Home / Guides

Why do I keep getting CAPTCHAs or blocked? (CGNAT and shared IPs)

If your ISP has you behind CGNAT, your home shares one public IPv4 address with other customers. Many websites judge visitors by IP address, so whatever someone else on that address does can land on you: extra CAPTCHAs, "too many requests" errors, sign-in lockouts and outright IP bans.

Why a shared IP gets you flagged

With carrier-grade NAT, your router doesn't get its own public address. The ISP translates traffic from many homes onto a smaller pool of public IPv4 addresses (see What is CGNAT?). To a website, all of those homes look like one visitor.

That breaks a lot of everyday abuse protection, which works per IP address:

• Rate limits and "penalty boxes." A site that sees too many requests or failed logins from one address may block it for a while or demand a CAPTCHA. On a shared address, one person's failed logins can lock out neighbors who haven't tried yet. The IETF's own write-up of address sharing describes exactly this and concludes that penalty-box defenses "simply will not work" with large-scale sharing (RFC 6269, section 13.1).
• Blocklists. If one customer on the address sends spam or has an infected device, the address can end up on a blocklist, and everyone sharing it is affected (RFC 6269, section 13.3).
• Connection limits. Anti-abuse tools that cap connections per address can mistake many households for one very busy device. An operator-run test of CGNAT reported this problem and warned that a blocklisted shared address or a per-IP connection limit "could negatively impact legitimate users" (RFC 7021, section 3 and section 7).
• Wrong location. The shared address may not map to where you live, so sites can show the wrong city or region (RFC 7021, section 3.4).

Signs it's happening to you

• You get CAPTCHAs or "unusual traffic" checks on almost every visit from home, but rarely on other networks.
• A site says you've made "too many requests" or locks a login when you've barely used it.
• A forum, game or service says your IP address is banned or listed, and you've done nothing.
• Sites show a location that's a different city or state from yours.
• The problem comes and goes, because your shared address can change.

These symptoms have other causes too, like a privacy tool or browser extension, or an infected device on your own network. So confirm CGNAT first: compare your router's WAN address with your public IP using the CGNAT checker or the step-by-step guide. A WAN address between 100.64.0.0 and 100.127.255.255 is the CGNAT range (100.64.0.0/10 explained).

What to ask your ISP

Only your ISP can take you off the shared address. When you contact support, ask these three questions:

1. "Can you move my line off CGNAT and give me my own public IPv4?" Some ISPs do this for free on request. Use the words "CGNAT" or "carrier-grade NAT" so you're routed to someone who knows what it is.
2. "Do you sell a static IP on residential plans, and what does it cost?" A static IP is always your own. Some ISPs only sell it on business plans.
3. "Is IPv6 available on my line, and is it turned on?" IPv6 traffic doesn't go through the CGNAT, so a site you reach over IPv6 sees your own IPv6 address instead of the shared IPv4. The IETF calls IPv6 deployment "the only perennial way" to ease the pressure that leads to address sharing (RFC 6269, section 1). It only helps on sites that support IPv6.

Check what we've already verified before you call: each ISP page lists whether CGNAT is the default, whether there's a free opt-out, the static IP options and IPv6, with sources. See ISPs that use CGNAT, or use the ISP finder to list providers without CGNAT in your state.

If you're stuck on a shared address

• Contact the site that blocks you, say you're on an ISP that shares IPv4 addresses (CGNAT), and ask whether they can review the block.
• Tell your ISP which sites block you and when. A website only sees the shared address; matching it to one customer takes the ISP's own records (RFC 6269, section 13.1).
• Make sure your own devices are clean, so you aren't the one getting the address flagged.
• Found an ISP policy we don't have yet? Submit a report.

FAQ

Why do I get so many CAPTCHAs on my home internet?

If your ISP uses CGNAT, your home shares one public IPv4 address with other customers. Sites that rate-limit or score visitors by IP address see all of that traffic as one visitor, so you can get CAPTCHAs or blocks for activity that wasn't yours.

How do I know if CGNAT is the cause?

Compare your router's WAN IP with your public IP. If they differ, or the WAN IP is between 100.64.0.0 and 100.127.255.255, you're behind CGNAT. Other causes, like browser extensions or an infected device, can look similar, so check those too.

Will a public or static IP stop the CAPTCHAs?

It removes the shared-address problem: with your own public IPv4, sites only see your own traffic on that address. Ask your ISP whether it can move you off CGNAT for free, or whether it sells a static IP on residential plans.

Does IPv6 help?

Yes, on sites that support IPv6. IPv6 traffic doesn't go through the CGNAT, so those sites see your own IPv6 address instead of the shared IPv4. Ask your ISP whether IPv6 is available and turned on for your line.

Can my ISP get a shared IP address unblocked?

Websites only see the shared address, and matching it to one customer takes the ISP's own records. Tell both the site and your ISP what happened and when; the ISP is the only one that can move you to a different or dedicated address.

Sources

• RFC 6269: Issues with IP Address Sharing (IETF, June 2011)
• RFC 7021: Assessing the Impact of Carrier-Grade NAT on Network Applications (IETF, September 2013)
• RFC 6598: the 100.64.0.0/10 shared address space (IETF, April 2012)

This site sticks to ISP facts. It doesn't review or recommend third-party products or services.