Why is my traffic marked as a VPN or proxy?
Monocle identifies traffic based on known infrastructure, behavior, and network signals. In some cases, shared networks or ISP routing may appear similar to anonymized traffic.
Similar questions
Why am I not seeing any data?
Check that your Monocle script is correctly installed, your publishable key is valid, and traffic is reaching your application.
Why is traffic not being blocked?
Monocle does not block traffic by default. Make sure you have implemented enforcement in your system, or configured a supported integration such as Cloudflare.
Why might the Monocle script fail to load?
This is usually caused by mcl.io being blocked by a firewall, DNS filter, or endpoint security tool. Confirm the domain is allowlisted, and test in an incognito window or from another network to isolate the cause.
Why did my Monocle assessment volume suddenly drop?
A sudden drop in assessment volume is usually caused by a change on your side — a recent deployment, a Content Security Policy (CSP) update, or a Cloudflare configuration change — rather than a Spur outage. Check your worker logs and recent configuration changes first. If volume still looks incorrect after that, contact support@spur.us with the time the drop started and any recent changes you made.
How long does it take to see data?
Typically within minutes of integrating Monocle. In some cases, it may take up to an hour for data to appear in the dashboard.
Related guides & explainers
Understanding Monocle Application Health Status
Each Monocle application shows a health status badge indicating whether it's actively sending traffic. Learn what each color means and what to check if an application goes quiet.
Entrance IPs vs. Exit IPs for Anonymizing Tunnels
Some anonymizing tunnel configurations route through shared infrastructure, like Cloudflare, before reaching the tunnel operator's own exit point. Here's why blocking the entrance IP can affect unrelated legitimate traffic, and what to enforce on instead.
Expanding IP and Service Rows in the Explorer
Click any IP or service row in the Monocle Explorer's breakdown tables to expand an inline detail panel, without leaving the table.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.