Can a Mobile IP Address Be Traced?

What a website sees

Every connection reaching a server carries a source address and a source port. A well-run server records them with the time. RFC 6302, the IETF's logging recommendation for internet-facing servers, says servers that log incoming addresses should also log the source port and a timestamp, in UTC and accurate to the second. A log line that follows it looks like this illustrative example:

2026-10-30T14:02:17Z  198.51.100.20:40871 -> 203.0.113.80:443  GET /login
          (public IP)  (source port)          (website)

From the address alone, the site can look up the carrier and an approximate region from IP geolocation. It cannot see a name, a phone number or a precise location; carriers do not publish who holds which address. RFC 6302 explains why the port matters: without the source port and an accurate timestamp, operators that share addresses cannot unambiguously identify a customer when handling abuse or public safety requests.

NAT logs and port mapping

Behind carrier-grade NAT, the carrier's equipment translates each subscriber's private address and port into a public address and port. RFC 6888, the requirements for carrier-grade NATs, notes that an operator needing to identify subscribers would log, for each mapping, the transport protocol, a subscriber identifier, the external address, the external port and a timestamp. The same RFC advises against recording where subscribers connect to, the destination addresses and ports, unless there is an administrative need, and gives privacy as the reason.

Logging every mapping produces huge volumes, so RFC 7422 describes deterministic mapping: each subscriber gets a fixed block of ports on a public address, and the operator only needs to keep the allocation, not every connection.

Put the two halves together: the website's record of address, port and time, matched against the carrier's mapping for that moment, points to one subscriber line. Missing either half, or a clock that is off by minutes, and the match may return many subscribers.

Who can request the records

Carriers do not hand subscriber records to websites or private individuals on request. The usual routes are legal ones, and they differ by country.

United States. Under 18 U.S.C. 2703(c), part of the Stored Communications Act, a government entity using a subpoena issued by an agency, a grand jury or a court can require a provider to disclose a subscriber's name, address, records of session times and durations, and any temporarily assigned network address, among other records. The contents of communications fall under stricter rules in the same section.

European Union. Regulation (EU) 2023/1543 on European Production Orders applies from August 18, 2026. It lets an authority in one member state order a provider in another to produce data, including data requested only to identify a user, which covers IP addresses and, where needed, source ports and timestamps.

Law enforcement has pushed on this for years. In 2017 Europol and the Estonian EU presidency called CGNAT a serious gap in the ability to attribute online crime to an individual, precisely because shared addresses without port data are ambiguous.

Courts in civil cases can also order disclosure in some countries. Retention periods depend on national law and the carrier's policy.

What this means for proxy users

When you use a mobile proxy, the website sees the proxy line's carrier address, not yours. If someone traces that address, the carrier's records point to the subscriber of that line, which is the proxy provider's SIM, not you. The trail then continues at the provider, which knows which customer rented the line and when, because that is how billing works, and at your own internet provider, which carried your connection to the proxy.

So a proxy separates your accounts and your locations from each other in the eyes of websites. It does not make anyone untraceable to those with legal authority, and it is not meant to. Coronium rents each line to one customer, and its terms of service govern how lines may be used.

The CGNAT guide explains the address sharing behind all of this, and can mobile proxies be detected covers what websites themselves can see.

Common worries, answered

Can someone locate my phone from its IP? No more precisely than the carrier and a rough region. Precise location comes from the carrier's network data, which is subject to its own legal rules.

Can someone hack my phone through its mobile IP? Behind carrier-grade NAT, unsolicited inbound connections do not reach your phone at all, because the carrier's NAT has no mapping for them. Attacks on phones come through apps, links and messages, not by knowing the address.

Can two phones have the same IP? Yes, at the same moment. That is what carrier-grade NAT does; the source port tells them apart.

Is a phone's IP the same tomorrow? Often not. Mobile addresses change when the device reconnects, which is why address, port and exact time are needed together.

Frequently asked questions