Why are many IP addresses based in the United States?
Many foreign threat actors use US-based infrastructure to obfuscate their true location. The US has the largest number of VPN and proxy exit IPs.
Similar questions
What is the difference between the Anonymous and Anonymous-Residential feeds?
The Anonymous+Residential feed includes everything in the Anonymous feed plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure — so it's larger and broader in scope. The Anonymous feed on its own is more focused on datacenter-centric anonymizing services.
How can I download all IP addresses for a certain VPN or proxy provider?
This functionality is reserved for our on-prem data customers. Our API access only allows for individual IP Address lookups.
Why doesn't Spur's IP location match other geolocation sources?
Many geolocation providers fall back to registration data, which is the address on an IP's WHOIS or regional registry record. That address shows where the network was registered, not where the IP is actually used. Spur geolocates IPs from active network measurement and from location data that network operators publish for their own ranges. So when the two disagree, Spur reports where the IP measures, not where it's registered. Anycast IPs, which are served from many locations at once, are labeled as anycast rather than assigned a single location.
What indicators may suggest a candidate or worker is masking their location?
Potential indicators include repeated VPN usage, residential proxy activity, frequent geographic inconsistencies, remote-access tooling, rapid location changes, and infrastructure patterns inconsistent with the worker's claimed location.
What signals can indicate possible location spoofing?
Potential indicators include VPN usage, proxy activity, mismatches between an IP's expected and observed location, infrastructure classifications that conflict with expected user behavior, unusual location changes, and inconsistencies between geographic, device, and behavioral information.
Related guides & explainers
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.