You, your neighbor, and possibly a few hundred strangers may be sharing one public IP address right now. That isn't an illusion. It is increasingly common since IPv4 addresses ran out, and the technique is called CGNAT (carrier-grade NAT).
Understanding it explains many "odd" things: why a mobile IP keeps changing, why its location is often off, why one IP carries lots of unrelated users, and what it means for account risk control.
Why CGNAT exists
IPv4 has about 4.3 billion addresses, and connected devices passed that number long ago. The last IPv4 blocks were allocated by IANA in 2011, and the regional registries have been exhausting their pools since.
There are two ways out: roll out IPv6, or have multiple users share one IPv4 address. The second is CGNAT. IPv6 adoption varies widely by country, so CGNAT is still everywhere. For that background, see IPv6 and IP Risk Scoring.
How it works
Your home router already does NAT: every device at home shares one public IP. CGNAT scales the same idea up to the carrier:
- Your router (or phone) gets not a real public IP but a private address, or one from
100.64.0.0/10, the range reserved for carrier NAT (RFC 6598). - The carrier's NAT equipment maps the traffic of hundreds or thousands of users onto a small number of public IPs.
- Different users' connections are told apart by port numbers.
So outside websites see the carrier's public IP and never your individual address.
Where it is common
- Mobile networks (4G/5G). Nearly universal. The exit IP is shared by many users and changes fairly often.
- Some home broadband. Depending on country and carrier, some new connections get a CGNAT address by default, and a dedicated public IP needs a separate request.
- Public Wi-Fi and corporate networks. These share an exit by design.
How to tell whether you are behind CGNAT
The simplest method is to compare two addresses:
- Log into your router's admin page and read the WAN address.
- Use the ipscoper IP lookup to see the IP the outside world sees.
How to judge:
- The two differ, and the WAN address is in
10.x.x.x,172.16–31.x.x,192.168.x.xor100.64–127.x.x: you are definitely behind CGNAT. - The two are identical: you very likely have your own public IP and no CGNAT.
A phone network has no router page, but the phone's network info or a diagnostic app can show the local address, which is usually private or 100.64.x.x.
What it means for you
1. The neighbor effect. The behavior of other users on the same exit affects that IP's reputation. If someone sends spam or hammers an API, the whole IP can take the hit. See IP Blacklists and Reputation.
2. The IP changes often. The exit is an address pool, so you may get a different IP on each connection. That differs from an ordinary dynamic IP; see Dynamic vs Static IP.
3. Location is even less accurate. Mobile exits concentrate at regional gateways, so city-level error is bigger. The reasons are in Why Your IP Location Looks Wrong.
4. No port forwarding. Reaching devices at home from outside, or hosting a service, doesn't work behind CGNAT. You need a dedicated public IP, IPv6 or a tunnel.
5. Tracing abuse depends on logs. One public IP maps to many people, so tracing it to a single user takes carrier logs with "IP + port + exact time." An ordinary website can't do this.
What it means for risk control and account operations
The two points below are industry experience and reasoning, not any platform's official statement:
- A platform can't simply ban an IP shared by hundreds of people, so it is generally more tolerant of mobile and CGNAT exits than of datacenter IPs. That is one reason mobile and home broadband IPs are favored in cross-border operations. For the category comparison, see Home, Mobile and Business IP Types.
- Several unrelated accounts appearing on one IP is normal under CGNAT, so a "same IP, many accounts" correlation signal is less reliable here.
Don't conclude from this that running many accounts is safe. Correlation has never depended on IP alone. Device fingerprints, behavior patterns and login habits can all be used; see How to Avoid IP Correlation in Multi-Account Setups.
How to read an ipscoper result behind CGNAT
If you are behind CGNAT, the lookup shows the carrier's shared public exit IP. The ASN will be the carrier's, and the network type is usually classified as broadband or mobile. The result isn't a dedicated address for you, and it can change at any time. The risk value is again a heuristic estimate; see the methodology.
Points to check when choosing a "mobile IP" or "4G proxy"
- Ask whether the exit is dedicated or shared. A shared pool can contain unknown users' behavior.
- Confirm how and how often the IP changes. Important accounts that need a stable exit shouldn't rotate frequently.
- Run the ping test and the environment check to measure stability and leaks in practice.
- Trial at small scale first, and compare against the 5-Point Checklist Before Buying an IP.
Summary
CGNAT is a product of IPv4 shortage: many users share one public IP, told apart by port. The consequences are the neighbor effect, changing IPs, location drift and no port forwarding. For account operations, it is one reason mobile IPs are relatively tolerant, and a reminder that the reputation of a shared exit is set by everyone who uses it.