Why a Single IP Address No Longer Means a Single User
Cloudflare’s security products are designed to help customers block malicious traffic — scraping, spam, and other automated attacks — while letting legitimate visitors through. Many of those customers rely on IP addresses as a signal to tell the two apart. That approach has a fundamental flaw: an IP address is frequently shared by many people at once.
Treating an IP address like a phone number that maps to one person was never accurate. A more useful analogy is a postal address: multiple individuals can receive mail at the same location. Through network address translation (NAT), carrier-grade NAT (CG-NAT), VPNs, and proxies, thousands of users can appear to originate from a single IP address. A burst of requests from such an address can look identical to a bot attack, even when it represents normal behavior from many distinct users. Security systems that don't account for this risk blocking legitimate traffic.
That's the problem Cloudflare is tackling with multi-user IP address detection — identifying which IP prefixes are likely shared, so its security products can adjust how they treat traffic from those addresses.
Why IP Addresses Are Shared
The root cause is IPv4's limited 32-bit address space, which supports about four billion unique addresses. Today there are far more devices than that. IPv6 solves the problem with 128-bit addresses, but IPv4 still carries the majority of Internet traffic — roughly 76% of human-only traffic, per Cloudflare Radar.
To stretch IPv4 address space, devices on a local area network (LAN) use private addresses internally and share one public IP through a gateway that performs NAT. This is comparable to an office building where everyone shares a street address and a front desk routes incoming mail to the right person.
As the Internet grew, ISPs needed even more reuse. CG-NAT middleboxes translate hundreds or thousands of private IPv4 addresses into a single public address or a small pool of them. The tradeoff: those public IPs can no longer be tied to any single device, user, or broadband subscription.
How Cloudflare Detects Multi-User IPs
Cloudflare built a detection service that identifies which /24 IP prefixes — address blocks sharing the same first 24 bits — are likely to contain multi-user IPs. The service analyzes both internal and public data, focusing on a few key signals.
Each TCP connection is identified by a 4-tuple: source IP, source port, destination IP, and destination port. When a web client makes repeated requests, it tends to reuse the same source port. Counting distinct source ports for a given IP therefore provides a rough estimate of how many distinct client applications are behind it — and, by extension, how many users.
The service also counts distinct user agents seen in requests from each IP, filtering out bot traffic and counting only browser-based user agents. This has tradeoffs — some users run multiple browsers, and some browsers share identical user agents — but research has shown that unique browser user agent counts are the best available proxy for estimating CG-NAT usage. Grouping IPs by /24 prefix, Cloudflare found that about 35% of prefixes have more than 100 different browser clients behind them over the course of a day.
Additional public data sources refine the classification. PeeringDB provides network operators' self-identified network types, but it only covers a fraction of autonomous systems (ASes). Cloudflare supplements that with its own traffic data to infer AS type, and uses IRR data to flag VPNs and proxies. Because CG-NAT is almost exclusively deployed by broadband providers, knowing whether an AS is an ISP, CDN, or enterprise helps classify the type of multi-user address more confidently.
A scheduled job periodically pulls data from these sources, processes it, and writes the resulting list of multi-user IPs to a database. Another system deploys that list to Cloudflare's edge, letting security products act on it with minimal latency.
Validation and Accuracy
To verify its inferences, Cloudflare built validation datasets from independent measurements. One technique runs traceroute queries from RIPE Atlas probes to each probe's own public IP address. If the path terminates immediately or with a single hop — likely a home NAT — the address is probably not behind CG-NAT. If the path includes addresses in the RFC 6598 CGNAT prefix or other private/shared space, the probe is likely behind CG-NAT.
Cloudflare is also working with ISP partners to confirm known CG-NAT IP addresses, which should improve inference accuracy and reduce false positives for legitimate users on those networks.
The service currently identifies approximately 500,000 unique multi-user IP addresses, and Cloudflare says it is continuing to tune detection accuracy.
Impact on Bot Management and Rate Limiting
The initial rollout integrates multi-user IP detection into Cloudflare's Bot Management and Rate Limiting products.
Bot Management relies on five detection mechanisms, and the integration improves three of them: the machine learning (ML) model, the heuristics engine, and behavioral analysis. Multi-user IP addresses and their types become additional features in the ML model. The other mechanisms also treat multi-user IPs differently — for instance, a series of requests from a shared IP isn't treated as if it came from a single user. There's no new interface for this feature; customers should simply see fewer false positive bot detections involving shared IPs.
For Rate Limiting, the integration raises the threshold when requests come from multi-user IP addresses. The increase is deliberately conservative, so rate limits still apply — but legitimate users behind shared IPs should be blocked or challenged far less often.
What's Next
Cloudflare plans to extend multi-user IP detection across other products that treat IP addresses as a uniqueness signal, including DDoS Protection, Cloudflare One Intel, and the Web Application Firewall.
Detection itself will also improve. One planned data source would estimate subscribers per advertised IP address for each AS; ASes with more estimated subscribers than available IPs must rely on CG-NAT. Better ISP partner validation data should also refine accuracy. And the Bot Management integration creates a feedback loop: the challenge solve rate (CSR) — the proportion of challenges that were solved by humans — can help confirm that flagged multi-user IPs truly represent legitimate traffic customers shouldn't block.
Long-term, broader IPv6 adoption could reduce the need for CG-NAT and other IPv4 sharing mechanisms. But new technologies that obfuscate IP addresses for privacy — such as randomized IPv6 addresses — make it unlikely that tying an IP to a single user will ever become easier. Cloudflare's position is clear: eventually, IP addresses will be completely unassociated with identity. Until then, the company is working to make sure its customers don't mistake a shared address for a single, malicious actor.
