How does Spur detect VPNs, residential proxies, and ISP proxies?
Spur classifies an IP from the activity it observes on it, not from who owns the IP. It combines several kinds of evidence, including infrastructure and routing data, behavior over time, and ongoing research into VPN and proxy services, and evaluates them together to decide whether an IP belongs to a VPN, residential proxy network, ISP proxy, hosting provider, or other category.
What Spur looks at
Spur classifications describe what was observed on an IP during a given time window. An IP can be classified as a VPN, proxy, or tunnel because that kind of traffic was seen on it, whoever the registered owner is. See How Spur IP Classifications Work: Observed Behavior, Not IP Ownership.
No single signal decides a classification. Spur weighs several together:
- Infrastructure and routing: whether the IP sits on hosting or datacenter networks, and how its network is announced and routed.
- Observed activity: what the IP has been seen doing over time, such as relaying traffic for a proxy network.
- Service research: ongoing research into individual VPN and proxy services, so a result can often name the service involved, not just the category.
VPNs and datacenter proxies usually run on hosting infrastructure. Residential proxies relay traffic through real consumer connections, so their IPs look like ordinary home users, and detecting them depends on observed proxy activity rather than network type. See What is the difference between a VPN, residential proxy, and ISP proxy? and Why are residential proxies more difficult to detect than traditional VPNs?.
Why an IP you trust can be flagged
- A device on the network joined a proxy network. Apps, browser extensions, and smart TVs can relay proxy traffic without the owner knowing, so a legitimate ISP or home connection can carry a residential proxy classification. See Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure.
- The IP is shared. With carrier-grade NAT (CGNAT), corporate egress, or other shared infrastructure, many users sit behind one public IP, so activity from one of them shows up for everyone on it. See What is CGNAT, and why does it complicate IP-based fraud detection?.
- The IP is a tunnel entrance on shared infrastructure. Some tunnels route through shared reverse-proxy networks that also carry legitimate sites. See Entrance IPs vs. Exit IPs for Anonymizing Tunnels.
- It's a corporate VPN or ZTNA tunnel. Spur records these as tunnels but marks them as not anonymizing. See Anonymizing vs. Non-Anonymizing Tunnels.
Why a VPN or proxy IP can be missed
- The infrastructure is new. Spur adds new VPN and proxy infrastructure as it's discovered, so there can be a short gap. See How quickly can Spur identify and classify newly discovered VPN or proxy infrastructure?.
- No activity was observed in the time window. Classifications reflect a point in time. Residential proxy networks move through many consumer IPs, so an IP may not have been carrying proxy traffic when it was observed.
- You're comparing different products or times. A data feed is a snapshot from when it was generated, while the Context API reflects more recent data, so the same IP can return different results.
Report a misclassification
If you think an IP is classified incorrectly, or a VPN or proxy was missed, report it from the IP's page in the Spur app:
- Search for the IP and open its page.
- Select the report button, the warning-triangle icon at the top of the page next to copy and share.
- Under Activity observed, choose what fits, such as Incorrect Labels, VPN, or Proxy.
- Under Additional information, say what you expected and why, when you saw the result, and which product you used, such as the Context API, a data feed, or Monocle.
- Select Create.
You can report an ASN or a service tag the same way from its page.
If you operate the network and see residential proxy activity on your own address space, see What should an ISP, hoster, or ASN owner do if they discover residential proxy activity within their address space?.
Similar questions
What is the difference between a VPN, residential proxy, and ISP proxy?
Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.
What is CGNAT, and why does it complicate IP-based fraud detection?
CGNAT (Carrier-Grade NAT) lets a mobile carrier or ISP route many customers' traffic through a single public IP address. That means one IP can represent thousands of different devices and a mix of legitimate and malicious users, which makes IP-based signals alone less reliable — additional context is needed to distinguish individual users sharing that address.
What should I do when I detect a VPN or proxy?
Detection alone should not automatically trigger a block. VPNs and proxies are used by both legitimate users and attackers. Most organizations incorporate VPN and proxy signals into broader risk-scoring or adaptive decisioning workflows that consider account history, geography, transaction context, and behavioral indicators.
How quickly can Spur identify and classify newly discovered VPN or proxy infrastructure?
Spur continuously researches emerging infrastructure and updates classifications as new intelligence becomes available. New infrastructure is often identified and incorporated rapidly, allowing customers to benefit from current intelligence through the API and data products.
Why are residential proxies more difficult to detect than traditional VPNs?
Residential proxies route traffic through real consumer internet connections, causing activity to appear as if it originates from legitimate users. Because the IP addresses belong to trusted ISPs rather than known hosting providers, traditional reputation and geolocation controls are often less effective.
Related guides & explainers
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.