You’re sharing an address with thousands of people

If you are being challenged on every site at once, including sites you have never visited, the thing you share with all of them is your address — and the odds are that it is not only yours. That is the row this page is about, and the honest headline is that most of the fix is not on your machine.

Every request you make arrives at a server with exactly one piece of information the server can be certain of: the address it came from. Everything else — your browser, your screen, your fonts — is something your side volunteered and could have made up. So the address gets weighted heavily, and it gets weighted on the behaviour of everyone who shares it.

There are four ordinary ways to end up sharing one.

Carrier-grade NAT

Your provider has run out of public addresses and has put you, along with hundreds or thousands of other subscribers, behind one. You can recognise it by an address inside 100.64.0.0/10, or by a reverse DNS name that looks like it was generated rather than assigned. This is normal on mobile networks and increasingly normal on fixed lines outside North America.

From a vendor's side, everything those subscribers do is one address's behaviour. One person running a scraper on that block costs everybody else their reputation.

Campus, office and hotel networks

A university with forty thousand students exits through a handful of addresses. So does an office, so does a hotel, so does a coffee shop chain. The volume from one address is genuinely enormous and genuinely automated in part — every piece of monitoring software, every update checker, every crawler somebody left running.

Public VPN nodes

A commercial VPN's popular exits carry far more traffic than any household, and the autonomous system they belong to is published as a hosting network. Vendors treat hosting networks harshly for a straightforward reason: almost all automated traffic comes from them, because that is where servers live.

A proxy or a security appliance in front of you

Corporate networks frequently terminate and re-issue every connection through an inspection appliance. To the site, all of it is one client with one TLS profile and one address.

How can I tell which of the four I am on?

Your reading names two of them outright from the address itself — carrier-grade NAT, and a network published as a hosting or VPN operator. The other two it cannot see, and you can work them out yourself without running anything, because all four leave different traces in ordinary life.

• Carrier-grade NAT shows up as an inability to receive incoming connections. If port forwarding on your router has stopped working, if a game console reports a strict NAT type, or if your router's status page shows a different address from the one a site reports back to you, you are behind one.
• A campus, office or hotel network announces itself: everyone around you is complaining about the same thing at the same time. That is the strongest evidence available to you and it costs nothing to collect — ask one colleague.
• A public VPN exit is under your control and you can test it by turning the VPN off for one page load. If the challenges stop instantly, the address was doing the work.
• An inspection appliance is a managed-machine phenomenon. Your browser will usually show a certificate issued by your employer rather than by the site, which is visible by clicking the padlock in the address bar and reading who issued it.

Why do the challenges follow me to sites I’ve never visited?

Because the reputation is not held by the site. Anti-bot vendors serve thousands of sites from one set of decisions, so an address that behaved badly toward one customer is met carefully by every other customer, including the ones you are visiting for the first time. That is the entire business model: the sites buy exactly this transfer of knowledge.

It also explains the timing that feels most arbitrary. You did nothing, your setup did not change, and one Tuesday everything became difficult — because on the Monday somebody else on your block did something, or a vendor re-scored the range, or your provider handed your address to a different subscriber pool. The reader changed. You did not.

Does a mobile hotspot actually help?

Often, and it is worth knowing why, because the reason also tells you when it will not.

A mobile network is carrier-grade NAT too — you are sharing that address with a great many other phones. What differs is the classification. A mobile carrier's ranges are published as consumer access networks, and consumer access is where people are; a data-centre range is where servers are. A vendor deciding how much benefit of the doubt to extend cares more about that classification than about how many people are behind the address.

So a hotspot usually gets you through a checkout that a public VPN exit will not. What it will not do is help if the mobile range itself has been recently abused, and it will not help at all if the thing being scored is inside your browser rather than in front of it.

What about IPv6?

If your connection has IPv6 you are usually not sharing at all — the whole point of the address space is that there are enough for everyone, so your device typically has its own. This can produce a confusing reading where a site treats you well over one protocol and badly over the other, on the same connection, minutes apart.

There is no setting that makes this consistent from your side, and turning IPv6 off to force the shared path is the wrong direction: it moves you back behind the crowded address. If your reading names one protocol and your symptoms name the other, that gap is real and it is the network's, not yours.

What you can actually do

Very little, honestly, and this page is not going to pretend otherwise. Switching to a mobile hotspot for one checkout works. Turning the VPN off for one site works. Asking your provider for a dedicated address works, and some will sell you one. Everything else is somebody else's network to fix.

What matters is knowing that this row exists, because it explains the thing that feels most unfair: you changed nothing, you did nothing, and the challenges are about somebody else.

What to say to whoever runs the network

If this is an office, a campus or a building's shared connection, the person who can act on it is not you, and a vague complaint will not move them. Three concrete sentences will.

1. Name the address the network exits on and the time you were challenged. Both are on your reading, and the printable card exists so you can hand it over without explaining any of this.
2. Say which sites are affected and whether colleagues see the same thing. Several people, several sites, one network is the shape that makes this an infrastructure problem rather than a support ticket about your laptop.
3. Ask the one question that has an answer: whether the exit range is published as a business access network or as hosting, and whether the affected traffic can leave over a different path. Those are things a network administrator can look up in minutes and neither requires them to agree with you first.