The IP was never yours alone: CGNAT and shared addresses

There is an assumption buried in almost every conversation about residential proxies: that one address equals one household. It is a reasonable thing to assume. It is also, for a large and growing share of the internet, untrue.

The reason is carrier-grade NAT, and understanding it explains several things that otherwise look like faults.

One address, many households

There are about 4.3 billion IPv4 addresses and rather more than 5 billion internet users. That arithmetic stopped working years ago, and the industry’s answer was to stop giving every customer their own public address.

Under carrier-grade NAT, an ISP gives your router a private address and translates it to a shared public one on the way out. Everyone behind that translator appears to the outside world as the same address.

How many people share one varies by how aggressively the operator has configured it. Conservative deployments put 20 to 50 customers behind a single address. Moderate ones run 50 to 100. Aggressive ones go to several hundred. A common configuration allocating around 512 ports per subscriber works out at roughly 126 customers per public address.

So when a site sees a request from a residential address, it is very often not looking at a household. It is looking at a neighbourhood.

What this explains

Once you know this, a set of familiar annoyances stop looking like bad luck.

Addresses that arrive already flagged. If a reputation system has seen abusive traffic from an address, it may score that address badly. Under CGNAT it was not one person’s behaviour — it was one of the hundred-odd people sharing it. You inherit a reputation formed by strangers, and no amount of care on your part would have prevented it. This is the same reason we are careful never to promise a “clean” address on any plan: nobody can honestly promise that when the address is shared upstream of them.

Rate limits that trigger far too early. A site limiting requests per address is limiting an entire CGNAT block. If a handful of ordinary people behind the same address happen to be browsing that site while you are working, the limit arrives sooner than your own request rate would suggest. Your traffic did not misbehave; it queued behind everyone else’s.

Blocks that appear and vanish without explanation. As subscribers move between translators, the population behind a given address changes. An address that was fine last week can be carrying someone else’s problem this week.

Sudden success on retry with no change. Same mechanism, different direction.

What it means for “unique IPs”

Every provider in this industry, us included, publishes a pool size. Those numbers are real, but they measure something narrower than most readers assume.

A count of unique addresses is a count of addresses, not of independent vantage points. If a meaningful share of them sit behind carrier-grade NAT, then the number of genuinely distinct network positions is lower than the headline — and two addresses from the same carrier region may look considerably more alike to a target site than the count suggests.

This is the honest reading of every pool number you will see advertised, ours included. It is not a reason to distrust the figure. It is a reason to stop treating pool size as the single measure of quality, and to look at what actually determines whether a job works: whether the addresses are in the right country, spread across enough different networks, and behaving like ordinary consumer connections.

Diversity of network beats raw count. Ten addresses spread across ten carriers will usually outperform fifty from one.

Where IPv6 changes the picture

IPv6 removes the scarcity that forced sharing in the first place. There are enough addresses to give every device its own, several times over, so there is no reason to put hundreds of subscribers behind one.

That has a real consequence: an IPv6 address is far more likely to correspond to a single subscriber than an IPv4 one. It also means the reputation attached to it is more likely to be theirs alone.

The catch is that a great many sites still do not serve IPv6 at all, so it is not a universal substitute. It is worth knowing about as a property of the address family rather than as a fix. If you are weighing it up, where IPv6 proxies fit covers what they are genuinely good for.

The thirty-second test

You can see whether an address you are handed is likely shared. Fetch it, then check what the address is registered to:

curl -s https://ipinfo.io/json | grep -E '"ip"|"org"|"city"'

The organisation tells you which carrier it belongs to. Run it a few times and look at the spread: if repeated requests keep returning addresses from the same carrier and the same city, you have less network diversity than the count implies, whatever the raw number of distinct addresses.

For a stronger signal, compare the address ranges. Addresses that differ only in the final octet frequently sit behind the same infrastructure, whatever they are labelled as.

What to do about it

Not much, honestly — and that is the point. CGNAT is a property of how consumer internet is built, not a setting anyone can switch off.

What changes is how you interpret what you see. An address that arrives pre-flagged is not evidence of a bad provider. A rate limit that trips early is not evidence your concurrency is wrong. A pool size is not a promise of independence.

The practical response is the same one that works for most of this: measure what your own targets actually do rather than what a reputation checker says, spread across networks rather than piling onto one, and treat any single address as something you share with people whose behaviour you will never see. If you want the fuller version of the first point, why IP checkers flag proxies explains why those scores are mostly inference rather than observation.