Why is my traffic marked as a VPN or proxy?

How fast does Spur detect a VPN or Proxy?

New VPNs or proxies are typically identified within 24-48 hours depending on where it is hosted and how it is being used. Monocle will detect all new VPNs and proxies on first use. All new identifications are available immediately in our API products. On-prem solutions will be update on their next update cadence or in real-time if that option has been added.

What Proxy or VPN services are known bad?

Some services tend to be more abuse than others. It is important to remember that because abuse is ultimately driven by the users of a service, this can ebb and flow depending on different threat actors, techniques, and targets. We recommend looking for services that explicitly enable anonymous purchases without logging and services that are frequently sourced by malware.

Does Spur identify legitimate privacy-focused users as well as malicious actors?

Spur identifies infrastructure characteristics and anonymization technologies, not intent. Organizations determine how to use those signals based on their business requirements, risk tolerance, and policies.

How does Spur detect VPNs, residential proxies, and ISP proxies?

Spur uses a combination of network intelligence, infrastructure analysis, behavioral signals, routing characteristics, historical observations, and proprietary research to identify and classify IP addresses. Multiple signals are evaluated together to determine the likelihood that an IP belongs to a VPN, residential proxy network, ISP proxy service, hosting provider, or other category.

Why are residential proxies more difficult to detect than traditional VPNs?

Residential proxies route traffic through real consumer internet connections, causing activity to appear as if it originates from legitimate users. Because the IP addresses belong to trusted ISPs rather than known hosting providers, traditional reputation and geolocation controls are often less effective.