What is CGNAT, and why does it complicate IP-based fraud detection?
CGNAT (Carrier-Grade NAT) lets a mobile carrier or ISP route many customers' traffic through a single public IP address. That means one IP can represent thousands of different devices and a mix of legitimate and malicious users, which makes IP-based signals alone less reliable — additional context is needed to distinguish individual users sharing that address.
Similar questions
How can Spur help organizations identify fraudulent remote workers without creating unnecessary friction?
The most effective approach is to use multiple signals rather than relying on any single indicator. Organizations can combine IP intelligence, identity verification, onboarding controls, and behavioral analytics to identify suspicious infrastructure patterns while minimizing disruption for legitimate candidates and employees. Spur intelligence can help identify infrastructure patterns, anonymization tools, proxy services, and geographic inconsistencies that may be associated with certain remote-work fraud schemes. Most organizations combine Spur data with additional identity, behavioral, and investigative signals.
Why isn't traditional IP geolocation enough to enforce geographic restrictions?
Traditional geolocation only identifies where an IP address appears to be located. It does not reveal whether traffic is being routed through a VPN, residential proxy, mobile proxy, or other anonymization service. As a result, users can appear to originate from approved locations while actually operating elsewhere.
Can organizations rely on country-level geolocation alone?
Country-level geolocation remains useful, but it should not be treated as a complete solution. Modern anonymization services allow users to appear in approved countries while operating elsewhere, making additional infrastructure context increasingly important.
What should an ISP, hoster, or ASN owner do if they discover residential proxy activity within their address space?
Organizations should investigate affected customers or devices, review acceptable-use policies, validate indicators, notify impacted parties when appropriate, and coordinate remediation efforts. Infrastructure owners are often in the best position to disrupt abuse occurring within their networks.
Are proxy SDKs primarily found in unofficial or malicious applications?
No. Proxy and bandwidth-sharing SDKs have been observed in both official app stores and less-official distribution channels. Their presence is not limited to free applications and may not always be clearly disclosed to users.
Related guides & explainers
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.