TL;DRDetectors estimate how many users sit behind an address using several documented methods — IP-ID counting, per-/24 clustering, concurrent-session and cross-layer RTT analysis, and direct client observation. Ordinary CGNAT sharing and a residential proxy pool both look like many users behind one IP; what separates them is behaviour, and what separates you from a pool is exclusivity.
Counting users behind one address is a solved problem
The idea that nobody can tell how many people share an IP is wrong, and it has been wrong for a long time. A classic technique (Bellovin) uses the IP header's ID field — often a simple incrementing counter — to separate distinct hosts behind a NAT, accurate to within about one host on quiet home networks.
Modern methods are far stronger. Cloudflare's CGNAT classifier reaches 0.98 accuracy using distributed traceroute, WHOIS/PTR keywords, per-IP user-agent and client diversity, and — its most important feature — how addresses cluster within a /24 prefix. Commercial detectors like Spur publish a field, clients.count, that reports the average number of clients observed on an address per day.
The methods, and what each observes
| Method | What it observes | What it separates |
|---|---|---|
| IP-ID counting | Incrementing counters in IP headers | Distinct hosts behind one NAT |
| Per-/24 clustering | Whether addresses group within a prefix | CGNAT (clustered) from proxy pools (scattered) |
| Client diversity | User-agent and device variety per IP | One household from many unrelated users |
| Concurrent sessions | Simultaneous connections and their timing | Normal use from forwarded proxy traffic |
| Cross-layer RTT | The gap between TCP-handshake and TLS-handshake latency | Direct connections from proxied ones |
| Client observation | Where users actually enter and exit | Real subscribers from proxy egress |
One research measurement found the TCP-vs-TLS latency gap sat around 4ms on direct connections and 245–265ms through commercial residential proxies. That method can be attacked, but newer work correlates gateway and forwarded traffic instead and holds up under those attacks.
CGNAT sharing vs a proxy pool
Ordinary carrier-grade NAT and a residential proxy pool both present as many users behind one address — which is exactly why the distinction is hard and worth understanding.
What separates them is behaviour. CGNAT is a real aggregation of households on one carrier in one region, its addresses clustered in the carrier's prefixes. A proxy pool forwards traffic from scattered, unrelated devices across regions, with the concurrency bursts, heartbeats and geographic mismatch that expose forwarding. Detectors read the difference in the pattern, not the address.
How residential proxy pools are actually built
This is why pooled addresses carry a stigma. A 2019 study enumerated over 6.18 million residential proxy IPs across 238 countries and regions; of the devices it fingerprinted, 43% were IoT devices — cameras, DVRs, printers — and among a sample of proxy programs, most were flagged as malicious by antivirus. Pools are assembled from bundled SDKs, unwanted programs and compromised devices.
Even the commercial, opt-in providers source their pools from bandwidth-sharing apps installed by millions of users; one newer technique co-opts entire network segments at the router level. Detectors enumerate these exit addresses by joining the networks and observing them — which is precisely how an address ends up on a list you didn't put it on.
Why exclusivity is the property that matters
If sharing is detectable and pooling carries a stigma, then the property that actually protects an address is that only you use it. A dedicated address behind one user produces none of the concurrency bursts, client diversity or geographic mismatch that mark a pool.
This is a structural point, not a marketing one: one-customer-per-address matters more than the label on the product, because the detection above reads behaviour, and a single user's behaviour is what a genuine residential line is supposed to look like. Exclusivity is a contractual fact, so it is worth getting in writing.
Frequently Asked Questions
Can a website tell how many people are behind one IP?
Yes. Documented methods include IP-ID counting, per-/24 clustering, client-diversity and concurrent-session analysis, and cross-layer RTT. Cloudflare's CGNAT classifier reaches 0.98 accuracy; Spur publishes an estimated per-day client count for an address.
How is normal home sharing (CGNAT) different from a proxy pool?
Both look like many users behind one address. CGNAT is a real aggregation of households on one carrier, clustered in its prefixes; a proxy pool forwards traffic from scattered devices across regions, with concurrency bursts, heartbeats and geographic mismatch. Detectors read the behaviour, not the address.
Why are residential proxy IPs flagged so often?
Because of how the pools are built. A 2019 study found over 6.18 million such IPs, 43% of fingerprinted devices being IoT, many from bundled or malicious software. Detection vendors enumerate these exit addresses by observing the networks — so the addresses end up widely listed.
Does a dedicated IP avoid all this?
It avoids the pooling signals specifically. One user behind an address produces none of the concurrency, client-diversity or geographic-mismatch patterns that mark a pool. Exclusivity is a contractual fact rather than something a lookup shows, so get it in writing.
Updated 2026-08-25 · Back to Guides · View plans →