Can a single IP address be associated with more than one proxy or anonymization service?
Yes. Shared infrastructure, reseller arrangements, and overlapping proxy ecosystems can result in an IP being associated with multiple services. Determining the exact service responsible for a specific event often requires additional context and investigation.
Similar questions
What is the difference between a VPN, residential proxy, and ISP proxy?
Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.
Are proxy SDKs primarily found in unofficial or malicious applications?
No. Proxy and bandwidth-sharing SDKs have been observed in both official app stores and less-official distribution channels. Their presence is not limited to free applications and may not always be clearly disclosed to users.
What should I do when I detect a VPN or proxy?
Detection alone should not automatically trigger a block. VPNs and proxies are used by both legitimate users and attackers. Most organizations incorporate VPN and proxy signals into broader risk-scoring or adaptive decisioning workflows that consider account history, geography, transaction context, and behavioral indicators.
How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?
Spur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.
What Proxy or VPN services are known bad?
Some services tend to be more abuse than others. It is important to remember that because abuse is ultimately driven by the users of a service, this can ebb and flow depending on different threat actors, techniques, and targets. We recommend looking for services that explicitly enable anonymous purchases without logging and services that are frequently sourced by malware.
Related guides & explainers
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Switching Between Organizations
If your account belongs to more than one Spur organization, use the Organization Switcher to move between them and manage each organization's plan and settings separately.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.