How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?

Is a reverse proxy classified as anonymizing?

Not automatically. Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. When Spur detects a tunnel or proxy, the anonymous flag indicates which: false for corporate or ZTNA infrastructure attributed as a tunnel but not anonymizing, and true for an anonymizing proxy service. Methodology can vary slightly by product — contact support if you need product-specific detail.

What Proxy or VPN services are known bad?

Some services tend to be more abuse than others. It is important to remember that because abuse is ultimately driven by the users of a service, this can ebb and flow depending on different threat actors, techniques, and targets. We recommend looking for services that explicitly enable anonymous purchases without logging and services that are frequently sourced by malware.

Can a single IP address be associated with more than one proxy or anonymization service?

Yes. Shared infrastructure, reseller arrangements, and overlapping proxy ecosystems can result in an IP being associated with multiple services. Determining the exact service responsible for a specific event often requires additional context and investigation.

How quickly can Spur identify and classify newly discovered VPN or proxy infrastructure?

Spur continuously researches emerging infrastructure and updates classifications as new intelligence becomes available. New infrastructure is often identified and incorporated rapidly, allowing customers to benefit from current intelligence through the API and data products.

Does Spur identify legitimate privacy-focused users as well as malicious actors?

Spur identifies infrastructure characteristics and anonymization technologies, not intent. Organizations determine how to use those signals based on their business requirements, risk tolerance, and policies.