Fewer than 0.2% of domains in the .com, .net and .org zones resolve to an address of their own, and 5% of client addresses generate more than half of the world's web requests, according to a Stanford-led measurement study that reached wide circulation this week, eight days after Google switched on IP-based ad personalization across the European Economic Area.

The paper, titled On IP Addresses as Identifiers of Internet Users and Services, is authored by Rumaisa Habib and Zakir Durumeric of Stanford University, Sudheesh Singanamalla, listed as independent, and Marwan Fayed of Cloudflare. It is scheduled for the Research Conference on Communications, Information and Internet Policy in September 2026. Its most recent citation, an Open Observatory of Network Interference post on collateral blocking in Spain, is marked as accessed on August 1, 2026, placing the draft in the first days of that month. Discussion of the findings spread through LinkedIn over the past two days, drawing comments from security practitioners and academics.

The argument is narrow and empirical. IP addresses were designed to route packets. Policy and commercial practice have loaded them with a second job, that of naming a specific person or a specific service, and the measurements show that the second job no longer works.

What the researchers measured

Three datasets carry the analysis.

The first is OpenINTEL, a large public DNS repository, covering domains in the .com, .net and .org top level domains from 2015 through 2025. The second is a set of active DNS queries run with the ZDNS toolkit in April 2025 against the top million domains in the Cloudflare Radar Domain Rankings. The third is a passive traffic sample: anonymized per-address measurements drawn from 0.1% sampled HTTP request logs at Cloudflare, a content delivery network that the paper states handles an average of 78 million requests per second from points of presence in 330 cities and 125 countries.

The traffic aggregate covers a single 24-hour window on February 26, 2025. Entries were annotated with device type, origin autonomous system and country, filtered through Cloudflare's bot detection to remove automated requests, and then anonymized. Countries with fewer than 100 client addresses or fewer than 10,000 distinct user agents were excluded, removing 48 countries and 0.2% of total requests. What remains covers roughly 195.8 million distinct source addresses across 198 countries.

Because the study examines domains rather than subdomains, the authors state that their figures understate the extent of address sharing.

The address stopped naming the site

As of February 2025, only 0.2% of domains in the three legacy top level domains mapped to a unique address. Read from the other direction, only 16% of addresses hosting at least one such domain hosted exactly one.

Popularity does not repair the picture. Among the top million domains by traffic, a set that earlier work found accounts for roughly 95% of user traffic, only 9% had a dedicated address. Even inside the top 100, the share reached only 19%, and only 19% of the addresses serving a top 100 domain served nothing else.

Concentration at the head of the distribution is extreme. Fifty addresses serve 55% of domains across the three zones. One thousand serve 72%. One percent of addresses in the dataset host 87% of the domains.

Some of that is parked inventory. A single Google address, 34.102.136.180, hosted more than 43 million domains from 2020, and the load shifted to an Amazon address in October 2023 after Squarespace acquired Google Domains. Manual inspection showed the traffic belonged to domains not currently in use.

Strip the parking lots out and the concentration survives. Excluding addresses that host only parked domains, the top 50 addresses serve more than 182 million domains, or 48% of the total. The top ten addresses serving live domains account for over 80 million domains, roughly 21%. The single largest, 198.185.159.144, is operated by Squarespace and serves close to 9.8 million. Amazon's global accelerator supplies four of the top ten.

The five largest providers by domain count serve approximately 66% of domains in the three zones and 49% of the top million.

Provider architecture differs in a way that matters for anyone reasoning about blast radius. Squarespace and Wix peak above 9 million and 5 million domains on a single address respectively, but their median address hosts three and four domains. Amazon, Cloudflare and Google Cloud spread thousands of domains across each address in a much larger pool. A blocking order aimed at a Wix address is likely to hit almost nothing; the same order aimed at a Cloudflare address is likely to hit thousands of unrelated sites.

The trend line points one way. In 2015, 0.9% of addresses accounted for 80% of domains. By 2024, 0.2% of addresses accounted for the same share.

The mechanism behind the shift is the TLS Server Name Indication extension, which lets a client state which service it wants inside the handshake while the address does nothing but get the packet to a data center. The paper notes that SNI has been widely adopted over the past 10 to 15 years, and that operational and policy practice has not kept pace with it.

Half the world's requests, a twentieth of the addresses

The client-side result is the one with direct commercial consequences.

Globally, 5% of client addresses account for 55% of web requests in the sample. Across all source addresses, 44% carry at least two distinct user agents, and at the extreme, a single address produced requests from more than 7,000 of them. Within individual countries, the densest single address accounts for an average of 0.36% of all user agents, a figure that ranges from 0.003% in Italy to 16% in the Seychelles.

The authors avoid claiming to count users behind an address, noting that the relationship between user agents and real people is poorly understood and that request volumes are also shaped by page complexity and subrequests. Instead they measure concentration using Earth Mover's Distance, normalized against a theoretical distribution in which every address makes an equal number of requests. Globally, the request score reaches 0.55 against 0.45 for user agents, with the two correlated at a Pearson coefficient of 0.85.

Country-level variation is wide. Zimbabwe records 5% of addresses producing 83% of all requests and 10% producing 82% of user agents. Papua New Guinea and the Seychelles sit near the top. Syria sits near the bottom, with 26% of addresses showing more than one user agent. The United States falls in the middle of the range, with 5% of addresses accounting for 57% of its requests and 39% of its user agents.

Sub-regional patterns are sharper still. Micronesia and Melanesia record the highest user agent concentration, and in Micronesia 20% of addresses account for 76% of user agents. Even in Northern Africa, which sits lower on the scale, 20% of addresses account for half of all distinct user agents.

The explanations that failed

The paper tests three common assumptions about why concentration varies, and rejects all three.

Dominant carriers do not explain it. The Seychelles fits the theory, with 84% of requests originating from a single address. Syria and Cuba do not: 99.5% and 99.7% of requests respectively come from one provider in each country, yet both distributions sit closest to uniform. Zimbabwe runs the pattern in reverse, showing high concentration while its leading provider in the dataset generates only 32% of requests.

Mobile networks and carrier-grade address translation do not explain it either. Lower desktop share correlates with higher user agent concentration at a coefficient of minus 0.42, but no statistically significant correlation appears with mobile device share.

Historical address scarcity does not explain it. Normalizing registry allocations by national population produces correlations of 0.19 and minus 0.15, close to nothing.

What the authors draw from this is a policy point rather than a technical one. Because concentration appears to follow ad hoc infrastructure decisions rather than documented policy, the clients most exposed to collateral damage from address-based enforcement cannot be identified in advance and bear no responsibility for that exposure.

Street addresses, not names

The framing the authors propose treats an address as the online equivalent of a street address: necessarily public so it can be found, revealing nothing about how many businesses or people sit behind it, and deserving of protection in how it is used rather than in whether it is visible.

On what replaces the identifier role, the paper splits client and server needs. Servers, it argues, have already migrated to names and cryptographic binding through certificates, and the authors call for other protocols to follow so the address can retreat to pure reachability. Client identifiers, in their proposal, move in the opposite direction, toward tokens that are not public, hold no meaning outside a single destination service, and are likely to be ephemeral. Privacy Pass and a rate-limited token issuance draft under discussion at the IETF are named as existing models.

IPv6 receives a cautionary note rather than an endorsement. The authors argue that the larger address space does not resolve the identifier and locator conflict, that hyperscalers and content delivery networks remain agile in how they allocate and reuse addresses, that client operating systems rotate IPv6 addresses at most every 24 hours by default for privacy reasons, and that providers still host multiple domains behind one address under IPv6. The temptation to treat a larger address space as a stable name, in their reading, delays the problem rather than fixing it.

Why the finding matters for advertisers and publishers

The timing is awkward for a large part of the advertising stack.

Google began using IP addresses for measurement and personalization across the EEA, the UK and Switzerland on or shortly after August 3, 2026, a change communicated to AdSense publishers in a mandatory service email on June 17, 2026 and accompanied by a Transparency and Consent Framework registration update covering Feature 3, the identification of devices from information transmitted automatically. Two months earlier, AdSense gained a publisher control that restores the full fourth octet of an IPv4 address in programmatic bid requests, off by default, launched on June 1, 2026. Three days before that, Google added IP address ingestion to Customer Match through the Data Manager API on May 28, 2026, with the same three European territories carved out.

The measurement literature already pointed in an uncomfortable direction. Research from Adstra and InterMedia Advertising, first reported on July 15, 2026, found that only 23% of residential IP addresses reached their intended geographic target in connected television campaigns, with device-level identifiers 71% consistent month over month against 57% for addresses. A study commissioned by the Coalition for Innovative Media Measurement and Go Addressable and conducted by Truthset, released on November 5, 2025, benchmarked nearly a billion records and found IP-to-postal linkages accurate 13% of the time and IP-to-email 16%, with providers agreeing on the same household linkage only 6.4% of the time. FreeWheel, in a February 2026 post, described address-based geolocation as typically resolving only to city level, with acute error in dense urban areas and near administrative borders.

Those studies measured whether an address points at the right household. The Stanford paper measures something prior to that: whether the address corresponds to one household at all. A finding that 44% of client addresses carry at least two distinct user agents, and that one address in the sample carried more than 7,000, sits underneath every frequency cap, every household-level reach calculation and every suppression list built on address matching.

Fraud detection inherits the same problem

Invalid traffic filtering leans on address reputation harder than most parts of the stack. Verification vendors check addresses against databases of data center ranges and known residential proxy networks, a method whose resolution degrades when many unrelated parties share an exit point. An Adalytics investigation covered in March 2025 found that pre-bid systems from major vendors do not receive browser, device and address credentials from some of the largest buying platforms, leaving them unable to separate a declared bot from a data center.

The native controls are not obviously stronger. A Madrid agency demonstrated in March 2026 and published in April that Google Ads exclusion lists can be defeated by separating the address that harvests a valid click identifier from the address that later spends it. The IAB Tech Lab's podcast measurement rules require filtering implausible download volumes from a single address while maintaining an inclusion list of known safe addresses such as dormitories and corporate networks, revalidated at least every 90 days, which is an operational admission that heavy sharing and abuse look alike from the outside.

Regulation is pulling in two directions at once

European authorities treat the address as personal data. France's Conseil d'Etat upheld Criteo's 40 million euro fine on March 4, 2026, reasoning in part that the identifiers at issue were associated with an address and the geographic location derived from it. On the other side, a US federal judge approved the Google real-time bidding settlement on March 26, 2026, requiring a control that strips addresses and other identifiers from bid requests, a mechanism Google shipped in May and which PPC Land examined as a product built to a court deadline.

Access control is a third pressure. The Court of Justice of the European Union accepted address-based geo-blocking as adequate in the Anne Frank Fund case, applying a state of the art standard rather than an absolute one. Meanwhile Proton VPN recorded a signup surge above 1,400% among UK users after the Online Safety Act's age verification duties activated on July 25, 2025, adding another layer of shared addresses to the pool that targeting and enforcement systems both read.

The Stanford paper's opening example is the enforcement version of the same failure: Austrian courts in 2022 directed national ISPs to block a set of server addresses that belonged to Cloudflare, and citizens lost access to thousands of unrelated websites. A commenter on the LinkedIn thread identifying as a tenured scientist at Spain's Consejo Superior de Investigaciones Cientificas connected the findings to blocking practices in Spain and Italy, tagging the post with references to net neutrality.

Farhad Pashaei, a business-to-business cybersecurity content strategist, framed the consequence for automated systems in a comment on the same thread. "I think the Stanford findings are the final nail in the coffin of IP-based security," he wrote, adding that an agent whose identity is tied to its address can be circumvented and that governance belongs at the granular access layer rather than in network infrastructure. That question is live in ad tech: Cloudflare published a registry format for bot and agent authentication in November 2025 precisely because address reputation cannot distinguish a legitimate agent from an abusive one.

Disclosed interests

The paper carries an explicit competing interests statement. Fayed is employed by Cloudflare, a content delivery network whose operations have been directly affected by address-based blocking orders, and the Cloudflare traffic sample forms the basis of the client-side analysis. Singanamalla was previously employed by the same company. Durumeric, whose LinkedIn profile lists him as co-founder and chief executive of Censys and a computer science professor at Stanford, is concurrently employed at Censys, a security company that collects data about both address-based and name-based internet services. The client dataset is described as the passive view of a single network, with third parties estimating that around 20% of all websites use it, and the authors note that the proprietary nature of the data prevented identification of autonomous system numbers and network names.

The work was supported in part by the National Science Foundation under grant numbers 2319080 and 2540803, a Sloan Research Fellowship and a Stanford Graduate Fellowship.

Timeline

Summary

Who: Rumaisa Habib and Zakir Durumeric of Stanford University, Sudheesh Singanamalla, listed as independent, and Marwan Fayed of Cloudflare. The paper carries a competing interests statement covering Fayed's employment at Cloudflare, Singanamalla's prior employment there, and Durumeric's concurrent employment at Censys.

What: An empirical assessment of whether IP addresses still identify users and services. It reports that only 0.2% of domains in the .com, .net and .org zones map to a unique address, that 9% of the top million domains have a dedicated address, that 50 addresses serve 55% of domains across the three zones, and that 5% of client addresses account for 55% of web requests, with 44% of client addresses carrying at least two distinct user agents.

When: The server-side analysis spans 2015 to 2025 with a February 2025 snapshot; the client-side analysis covers a 24-hour window on February 26, 2025; active DNS measurements were run in April 2025. The paper's most recent citation is dated August 1, 2026, it circulated widely this week, and it is scheduled for the Research Conference on Communications, Information and Internet Policy in September 2026.

Where: Global. Client traffic was analyzed across 198 countries after exclusions, drawn from a network with points of presence in 330 cities and 125 countries. Country-level results range from the Seychelles and Zimbabwe at the concentrated end to Syria and Cuba at the uniform end, with the United States mid-range.

Why: Policy and commercial systems continue to treat the address as a name for a person or a service long after content delivery networks, address translation and TLS Server Name Indication separated the two roles. The authors argue the address is neither specific nor fair as an identifier, and that separate client and service identifiers are needed, with server identity bound to names and certificates and client identity moved to private, ephemeral tokens.