What does "Client Proxies" mean in Spur's data?

What does "client count" mean in Spur's data?

It's Spur's count of instances or connections observed from a given IP. As a general signal, a high count often points to shared infrastructure such as carrier-grade NAT, where many users' traffic passes through the same address, while a low count is more consistent with dedicated, single-tenant infrastructure. Treat it as a supporting signal alongside other data rather than a definitive classification on its own.

How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?

Spur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.

How does Spur detect VPNs, residential proxies, and ISP proxies?

Spur uses a combination of network intelligence, infrastructure analysis, behavioral signals, routing characteristics, historical observations, and proprietary research to identify and classify IP addresses. Multiple signals are evaluated together to determine the likelihood that an IP belongs to a VPN, residential proxy network, ISP proxy service, hosting provider, or other category.

What is the difference between a VPN, residential proxy, and ISP proxy?

Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.

What is CGNAT, and why does it complicate IP-based fraud detection?

CGNAT (Carrier-Grade NAT) lets a mobile carrier or ISP route many customers' traffic through a single public IP address. That means one IP can represent thousands of different devices and a mix of legitimate and malicious users, which makes IP-based signals alone less reliable — additional context is needed to distinguish individual users sharing that address.