Why thousands of strangers share your IP address
The number the internet treats as your address, the one every reply gets sent back to, feels personal. On most mobile networks it belongs to your carrier, and at this exact moment hundreds or thousands of strangers are sitting behind the same number with you, invisible to you and to each other. The systems trying to judge you by that number usually cannot tell any of you apart.
I should declare an interest before explaining it. I run mobile proxy lines on carrier SIMs in Singapore, and the commercial value of those lines rests directly on the property this piece describes. The crowd behind a mobile address is the reason such addresses are treated gently, which is why that property gets sought after and paid for, and just as deliberately studied by everyone whose job is telling crowds apart. Very few subjects sit closer to my own operation than this one.
Four billion turned out to be small
The cause is a decision made decades ago, when the internet was young and its designers could not picture its eventual size. Every device speaking directly on the network needs an address, and the original addressing system had room for roughly four billion. At the time that read as inexhaustible. Then came the phones, and after them the laptops and tablets and watches and doorbells and cars, billions of devices, each wanting to speak.
The original pool drained years ago, handed out to the last entry, while the number of devices demanding addresses kept climbing. Carriers were left with brutal arithmetic: far more customers than addresses, and no new addresses of the old kind to be had at any price.
The promise that broke
The internet’s early deal was simple. You connect, the network hands you a public address, and for as long as you stay online that address is yours alone. It worked like a phone line in the old sense, one number pointing at one household.
A remarkable amount of security machinery was built on that assumption. The address stood in for a person or a place. Block the address, block the troublemaker. Recognize the address, recognize the returning customer. It was never perfectly true, and it was true enough to lean on for decades, so everyone leaned. Then the addresses ran out and it stopped being true at all.
One door, thousands of rooms
The carriers’ answer was to take a technique that had quietly held the internet together for years, network address translation, and scale it to an entire subscriber base at once. That is the whole meaning of carrier grade.
Picture one public address as a single door onto the internet. Behind the door sits a private network where thousands of customers each hold an internal address that means nothing to the outside world. When any of them reaches out to a website, a shared gateway swaps their private address for the public one on the way through. To the site on the far side, everything appears to come from that single shared number. The crowd is invisible. Only the door is ever seen.
The bookkeeping that makes it work
The gateway earns its keep by keeping thousands of simultaneous conversations untangled. As your traffic leaves through the shared door, the gateway records a note to itself: this particular connection, on this particular channel, belongs to this customer and nobody else. When a reply arrives addressed to the shared public number, the gateway consults its notes, finds which subscriber that channel was promised to, and threads the answer back to you alone.
It does this for staggering volumes of parallel activity, thousands of people streaming and scrolling and paying bills at the same instant, every conversation funneled through one number and every reply routed home by a careful table of who holds which channel. It works so smoothly that most people live their entire online lives behind one of these gateways and never suspect it exists.
Reputation becomes collective
The internet keeps score on addresses. Behavior seen coming from an address accrues to it as a kind of reputation, and systems everywhere consult that reputation when deciding how much to trust the next visitor wearing it. That scheme had rough justice to it when an address meant one household.
Put a thousand strangers behind one address and the scheme turns into collective punishment. One member of the crowd sends spam or hammers a site, and the shared address takes the hit for everyone. The score drops, and suddenly the student, the grandmother, and the person quietly paying a bill all find the internet has grown suspicious of them. They face endless puzzles demanding proof they are human, or slow responses, or flat refusals, punished for the sins of a neighbor they cannot see and never chose. Nothing in their own behavior changed. The coat they were handed had someone else’s history sewn into it.
The assumption that quietly dissolved
Step back and the deeper fault line shows. Rate limits, blocklists, and trust scores across the industry still quietly assume that one address maps to one actor. Carrier grade sharing shattered that mapping silently and at enormous scale. The address now points at a gateway, and behind the gateway churns a population whose membership drifts hour by hour.
Any system still reading that number as an identity is making decisions on a foundation that dissolved underneath it, blocking innocents here and waving through the wrong people there, all while confidently reading a name that stopped belonging to anyone in particular.
Why mobile addresses get treated gently
This is also the answer to a question that puzzles people who study traffic. Addresses belonging to mobile carriers are notoriously hard to judge and harder to block wholesale. The reason is that the crowd behind them is real. A genuine, churning population of ordinary people uses their phones through each shared address, so the traffic coming off it looks messy and human because it is messy and human.
A website that bans such an address the moment it sees something it dislikes has banned a town’s worth of innocent customers along with one troublemaker, and it knows this, so it hesitates. That hesitation is precisely the property my industry sells, and precisely the property detection teams spend their days working around. Both sides of that trade exist because of the same door.
Cover for the crowd, cover in the crowd
The uncomfortable corner has to be named. The crowding that shields the innocent grandmother from a wrongful block also shelters anyone who would rather not be singled out. When a thousand people share one address, isolating any one of them is structurally hard, for good reasons and bad alike.
So the shared address gets fought over from both directions. Those abusing it lean on the crowd to disappear into it. Those defending against abuse have to find ways of separating one member from the rest without punishing the whole group. The door that keeps a billion ordinary people online and the door that muddies accountability are one door. There is no version with only the first property.
What defenders do instead
Systems that can no longer trust the address adapt by demoting it. Instead of asking only where a visitor came from, they ask what the visitor is doing. The shape of the behavior, the rhythm of the requests, the countless small signals a real person on a real device gives off, all of it gets weighed, with the address downgraded to one blurry hint among many rather than the verdict.
Underneath, the slow structural fix has been in progress for years. A vastly larger successor pool of addresses now exists, big enough in principle for every device on earth to hold its own again, and the internet has been migrating toward it for a long time. The shortage that forced the crowding was always meant to be temporary. Temporary, on the internet, has a way of outliving everyone’s patience.
A single blade
Both edges are real and neither can be filed off. Carrier grade sharing is one of the quiet feats that made the modern mobile internet possible. Without it the addresses would simply have run out, and billions of people who came online in the past decade might have had no way on. It stretched an exhausted resource across a world that had far outgrown it. The same mechanism weakens the whole idea of judging anyone by their address, hands out collective punishment to people who did nothing, and gives cover to people who did plenty. It shelters the crowd and hides the guilty in one motion.
Most people picture their address as a home, a fixed point that says here is me. For a great many of us that quietly stopped being true years ago. The number the internet reads as your name is a shared line, a coat passed around a crowd, a door with a thousand people behind it. Once you see that, a lot of the modern internet’s strangeness resolves: the sudden distrust, the puzzles demanding you prove you are human, the sense of being judged for something you never did. You are being read by systems that still believe an address is a person, on a network where it stopped being one, and a surprising amount of what happens to you online is the slow fallout of that single unspoken fact.
More on the machinery running underneath the ordinary internet at The Hidden Internet.
Get new guides and videos first — join the Telegram channel.