Does CGNAT/Residential proxy provide plausible deniability on home internet?

Questions
1

I checked an IP intelligence site and noticed a large number of devices sharing the exact same public IP as my home connection at the same time. There’s probably way more active than what this site is detecting.

image
image695×325 16.6 KB

The graph shows hundreds of active devices peaking around 300+ over recent weeks on this single IP. Some of these endpoints are explicitly flagged as residential proxy exits:

image

This is a major, well-known US residential carrier that uses CGNAT. Keep in mind my IP changes several times a day and instantly if the router is reset/connection drops. I’m aware that carriers can usually narrow it down using the source port + a precise timestamp from their NAT logs. That part is clear.

What still bothers me is the residential proxy situation. These commercial proxy networks deliberately route traffic through real home CGNAT IPs. So even if the ISP successfully maps IP + port + timestamp to a specific subscriber account, that account itself may just be a proxy exit node rather than the actual originator of the traffic.

brave_Rf0YUO8zW2
brave_Rf0YUO8zW2727×129 20.9 KB

Even Apple formally acknowledges the problem in their Law Enforcement Guidelines ^

Device type or fingerprinting information only comes into play if the website/app that originally logged the IP also collected and retained it.

Without the source port from the original website/service logs, a clean “that’s him” identification on CGNAT becomes difficult or impossible. The website provides its logs to law enforcement. Law enforcement then asks the ISP for the subscriber behind that public IP at the given time. If law enforcement only has the public IP + timestamp and no source port, the ISP looks at its logs and sees:

  • Port 41234 → Subscriber A
  • Port 41890 → Subscriber B
  • Port 42511 → Subscriber C
  • Port 43102 → Subscriber D
    plus more

All of those were active on the same public IP at that exact second. Without the source port, the ISP has no way to know whether it was A, B, C, or D. The different ports only help after the source port number is supplied. The port is the piece of information that lets the ISP pick the correct row from its own logs.

If the website provides a complete IP history log than this doesn’t seem like an issue. For services like Telegram that only provide a single IP this could be a issue during the initial identification stage of an investigation.

Edit:
This could also drag innocent people into investigations. If the ISP isn’t keeping detailed CGN logs they probably will hand out a fat list of people that were using the IP meaning LE has to go through each 1 by 1 searching for correlation.

2

I think this analysis would also supplement what we may lose with IPv6, and perhaps the continued use of NATs for privacy protection.

Posting related wiki for possible readers unaware of NATs.

3

Can you check any public VPN IPs? I’m wondering the amount of “active devices” that the tool says for them.

4

Yes they keep an extensive list. I found them them because the site was mentioned in a FBI case. https://spur.us/ They have a free plan for simple checking.

5

I wonder if I’ll be able to sign up :smiling_face_with_tear:

6

Yes, and it is the same thing when someone with their own IP address runs such a residential proxy. Law enforcement would go to them.

7

CGNAT, IPv4-only, is a great way to blend in with a large legitimate crowd. It’s essentially the same privacy mechanism used on VPN servers. When using a VPN provider, they could identify your subscription account with a logging mechanism that ties packets to a specific connecting VPN client and its public key. When using CGNAT without VPN provider, the carrier can identify your subscription account based on flow records / NAT translation logs and internal IP assignment records.

In some countries, especially European countries without mandatory data retention, CGNAT is a meaningful obstacle for identification (there’s some posts by Europol complaining how CGNAT makes their job much harder). The consequence is that IP addresses are weak identifiers and usually require additional circumstantial evidence to identify someone with high confidence.

In the US, when the visited website/accessed resource retains the source port, you have to assume that CGNAT gives you zero anonymity because extensive logging exists. In some parts of the EU, even with a source port, there may simply not be enough logs collected.

8

ISPs do log CGNAT leases and Apple isn’t the one who decides what to do in their transactions with LE. CGNAT deployments are dualstacked this days so there’s an easy way to correlate customers with IPv6.

Does CGNAT/Residential proxy provide plausible deniability on home internet?

No. Police can forensically investigate this.

9

Source port in website logs not a common practice, it is starting to get adapted though because people are waking up. No source port for CGNAT IP = Weak device attribution = Must find other leads.

Meta, Snapchat, Roblox, Grindr all added source port logging because law enforcement and NCMEC told them IP-based investigations are difficult without it for shared IP customers.

10

I see it in many telemetry frameworks nowadays.

11

How did you make an account?

12

Yes, that’s good and bad about CGNAT. That’s why IPV6 is on the way.

13

You’re not running something like this by chance?

14
IPv6 Trivia

It was introduced in December 1995, making it currently 30 years old.

15

that’s a question for the other 300+ people sharing my ip :grin: