September 4, 2026

Your IP Address Is a Costume: CGNAT, Anycast, and Reputation Lies

Fraud tools still talk like it is 2009. One address, one household, one guilt score. Today a single public IPv4 can be a thousand phones behind carrier-grade NAT, a CDN edge that exists in thirty cities at once, or an AI gateway that exits from a prefix rented by the hour. The address is a costume. The ASN and the announced prefix are the actor.

Three costumes that break scoreboards

CGNAT. Mobile carriers and many ISPs ran out of polite IPv4. Hundreds of subscribers exit through one address. If one of them scrapes, the costume gets dirty and a teacher in the same pool fails a captcha. Look up the address on IP Lookup. A fat carrier prefix plus a mobile ASN is a crowd, not a villain.

Anycast. The same address exists in many places. GeoIP picks a famous city — often Ashburn — and writes fiction. Anycast is a routing trick, not teleportation. Looking-glass next hops tell you which copy you hit. A fraud “distance” from that city is noise.

Cloud egress and AI gateways. Serverless functions and model APIs share huge NAT pools. Yesterday’s clean address is tomorrow’s scraper. Blocking the IP is how you block your own vendor next week. Block or allow on prefix and ASN, then review.

What to record instead of a scare-score

• Public IP and covering prefix from live BGP Lookup.
• Origin ASN and whether it matches the product you think you are talking to.
• RPKI state of that origin.
• RDAP owner via WHOIS / RDAP.
• Geo only as a shrug, never as identity.

If those five fields are stable, the user is probably stable. If the score moves and those fields do not, your scoring vendor is chasing costumes.

AI products make this worse

Browser agents, “research” copilots, and scraping assistants exit from data-center ASNs while pretending to be a shopper in Ohio. Downstream sites then ban the ASN and accidentally ban a thousand harmless tools. If you run a site, separate “this ASN is a known crawler pool” from “this human is banned.” If you build an agent, publish your egress prefixes and keep them boring. Surprise ASNs look like hijacks.

A five-minute sanity check

Take the address a fraud ticket named. Look it up. If the prefix is a /12 from a national mobile operator, you do not have a unique suspect. If the origin is a CDN anycast, you do not have a basement. If RPKI is invalid, you may have an actual routing incident — that ticket just became interesting.

Look up the accused IP on IP Lookup. Read prefix and ASN before you trust a numeric reputation.

FAQ

FAQ

Is IP reputation useless?

No. It is a prior. It is a terrible verdict. Combine it with origin and prefix or you will punish crowds.

Does IPv6 fix shared reputation?

It can. It also creates new tracking and new scanner noise. Treat v6 prefixes as first-class inventory, not leftovers.

Should I ban all cloud ASNs?

Then you ban your own status page, your email vendor, and half of SaaS. Ban behavior, allow known vendor prefixes.