I worked for a year as a core network technician with the largest mobile service provider in Canada. I know exactly what you are talking about as I had to deal with these groups of IPs.
so here are the details.
when a mobile device like a cell phone or dongle connects to a network, it has something called an Access Point Name configured. this is a tells the network what sort of device it is to help control traffic.
these APNs have pools of IP addresses assigned to them.
when a device connects, part of the process of establishing a connection is that the network will receive the devices APN and compare it to what is configured in the network. if the APN excists on the network, then the connection will be established with the APN configuration. this sets things like access to different features, speeds, and which IPs to use.
the device is given an IP and it is then able to use the network.
when you disconnect you can disconnect gracefully which happens when you turn off your phone with the power button or go into airplane mode. you can also disconnect abruptly which is when the phone loses power instantly like when you pull the battery out. or if you manage to move out of a service area into an uncovered area so quickly that the network doesnt have time to notice the movement.
when you disconnect gracefully, the device sends the network a message saying that it is disconnecting. as soon as that happens, the IP is put back into the pool of available IPs for other devices with the same APN to use.
when a device disconnects from the network abruptly, then something similar will happen. the network stops receiving messages from the device and a timer starts. this idle timer goes until it hits a preset amount of time. if no messages come in, the network will send a disconnect message addressed to the device (regardless of whether the device gets it or not), and it will clear the resources assigned to the device. this includes the IP. after this happens, the IP is able to be used by another device.
the groups of IPs used by ISPs are not infinite. they are finite addresses that are being recycled over and over and assigned to devices as they connect in different places.
because of how these networks can be set up, it can be nearly impossible for you to find out the range. ISPs have massive ranges and you can't guarantee that you will cycle through the APNs IP pool one address at a time to find the range.
mathematically it is possible but in the real world its not something you can do.
EXCEPT
when a business requests a custom network setup for their employees, they can request an IP pool size.
at this moment, the business may know the specific IP range assigned to it.
when you share IPs its not like a single IP is used by more than 1 person at once. when a device connects and it is assigned an IP it is immediately flagged as in use and it can't be used by another device. only 1 can have it. that way there are no problems. also, IPs are shared by users of the same ISP and for the most part, the same APN.
in fact, IP sharing like this is great because it helps with user protection.
lets say that someone wants to attack your device. they find your IP. they start sending data to your device. this is not good. if the next day you still have the same IP despite having turned the device off, the bad person can continue to send your device data without you wanting it. if however your IP has changed, the person wont be able to attack you any further. in fact, if an outside IP keeps sending data to a single IP after it has been reassigned, its pretty easy to spot this traffic and it can be blocked by the ISP. this protects the next person to use that IP, not just you.