One IP address, many users: detecting CGNAT to reduce collateral effects

Cloudflare has published a method to detect large‑scale IP sharing behind CGNAT to reduce collateral damage in security systems that rely on IP reputation. The team built a supervised learning classifier to separate CGNAT and VPN/proxy IPs from single-subscriber IPs, using a dataset generated from public data and Cloudflare’s own logs. They trained on more than 200,000 CGNAT IPs, about 180,000 VPNs and proxies, and close to 900,000 non‑LSS IPs, with features drawn from per‑IP and per‑/24 prefix analyses.

The approach combines distributed traceroutes, WHOIS and PTR data, and VPN/proxy IP collection, then applies an XGBoost model achieving 0.98 accuracy, 0.97 weighted F1, and 0.04 log loss. They evaluate performance with 10‑fold cross‑validation, reporting a macro‑average AUC of 0.9946. The work uses 1% HTTP log samples over 24‑hour intervals and over 9,000 RIPE Atlas probes to classify traffic as CGNAT, VPN/proxy, or non‑LSS, highlighting that CGNAT users are more likely to be rate limited.