Right now, the public IP address the internet sees for your phone is almost certainly not yours. It belongs to your carrier, and at this exact moment it is shared by hundreds, maybe thousands, of other people: someone on a train two cities over, someone paying a bill, someone scrolling a feed. You are all wearing the same address. That arrangement is called CGNAT, and it is the quiet reason a mobile IP is one of the hardest addresses on the internet to block.
We run a proxy network, and CGNAT sits underneath the most trusted product in it. So here is the honest, mechanical explanation: what carrier-grade NAT actually is, the hidden address range it runs on, why every carrier now does it, and why sharing an IP with a crowd of strangers turns out to be a feature, not a bug, when a website is deciding whether to trust you.
What is CGNAT?
CGNAT (carrier-grade NAT) is a translation step an internet provider runs to share one public IPv4 address among many subscribers at once. Rather than give every customer a public address of their own, the carrier hands each one a private address, then rewrites all of that traffic to exit from a small pool of shared public IPs. RFC 6888, the standard that lays out the requirements for these systems, defines a carrier-grade NAT plainly as "a NAT-based logical function used to share the same IPv4 address among several subscribers."
You have met ordinary NAT already. Your home router does it: every laptop, phone, and TV in the house shares the one public IP your provider gave the router, and the router keeps track of which internal device each connection belongs to. CGNAT is that same trick run one level up, by the carrier, across thousands of customers instead of the handful of devices in your home. It is also called large-scale NAT (LSN) or NAT444, but the idea is identical: one public address, many private users hidden behind it.
How carrier-grade NAT works
Follow a single request. Your device holds a private address the carrier assigned it, an address that means nothing on the public internet. When you load a page, your traffic reaches the carrier's CGN equipment, which rewrites the private source address to one of the carrier's shared public IPs and remembers the mapping so the reply finds its way back to you. To the website, every one of those subscribers looks like the same address.
The mapping runs on ports. A public IPv4 address has roughly 65,000 usable ports, and the CGN parcels them out among its subscribers so each person's connections stay separately addressable behind the shared address. That is why RFC 6888 spends most of its requirements on port behavior: it asks a CGN to cap the ports any one subscriber can grab so a single heavy user cannot starve the pool (REQ-4), and to hold a freed port for at least 120 seconds before handing it to someone else so an old connection and a new one never collide (REQ-8). The whole scheme is a careful exercise in packing many people onto one address without their sessions treading on each other.
The address you never see: 100.64.0.0/10
There is a subtlety worth pulling out, because it is where the "shared" part becomes concrete. The private address your carrier assigns you often does not come from the familiar home ranges. It comes from a block reserved for exactly this job: 100.64.0.0/10, formally named Shared Address Space by RFC 6598.
Why a special range at all, when private addresses like 192.168.0.0 and 10.0.0.0 already exist? Because those are already in use inside your home. If a carrier numbered its side of the link with 10.x addresses and your home router also used 10.x, the two private networks would overlap and the translation would break. RFC 6598 solves this by carving out a fresh block that belongs to no one's home network, "used to number the interfaces that connect CGN devices to Customer Premises Equipment," as the RFC puts it. The block is a /10, which works out to about 4.2 million addresses, a private pool large enough for a national carrier to number its subscriber links without ever touching the private space you run behind your own router.
So the shared IP you present to the world is public, but the address on your device is very likely one of these invisible 100.64 addresses that only exists inside the carrier's network. You never see it, and it never leaves.
Why carriers do this: IPv4 ran out
CGNAT is not a design choice anyone made for elegance. It is a workaround for scarcity. The original internet address format, IPv4, has room for about 4.3 billion addresses, and the world blew past that number of connected devices long ago. The regional registries that hand out address blocks started running dry over a decade ago, so a carrier signing up new customers today simply cannot give each one a public IPv4 address. There are not enough to go around.
The long-term fix is IPv6, which has effectively unlimited addresses, and carriers are rolling it out. But the existing internet still runs heavily on IPv4, so carriers need every subscriber to reach IPv4 sites in the meantime. CGNAT is the bridge: it lets one public IPv4 address serve a whole neighborhood of customers, stretching an exhausted resource across far more people than it was ever meant to hold. Mobile networks adopted it earliest and most completely, which is why essentially every phone on cellular data sits behind a carrier NAT right now.
Why a shared IP is so hard to block
Here is where CGNAT stops being networking trivia and starts mattering for anyone who cares how a website reads an IP. When hundreds or thousands of real people share one public address, that address becomes very expensive for a site to block.
Put yourself in the website's seat. A request arrives from a shared carrier IP and looks a little like a bot. The site would like to block it, but it cannot, not without blocking every real customer sharing that same address. Cloudflare, which sees a large slice of global web traffic, notes that a single IPv4 address may represent hundreds or even thousands of users, and that this is common on mobile networks. Banning one such IP is banning a crowd, and much of that crowd are paying users the site does not want to lose.
The measured behavior backs this up. When Cloudflare compared traffic behind carrier NAT against the rest of the internet, the shared IPs carried almost exactly the same share of automated traffic (a median bot rate of 4.8% versus 4.7%), yet they were rate-limited three times as often. The crowd behind a carrier address is overwhelmingly human, so blunt IP blocking mostly punishes bystanders, which is precisely the collateral damage a well-run site works to avoid. That reluctance is the trust. An address that is costly to block is an address that gets the benefit of the doubt.
This is the mechanical reason mobile IPs sit at the very top of the proxy trust ladder. It is not anything clever in the software. It is that a mobile IP inherits the untouchability of the CGNAT crowd it hides in. We walk through that product in full in what is a mobile proxy, but CGNAT is the fact underneath it.
How to tell if you are behind CGNAT
You can check in under a minute, and it is worth knowing. Find the public IP a website sees you as (search "what is my IP" in a browser), then open your router's admin page and read the WAN or internet address it reports. On a phone, the equivalent private address is the one the cellular connection holds internally.
If the two numbers match, you have your own public IP. If they differ, and the address your router or device reports is a private one, a carrier NAT sits between you and the internet. The tell is the range: an address in 100.64.x.x through 100.127.x.x is Shared Address Space and means CGNAT with certainty, and a 10.x or 192.168.x WAN address behind a different public IP means the same thing. On mobile data you can assume it without checking, because carriers run CGNAT on cellular almost universally.
What CGNAT costs you
Because this is the honest version, the downsides belong here too, since sharing an address is not free. The core limitation is that you do not hold a public IP of your own, so nothing on the internet can open a connection to you by default. Outbound traffic works fine, which is why browsing, streaming, and ordinary app use never reveal the NAT. Inbound is where it bites.
Hosting a game server, running port forwarding for a home service, some peer-to-peer transfers, and remote access to a device at home all expect the world to reach a public address that is yours, and behind CGNAT there is no such address to reach. Workarounds exist (relays, hole-punching, IPv6, or paying the carrier for a static public IP), but the friction is real, and it is the most common way a home or small-business user runs headfirst into CGNAT without knowing the name for it.
CGNAT and proxies: the mobile connection
Everything above explains why we build a mobile pool at all. A mobile proxy routes your traffic through a real device on a carrier's 4G or 5G network, which means your exit IP is a carrier CGNAT address shared, at that moment, by a churning crowd of real subscribers. You are not borrowing a clever piece of software. You are borrowing a seat in the exact crowd this whole article is about, the one a website cannot swing at without hitting real customers.
That is the difference from a datacenter IP, which announces "I am a server" through the network that owns it, a signal we unpack in what is an ASN. A CGNAT mobile IP announces "I am one of thousands of phones," and the site treats it accordingly. If your work lives on the hardest targets, that inherited trust is the product, and our pricing page lays out where mobile sits against the cheaper tiers so you only pay for the top of the ladder when a target actually forces you there. For most jobs, start lower and climb only when block rates prove you must, the same honest rule we give for every proxy type.
Sources
- RFC 6888: Common Requirements for Carrier-Grade NATs (CGNs). Defines a CGN as a NAT function that shares one IPv4 address among several subscribers, and sets the port-limit (REQ-4) and 120-second port-reuse (REQ-8) requirements.
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space. Reserves
100.64.0.0/10for numbering the link between carrier NAT equipment and customer devices, and explains why ordinary private ranges could not be used. - Cloudflare, "One IP address, many users: Detecting CGNAT to reduce collateral effects". The measured figures for how many users share one carrier IP, the near-identical bot rate behind CGNAT, and the higher rate-limiting those shared addresses face.