IPinfo Device Count is our newest dataset that tells you exactly how many devices share an IP address. This includes anything from a single device to tens of thousands, and it accounts for whether that sharing happens at the same time (as in CGNAT environments) or shifts over time (as in dynamic residential networks). It is currently in alpha and covers 7.7 million networks globally.
We’re excited to share something we’ve been working on for months: IPinfo Device Count, a new dataset that answers a question traditional IP intelligence has never been able to answer clearly: how many devices actually share this IP address?
The Problem with “Residential” Labels
Traditional IP intelligence typically classifies IPs as “residential,” “mobile,” or “business.” While useful, this simple categorization hides a major gap in understanding.
- A household with 3 people is labeled residential.
- A university dorm with 500 students is also labeled residential.
- A cellular CGNAT pool serving 10,000 users is labeled mobile.
These labels describe the type of network, but they do not capture its scale. And scale fundamentally changes how the IP behaves and how it should be interpreted.
What Device Count Actually Tells You
Device Count provides three key dimensions of insight.
1. Device Count Buckets
We group IPs into six logarithmic buckets based on observed device sharing:
| Devices | What It Represents | Real-World Examples |
|---|---|---|
| 1 | Single device | Person living alone, individual connection |
| 10 | Small shared | Household (2–10 people), family router, small office |
| 100 | Medium shared | Apartment building, enterprise office, co-working space |
| 1,000 | Large shared | University campus, hospital network, cellular CGNAT pool |
| 10,000 | Carrier-scale | Regional carrier CGNAT, large infrastructure networks |
| 100,000+ | Hyper-scale | National carrier CGNAT pools (rare but real) |
Why use logarithmic buckets? Because small differences at large scales rarely matter operationally. The difference between 8,500 and 9,200 devices is not usually meaningful, but the difference between 10 and 100 devices is. Order-of-magnitude ranges provide actionable clarity without pretending to offer false precision.
2. Time Windows: Concurrent vs Rotating Usage
Device sharing is not only about how many devices are involved, but also when they appear. We measure this across three time windows:
- Daily: Devices observed within a 24-hour period (concurrent usage)
- Weekly: Devices observed over 7 days (campaign-scale behavior)
- Monthly: Devices observed over 30 days (long-term patterns)
This helps reveal very different network behaviors:
Pattern 1: Stable household
- Daily: 10 / Weekly: 10 / Monthly: 10
- Indicates a consistent group of users sharing the same connection
Pattern 2: Dynamic rotation
- Daily: 1 / Weekly: 10 / Monthly: 100
- Suggests ISP IP reassignment, where different devices use the IP over time
Pattern 3: Concurrent CGNAT
- Daily: 1,000 / Weekly: 1,000 / Monthly: 1,000
- Indicates large numbers of users actively sharing the same IP at once
3. Shared Classification
Each IP is assigned a shared field that reflects the shortest time window in which meaningful sharing (10 or more devices) is observed:
daily: Concurrent sharing is happening right now, indicating high immediate impactweekly: Moderate rotation across short-term usage periodsmonthly: Slow rotation over time, likely sequential rather than concurrent usage
Real-World Use Cases
Security & Fraud: Understanding Blast Radius
The problem: You detect malicious activity from an IP. The key question becomes whether you should block it immediately.
Without Device Count: You rely on broad labels like “residential,” which can lead to overblocking or underestimating risk.
With Device Count: You can assess impact more precisely:
- 1 device: High confidence, safe to block immediately
- 10 devices: Medium risk, investigate further signals
- 1,000+ devices: High-impact IP, requires careful review before action
Example: A suspected residential proxy shows 500 devices using the same IP daily. This is not a compromised home router. It is clearly a large-scale proxy network that requires a different response strategy.
AdTech: Reducing Measurement Noise
The problem: A campaign reports 1,000 conversions from a single IP, but it is unclear whether these are legitimate users or artifacts of shared infrastructure.
Without Device Count: You would need manual investigation and delayed analysis, often without a clear answer.
With Device Count: You can quickly classify the IP:
- 1 device: Likely fraud or tracking anomaly
- 10 devices: Could be a household or small business
- 1,000 devices: Likely CGNAT or university network, exclude from attribution
Real-world example: An IP shows 10 daily devices and 100 monthly devices. This suggests dynamic IP rotation. It is fine for short-term measurement, but unreliable for long-term attribution.
Data Quality: Evaluating Third-Party Lists
The problem: You acquire an IP list that performs far worse than expected, but the reason is unclear.
Without Device Count: You cannot easily distinguish between outdated data, misclassification, or shared infrastructure contamination.
With Device Count: Patterns become visible:
- 83% single-device IPs: Likely high-quality residential dataset
- 30% high-device IPs: Likely polluted with CGNAT or shared networks
- Increasing monthly counts: Indicates unstable, rotating IPs unsuitable for targeting
How We Built It
Device Count is powered by multiple complementary data sources:
- Network telemetry: Observing large-scale device behavior across the internet
- Behavioral analysis: Identifying unique devices using privacy-preserving signals
- Temporal modeling: Separating concurrent activity from long-term rotation patterns
- Cross-validation: Comparing results against known CGNAT deployments and carrier infrastructure
We classify device counts into logarithmic buckets using proprietary methods designed to balance precision and statistical reliability. The goal is practical intelligence rather than misleading exact numbers.
Field Definitions
| Field | Description | Example Values |
|---|---|---|
network |
IP network range (CIDR format) | 103.89.82.50/32, 10.0.0.0/24 |
asn |
Autonomous System Number | AS10214, AS7922 |
shared |
Earliest window with ≥10 devices | daily, weekly, monthly |
devices_daily |
Daily device bucket | 1, 10, 100, 1,000, 10,000, 100,000 |
devices_weekly |
Weekly device bucket | same scale |
devices_monthly |
Monthly device bucket | same scale |
Available Formats
- CSV (gzipped): Best for spreadsheets and bulk imports
- JSON (newline-delimited, gzipped): Ideal for pipelines and streaming
- Parquet: Optimized for data warehouses and analytics
- MMDB: Compatible with MaxMind-style runtime lookups
Currently updated on a weekly cadence during alpha.
Faster refresh cycles are planned as the system scales.
How to Get Started
Visit ipinfo.io/data/device-count and complete the early access form. You’ll be asked to share:
- Your primary use case
- Expected query volume
- Preferred data format
- Integration timeline