What does "client count" mean in Spur's data?
It's Spur's count of instances or connections observed from a given IP. As a general signal, a high count often points to shared infrastructure such as carrier-grade NAT, where many users' traffic passes through the same address, while a low count is more consistent with dedicated, single-tenant infrastructure. Treat it as a supporting signal alongside other data rather than a definitive classification on its own.
Similar questions
Can a single IP address be associated with more than one proxy or anonymization service?
Yes. Shared infrastructure, reseller arrangements, and overlapping proxy ecosystems can result in an IP being associated with multiple services. Determining the exact service responsible for a specific event often requires additional context and investigation.
How quickly can Spur identify and classify newly discovered VPN or proxy infrastructure?
Spur continuously researches emerging infrastructure and updates classifications as new intelligence becomes available. New infrastructure is often identified and incorporated rapidly, allowing customers to benefit from current intelligence through the API and data products.
Why are residential proxies more difficult to detect than traditional VPNs?
Residential proxies route traffic through real consumer internet connections, causing activity to appear as if it originates from legitimate users. Because the IP addresses belong to trusted ISPs rather than known hosting providers, traditional reputation and geolocation controls are often less effective.
Does the use of a VPN always indicate malicious activity?
No. Many users rely on VPNs for privacy, remote work, travel, or security. VPN detection should be viewed as an additional signal that helps organizations better understand the context of a connection rather than as evidence of malicious intent.
What is the difference between a VPN, residential proxy, and ISP proxy?
Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.