Does the use of a VPN always indicate malicious activity?
No. Many users rely on VPNs for privacy, remote work, travel, or security. VPN detection should be viewed as an additional signal that helps organizations better understand the context of a connection rather than as evidence of malicious intent.
Similar questions
What is the difference between a VPN, residential proxy, and ISP proxy?
Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.
Are proxy SDKs primarily found in unofficial or malicious applications?
No. Proxy and bandwidth-sharing SDKs have been observed in both official app stores and less-official distribution channels. Their presence is not limited to free applications and may not always be clearly disclosed to users.
What should I do when I detect a VPN or proxy?
Detection alone should not automatically trigger a block. VPNs and proxies are used by both legitimate users and attackers. Most organizations incorporate VPN and proxy signals into broader risk-scoring or adaptive decisioning workflows that consider account history, geography, transaction context, and behavioral indicators.
Does Spur identify legitimate privacy-focused users as well as malicious actors?
Spur identifies infrastructure characteristics and anonymization technologies, not intent. Organizations determine how to use those signals based on their business requirements, risk tolerance, and policies.
Why are residential proxies more difficult to detect than traditional VPNs?
Residential proxies route traffic through real consumer internet connections, causing activity to appear as if it originates from legitimate users. Because the IP addresses belong to trusted ISPs rather than known hosting providers, traditional reputation and geolocation controls are often less effective.
Related guides & explainers
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Switching Between Organizations
If your account belongs to more than one Spur organization, use the Organization Switcher to move between them and manage each organization's plan and settings separately.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.