Why is a Cloudflare IP address classified as Anonymizing?
Some IPs belonging to a CDN like Cloudflare are classified as Anonymizing because they're used as the TLS entry point for an anonymizing tunnel service. The connecting client's TLS handshake names a legitimate-looking hostname, and the CDN routes the traffic to unrelated tunnel infrastructure behind it — the named domain and the CDN provider itself aren't involved in or aware of the proxying. In Spur's data this is reflected in the `tunnels` field, which distinguishes an IP's role as a tunnel entrance from its role as an exit. If your use case depends specifically on identifying egress points, you can filter out entrance-only IPs, since these are rarely also used as an exit for other services.
Similar questions
How does Spur integrate with our existing technologies (Cloudflare, etc.)?
Many customers integrate Spur intelligence into web security, fraud prevention, and access control workflows. Available integration methods may vary depending on the platform and use case.
Is a reverse proxy classified as anonymizing?
Not automatically. Spur distinguishes anonymizing proxies and tunnels from non-anonymizing ones. When Spur detects a tunnel or proxy, the anonymous flag indicates which: false for corporate or ZTNA infrastructure attributed as a tunnel but not anonymizing, and true for an anonymizing proxy service. Methodology can vary slightly by product — contact support if you need product-specific detail.
How does Spur classify infrastructure that serves more than one purpose, such as a legitimate corporate network also exposed through a public VPN service?
Spur classifies based on the most security-relevant observable behavior, not the primary or most benign use case. If otherwise-legitimate infrastructure is being publicly exposed through anonymizing or proxy services, it's labeled according to that exposure, since that's the behavior most relevant to a security decision.
What is the difference between the Anonymous and Anonymous-Residential feeds?
The Anonymous+Residential feed includes everything in the Anonymous feed plus IPs contributing to residential proxies, malware proxies, peer-to-peer proxies, blockchain proxies, and ZTNA infrastructure — so it's larger and broader in scope. The Anonymous feed on its own is more focused on datacenter-centric anonymizing services.
What is a residential proxy?
A residential proxy routes traffic through a real consumer device or home network — often without the device owner's knowledge — rather than a data center server, making the traffic look like it comes from an ordinary home internet connection. See our blog posts "What is a Residential Proxy?" and "Residential Proxies: The Legal Botnet Nobody Talks About" for more detail.
Related guides & explainers
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.