Identify company by IP address and why matching misses home traffic

Every request to your website arrives from an IP address. For some visits, that address belongs to a network that can be tied to a specific company. For many others, it belongs to a home internet provider, a mobile carrier, a VPN operator or a cloud platform, and it says nothing reliable about the visitor's employer. This article explains how tools identify a company by IP address, which public and commercial sources they draw on, where the method breaks down, why remote work changed the picture and why an honest tool reports the share of traffic it matched instead of promising to identify everyone.

What an IP address does and does not tell you

An IP address is a routing label. It tells the internet where to send response packets, much like a return address on an envelope. It is assigned to a network interface, not to a person, and often not even to a single device: an office router can put hundreds of employees behind one public address, and a mobile carrier can put many thousands of phones behind a pool of shared addresses.

That distinction is the foundation of everything else. An address can point to an organization when the organization operates the network. It cannot, on its own, point to an individual. So the honest question is never "who is this visitor", only "whose network did this visit come from, and is that network specific enough to mean something".

• IPv4 addresses are written as four numbers, for example 203.0.113.25.
• IPv6 addresses are longer and written in hexadecimal groups.
• Addresses are allocated in blocks, often called ranges or prefixes, and the block matters more than the single address.

Regional registries and autonomous systems

IP address space is distributed through a hierarchy. Five regional internet registries allocate address blocks within their regions: ARIN for North America, RIPE NCC for Europe, the Middle East and parts of Central Asia, APNIC for the Asia Pacific region, LACNIC for Latin America and the Caribbean, and AFRINIC for Africa. Each registry publishes records, commonly queried through WHOIS or RDAP, that show which organization holds a block and how it can be contacted.

Networks that route their own traffic on the internet use an autonomous system number, or ASN. An ASN identifies a network operator, and routing data shows which address prefixes each ASN announces. Large enterprises, universities, government bodies and of course internet providers and hosting companies often run their own ASN.

These public records are the first layer of company matching. If a block is registered to a manufacturing company and announced by that company's own ASN, a visit from that block very likely comes from that company's network. If the block is registered to an internet provider, the record names the provider, not the provider's customer.

Business ranges, sub-allocations and reverse DNS

Most companies do not hold their own registry allocation. Instead, they buy business internet service, and the provider assigns them a static address or a small block. Registries allow providers to record these sub-allocations, and many do for business customers, which gives a second layer of evidence: the parent block belongs to the provider, but a smaller range inside it is recorded as assigned to a named business.

Reverse DNS adds a third layer. A reverse lookup asks what host name is associated with an address. Business connections often carry names that include the customer's domain or a recognizable label, while residential connections tend to carry generic names that encode the address and the provider's domain. Reverse DNS is helpful but not authoritative, because the owner of the address controls the record and can set it to anything.

Commercial IP-to-company data sets combine registry records, routing data, reverse DNS, observed usage and other business signals, and they maintain the mapping over time as companies move offices and providers reassign space. VisitorDetector uses a licensed B2B IP-to-company data set of this kind to turn a matched address into a company profile with name, website, industry, employee range and HQ location.

Cloud, hosting and VPN ranges

A significant share of addresses on the internet belong to cloud and hosting platforms. Large cloud providers publish the address ranges they use, and those ranges show up in registry and routing data as belonging to the provider. A visit from a cloud range usually means one of a few things: an automated crawler or monitoring service, a corporate proxy or secure web gateway hosted in the cloud, a virtual desktop, or a VPN service running on cloud infrastructure.

Attributing that visit to the cloud provider would be wrong, because the provider is not your prospect. Attributing it to an employer is usually impossible, because the address gives no clue which customer is behind it. The same applies to commercial VPN services and privacy relays, which deliberately replace the visitor's original address with one belonging to the relay.

• Cloud and hosting ranges are identified from published lists and registry data, then excluded from company attribution.
• Known VPN and relay ranges are excluded the same way.
• Some enterprises route staff traffic through their own security gateway; when that gateway uses a range tied to the company, the visit can still match.

Why matching misses home and mobile traffic

Residential broadband and mobile data are the largest sources of unmatched traffic, and no amount of clever data fixes this, because the information simply is not in the address. A home connection is registered to the internet provider. The provider knows which subscriber held the address at a given moment, but that information is private and is not part of any business IP data set. Even if it were, the subscriber is a household, not an employer.

Mobile networks are even less specific. Carriers commonly use carrier-grade address translation, which places large numbers of subscribers behind shared public addresses that change frequently. A visit from a mobile range identifies the carrier and, at best, a broad region.

So when someone reads your pricing page from their kitchen table on a home connection, or on their phone during a commute, a company-level tool cannot attribute that visit to their employer. VisitorDetector excludes residential, mobile carrier and known VPN ranges and leaves those visits anonymous, instead of guessing.

How remote and hybrid work changed the picture

Company identification by IP address was designed for a world where most business browsing happened in offices. Hybrid and remote work moved a large share of that browsing to home connections. Employees who used to visit vendor websites from the corporate network now often visit them from home, on the same laptop, without a corporate VPN.

The effect depends on the audience. Companies that route staff traffic through a corporate VPN or a security gateway still appear under their own network even when staff work from home, as long as the gateway uses identifiable ranges. Companies that let staff browse directly from home largely disappear from network-based matching outside office days. Industries with more on-site work, such as manufacturing, logistics, healthcare and public sector organizations, tend to keep more office traffic than fully remote software companies.

This is why the matched share of traffic varies so much from one website to another, and why it can shift by day of the week. It is also why claims of a single universal match rate deserve skepticism.

Why honest tools report a matched share

Given all of the above, there are two ways for a tool to present its results. It can fill gaps with guesses, for example attributing a residential address to the most common company seen nearby, or quietly treating a cloud range as a prospect. That makes the report look fuller and makes it less true. Or it can match what it can verify, exclude what it cannot, and tell you exactly how much of your traffic produced a company.

VisitorDetector takes the second approach. The report shows the matched share, the portion of visits that came from business networks we could match, alongside the identified companies themselves. That lets you judge the result against your audience, notice when the share changes and avoid building sales motions on companies that were never really there. It also keeps the product at the company level: no names, no emails, no personal profiles.

• Matched visits produce a company profile and visit history.
• Unmatched visits stay anonymous and are counted, not hidden.
• Excluding your own office IPs keeps your team out of the matched share.

Getting the most value from the visits that do match

A matched share well below one hundred percent is normal and still valuable, because matched visits tend to be the ones from business networks during working hours, which is often when serious evaluation happens. What matters is what you do with them.

Weight high-intent pages such as pricing, demo, comparison and case study pages, so the interest score from 0 to 100 surfaces the accounts worth a call. Filter by your ideal customer profile and exclude existing customers and competitors. Send alerts to email or Slack, and sync identified companies to HubSpot, Salesforce or Pipedrive so reps see visit history next to the account. Read how to identify anonymous website visitors for a full setup checklist and score website visitors by intent for scoring advice. The IP to company lookup and anonymous visitor identification pages explain how this works inside the product.

Privacy still applies. In some jurisdictions IP addresses count as personal data, so describe company-level identification in your privacy notice and offer an opt-out. VisitorDetector supports IP truncation, retention settings, consent mode and Global Privacy Control. This article is not legal advice. Our security page covers how data is handled, and b2b website visitor identification at company level vs person level compares the risks of each approach.