While testing a recent adtech integration I noticed something I can't explain. The iPhone uses two IP addresses. Seemingly one for HTTP and one for HTTPS. To further confuse things it only happens when the device is not on wifi. Although, the only carrier I've confirmed it happening with is AT&T. FWIW, this does not happen with Verizon

Can anyone explain why this would be the case?

Example:
http://ipof.in/json returns a different IP address than https://ipof.in/json. They appear to be owned by the same carrier (AT&T), as well as both public, but are wildly different (107.77.212.XXX vs 166.216.157.XXX).

It's also worth noting that the response from ipof.in contains a timestamp. Nothing is being cached. I receive similar results with similar service www.ip4.com, etc.

I am just going to take a guess here.  Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result.  As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address.

If this is the case, your phone has one IP address but the carrier's routing shows different origin IP addresses at ipof.in.
