Multi-User IP Address Detection

This post introduces 'multi-user IP address detection' as a new capability within Cloudflare's security offerings. It explains the challenges posed by shared IP addresses due to NAT and CG-NAT, where a single IP can represent multiple users. The post details the technical approach to identifying these multi-user IP prefixes by analyzing distinct source ports and user agents, and leveraging external data sources like PeeringDB and IRR. This feature allows customers to make more informed security decisions, reducing false positives and improving the accuracy of threat detection by differentiating between legitimate traffic from shared IPs and potentially malicious automated traffic.