier or ISP route many customers' traffic through a single public IP address. That means one IP can represent thousands of different devices and a mix of legitimate and malicious users, which makes IP-based signals alone less reliable — additional context is needed to distinguish individual users sharing that address.
What indicators may suggest a candidate or worker is masking their location?
Potential indicators include repeated VPN usage, residential proxy activity, frequent geographic inconsistencies, remote-access tooling, rapid location changes, and infrastructure patterns inconsistent with the worker's claimed location.
Related guides & explainers
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.