Blog / IP & privacy

Does CGNAT Hurt IP Reputation? Shared IPs Explained

2026-10-20cdnping editors9 min read

Yes, it does, but not in the way most people expect. CGNAT (carrier-grade NAT) makes many subscribers share one public exit address, so a website sees the combined behavior of "that address." A neighbor's abusive traffic can therefore cost you an extra verification step or two. On the other hand, many reputation and risk systems know that mobile and CGNAT addresses are shared, and they often give such addresses less weight. Below: how CGNAT works, how it affects reputation scoring in practice, and how to check whether you are behind it.

This article is for understanding and checking your own network environment, for example when you ask "why do I get CAPTCHAs so often on my phone hotspot?" It does not discuss or recommend any way to bypass platform risk controls or regional restrictions. Follow each service's terms and local regulations.

#What CGNAT is and why carriers use it

There are only about 4.3 billion IPv4 addresses, and they ran out long ago. Carriers have far more subscribers than public IPv4 addresses, so they add another layer of address translation inside their own network. Your device gets a carrier-internal address, and only when traffic leaves the network is it rewritten to one of a small pool of shared public addresses, with port numbers telling different users' connections apart. This is CGNAT (Carrier-Grade NAT), also called LSN (Large Scale NAT) or NAT444.

Your home router already does one round of NAT, turning the 192.168.x.x addresses of your phone and laptop into the router's WAN address. A home connection behind CGNAT has one more layer after the router:

Phone/laptop 192.168.1.x
   → Home router WAN port 100.64.x.x (carrier-internal address)
   → Carrier CGNAT device
   → Public exit IP (shared with other subscribers)
   → Website

To avoid clashing with the private ranges used in people's homes, the IETF reserved 100.64.0.0/10 (100.64.0.0 to 100.127.255.255) in RFC 6598 as the carrier shared address space. If your router's WAN port gets an address in that range, you are almost certainly behind CGNAT. Some carriers use 10.x or other private ranges internally, though, so "not starting with 100.64" does not guarantee you have a public IP.

#Why mobile data is almost always behind CGNAT

Mobile networks have huge subscriber counts, and devices constantly go on and off the network and switch cells. Giving every phone a fixed public IPv4 address is neither practical nor necessary. So IPv4 traffic on cellular networks usually leaves through the carrier's large-scale NAT. At any moment many users may sit behind one exit address, and the next time you connect your exit may be different.

That is also why many IP checkers list "mobile" as its own category. cdnping's IP and environment check sorts IP types into datacenter, residential, mobile and Tor, and cellular exits are normally classed as "mobile," separate from residential and datacenter. For how to tell datacenter and residential apart, see Datacenter IP vs. residential IP.

#How a shared exit affects IP reputation

IP reputation is recorded per address (or per network block). When an address is shared, the record belongs to everyone behind it. The effects fall into three groups.

#Collateral effects: other people's records land on your address

Reputation data comes from two broad kinds of sources. One is abuse reports and blocklists: if an address is reported for spam, forum spam registrations or scanning, it can end up on StopForumSpam or a DNS blocklist. The other is commercial intelligence databases that assign risk scores from traffic patterns. If one device behind a shared exit is infected with malware that sends spam or scans ports, the public address is what gets recorded, and other users on that exit will see the hit when they look up their own IP.

Such hits have nothing to do with your own behavior. When you see one, first check which type of source flagged it, then decide whether it matters. For what each of the 14 reputation sources means and how they are weighted, see How the IP purity score is calculated. For why different sites often disagree, see Why IP purity sites give different results.

#Rate limiting: everyone shares the same quota

Many sites and APIs rate-limit by IP, for example "at most N requests per minute per IP." Users behind CGNAT share that allowance, so at peak hours you are more likely to hit a 429, a CAPTCHA or a "too many requests" message even if you only clicked a few times. This is not directly about reputation score, and it usually clears up after a while.

#Shared addresses are often down-weighted

Conversely, mobile and CGNAT addresses have large numbers of real users behind them, and blocking a whole exit because of one abuse record would cause a lot of collateral damage. So some risk systems reduce the weight of the IP dimension for such addresses and lean more on account history, device and behavior signals. The result: the same blocklist hit may cause an outright block on a datacenter IP, but only an extra verification step on a mobile exit.

For which factors raise or lower a risk score, see What affects an IP risk score, which breaks it down in more detail.

#Summary table

On the last row: carrier CGNAT exits are usually deployed at a few aggregation nodes, and geolocation databases can only locate the exit address, so it is common for a mobile connection to be placed in a different city. cdnping's IP and environment check polls 11 geolocation databases and reports a confidence level. If the databases disagree widely on the city and confidence is low, treat that as a hint that the exit is not local.

#How to tell whether you are behind CGNAT

There is one core idea: compare "the address your device or router thinks it has" with "the address websites see." If they match, you have your own public IP. If they differ, there are one or more NAT layers in between.

#Home broadband: four steps

Step 1: Check the exit IP that websites see. Open cdnping /ip and note the exit IPv4 address, or use the command line:

curl -4 https://cloudflare.com/cdn-cgi/trace | grep ip=

Step 2: Check the router's WAN address. Log in to the router admin page and look for the IPv4 address under "WAN status" or "Internet status." If the optical modem (ONT) handles dial-up and routing, check the modem's status page instead.

Step 3: Compare.

Step 4: Use traceroute to look at the first few hops. If step 3 cannot tell whether the modem or the carrier is doing the NAT, look at the addresses of the first hops:

# macOS / Linux
traceroute -n -m 6 1.1.1.1
# Windows
tracert -d -h 6 1.1.1.1

Hop 1 is usually your router (192.168.x.x). If you see addresses such as 100.64.x.x at hop 2 or 3, the carrier is using the shared address range inside its network, and CGNAT is very likely in place.

#Mobile network: check the IP type directly

On a phone you cannot look at a "WAN port," but you can:

1. Turn off Wi-Fi, open cdnping /ip over cellular data only, and see whether the IP type is "mobile."
2. Check the IPv4 address assigned to the cellular connection in system settings (some Android models show it under "About phone → Status information"). If it starts with 100.64 or 10.x while websites see a different public address, you are behind CGNAT.
3. Test again after some time or after toggling airplane mode. Exit addresses changing is very common.

#Don't forget IPv6

Many carriers run CGNAT for IPv4 while also giving users global IPv6 addresses. IPv6 has plenty of addresses and generally does not need to be shared, so you may be behind CGNAT on IPv4 but have your own address on IPv6. Which protocol a website prefers decides whether it sees the shared exit or your own address. cdnping /ip shows both your IPv4 and IPv6 exits. For problems caused by a mismatch between the two, see IPv6 proxy not working: IPv4 and IPv6 exits differ on dual-stack networks.

#What to do when your exit has reputation hits

Separate the scenarios first, then decide whether to act:

• Just browsing and everyday use, with an occasional extra CAPTCHA: usually nothing to do. Hits on a shared exit mostly come from other users on the same exit, and the address or the records will change over time.
• Home broadband where you need to run services or forward ports: ask your carrier whether it can assign a public IPv4 address. Carriers in some regions offer this, and the answer depends on your local carrier. Another option is to prefer IPv6.
• Servers or dev environments that need a stable exit: a shared exit is a poor basis for allowlists or reputation, so use a fixed address you control, such as a cloud server's elastic IP.
• Continuously blocked by a particular service: use that service's official appeal or support channel and explain that your network is a carrier shared exit. This is more reliable than changing addresses over and over, and it does not run afoul of the terms of service.

When you run a self-check you can look at everything at once: exit IP, IP type, reputation hits, DNS and WebRTC leaks, and whether IPv4 and IPv6 agree. The full checklist is in Developer network self-check checklist (2026 edition). For the concept of native versus broadcast IPs, see Native IP vs. broadcast IP.

#Common misconceptions

• "A CGNAT IP is always dirty." Not necessarily. Shared exits are more likely to have scattered hits, but many reputation systems down-weight them, so the day-to-day impact is mostly CAPTCHAs and rate limits.
• "A blocklist hit means I'm being watched." On a shared exit, a hit was most likely left by other users of the same address. Look at which type of source flagged it first. Email-related DNS blocklists usually have little effect on web browsing.
• "An address behind CGNAT is safer." CGNAT only makes many people share an exit. It does not encrypt anything or hide your device characteristics. Websites can still see your browser fingerprint, time zone, language and so on. For what each of these signals reveals, see Browser fingerprint and environment checks.
• "Mismatched IPs means CGNAT." It could also be a proxy, split routing, or IPv4 and IPv6 using different exits. Rule those out with the comparison table above first.