What does "Client Proxies" mean in Spur's data?
It refers to proxy client ecosystems or networks observed interacting through an IP, based on Spur telemetry. It does not mean the IP is owned or operated by the named provider — only that related activity was observed from it.
Similar questions
What does "client count" mean in Spur's data?
It's Spur's count of instances or connections observed from a given IP. As a general signal, a high count often points to shared infrastructure such as carrier-grade NAT, where many users' traffic passes through the same address, while a low count is more consistent with dedicated, single-tenant infrastructure. Treat it as a supporting signal alongside other data rather than a definitive classification on its own.
How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?
Spur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.
How does Spur detect VPNs, residential proxies, and ISP proxies?
Spur classifies an IP from the activity it observes on it, not from who owns the IP. It combines several kinds of evidence, including infrastructure and routing data, behavior over time, and ongoing research into VPN and proxy services, and evaluates them together to decide whether an IP belongs to a VPN, residential proxy network, ISP proxy, hosting provider, or other category.
What is the difference between a VPN, residential proxy, and ISP proxy?
Residential proxies route traffic through consumer devices and physical locations like homes and offices, while VPNs and ISP proxies are typically hosted in data centers. All three can present different network profiles.
What is CGNAT, and why does it complicate IP-based fraud detection?
CGNAT (Carrier-Grade NAT) lets a mobile carrier or ISP route many customers' traffic through a single public IP address. That means one IP can represent thousands of different devices and a mix of legitimate and malicious users, which makes IP-based signals alone less reliable — additional context is needed to distinguish individual users sharing that address.
Related guides & explainers
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Quick Search: Finding an IP, ASN, or Service Tag
Use quick search to jump straight to any IP, ASN or service tag, a Monocle app, or a main area of the app, from anywhere, without navigating through menus.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.