In one embodiment, a processing technique is provided for determining a refined attribute of a network address based on one or more other attributes. A network address associated with a source device in communication with a network is observed. One or more first attributes of the network address are determined, where the one or more first attributes indicate at least a spatial or temporal property of the network address. The one or more first attributes are processed to determine a second attribute to be associated with the network address, where the second attribute indicates whether the network address is a fixed or mobile network address, or is a proxy or non-proxy network address. A record is stored that maintains the association between the second attribute and the network address.