Reverse IP lookup is a way to identify the company behind an anonymous website visit by taking the visitor's IP address and checking which organization that address is registered to. If the visit came from a corporate network, you get a company name instead of a blank session.

The term means something slightly different to a network engineer, who uses it to find the domains hosted on a server or the hostname behind an address. In sales and marketing it almost always means visitor identification, and that's the meaning here.

It's one of the oldest tricks in B2B marketing and still one of the most misunderstood. Teams buy a visitor tool expecting names of people, get a list of companies with a fair amount of internet providers mixed in, and give up within a quarter. And for European companies, the step everyone skips is the legal one: the tracking script and the IP address itself both fall under EU privacy rules.

TL;DR

• The mechanics take four steps: capture the IP, look it up against registry and vendor data that maps address ranges to organizations, filter out internet providers, and attach the visit to a company record. You learn the company, not the person.

• What you can name depends on how the visitor connects. Office networks resolve well. Home broadband, mobile data, public Wi-Fi, VPNs and Apple's iCloud Private Relay mostly show up as an internet provider or nothing at all.

• Ignore headline match rates. Measure your own: identified companies divided by sessions, then the share of those that fit your ICP. The second number is the one that matters.

• In the EU, an IP address can be personal data (the CJEU said so in the Breyer case), and the EDPB says JavaScript that makes a browser send information falls under the ePrivacy consent rule. Plan for consent unless your privacy lead concludes otherwise.

• A company name is only useful once it's enriched, checked against your ICP, weighted by what the visitor looked at and handed to a rep while the interest is fresh.

• The usual waste: trusting vendor percentages, treating a company match as a person, chasing poor-fit visitors and leaving ISP noise in the list.

• Nebor wires visitor identification into your own CRM and outreach tools, with the consent setup and fit filters in place, so your team owns the whole flow after handover.

What happens between the page view and the company name

Every device on the internet talks through an IP address, and every request to your website carries one. Reverse IP lookup turns that address back into an owner. In practice it runs in four steps.

1. The address gets captured. A tracking script on your site or your server logs record the IP of each session, along with the pages viewed.

2. The address gets matched to an owner. Blocks of IP addresses are registered with regional registries. In Europe that's the RIPE NCC, whose database holds an inetnum object for each allocation and assignment of IPv4 address space, linked to the organization responsible for it. Vendors combine registry data like this with their own mapping, because registry entries often name a hosting company or an internet provider rather than the business actually using the address.

3. Providers get filtered out. If the owner is a telecom company, a cloud host or a café's Wi-Fi provider, the match tells you nothing about the visitor's employer, so good tools drop it.

4. The visit attaches to a company. What's left is a company name, its domain and the session data, ready to send to your CRM.

Notice what comes out the other end. Classic reverse IP lookup names a business, not the person at the keyboard. That is still a strong cue: a target account reading your pricing page three times in a week deserves a closer look whether or not you know who was reading.

Most modern visitor tools stack more on top of the IP: a first-party script that tracks sessions over time, cookies, and sometimes a vendor identity graph. That combination is website visitor deanonymization, and reverse IP lookup is its oldest layer. The step from company to person belongs to identity resolution, which is far harder and, in Europe, far more sensitive.

Which visitors can a reverse IP lookup actually name?

Most of your traffic never converts. People read, compare and leave, which is why a big share of B2B research sits in the dark funnel. Reverse IP lookup recovers a slice of it, and the size of that slice depends almost entirely on how your visitors connect to the internet.

Vendors describe the same pattern in their own documentation. Leadfeeder's help center explains that a visitor without their own IP address shows up under the network name of their internet provider, giving airport Wi-Fi, mobile networks and home internet as examples, and admits it hasn't found a way to block every provider.

Apple's relay goes a step further. With iCloud Private Relay switched on, Apple says your IP address is visible only to your network provider and the first relay, and a second relay hands the website a temporary address instead.

Put those together and the trend is plain. When most buyers sat in an office, a big share of B2B traffic carried a company's address. With hybrid work, phones and privacy features, more of it arrives from addresses that say nothing about an employer. That's why the better tools pair the IP with first-party session data, and why IP on its own catches less every year.

How many companies should you expect to see?

Vendors publish match rates, and they're hard to compare because each one counts differently: per session or per company, before or after filtering providers, for US or European traffic. We don't use any of those figures to plan. The number that matters is the one you measure on your own site.

Run a tool for four weeks and work out two ratios. The first is your match rate: sessions tied to a real company divided by total sessions, with internet providers excluded. The second is your fit rate: the share of those companies that match your ideal customer profile. A site with a modest match rate and a high fit rate is in better shape than one that names thousands of companies nobody will ever sell to.

Your audience shapes both numbers. Traffic from large companies with office networks resolves better than traffic from freelancers and small teams working from home. A niche B2B site often sees fewer matches but more of them worth acting on, which is also why low traffic is no reason to dismiss the technique.

Reverse IP lookup under GDPR and the ePrivacy rules

Nebor is based in the Netherlands and most of our clients sell into Europe, so this is the part we spend the most time on. What follows is a practical summary, not legal advice. Your privacy lead or DPO should sign off on your setup.

Start with the IP address. In the Breyer case, the EU Court of Justice ruled that a dynamic IP address can be personal data for a website operator when the operator has legal means to identify the visitor with extra information held by the internet provider. So you can't assume an IP is anonymous just because you only want the company behind it. And a company-level match isn't automatically free of personal data either: a freelancer's or a one-person firm's address points straight at a person.

Then the script. Article 5(3) of the ePrivacy Directive covers storing or reading information on a user's device, not just cookies. The EDPB's guidelines on its technical scope say this is only allowed on the basis of consent or necessity for specific purposes, that JavaScript instructing a browser to send information clearly falls within scope, and that tracking based on IP addresses alone can be covered too unless you can show the address doesn't come from the user's device.

In practice, our default for European sites is simple. Load the visitor identification script only after consent, list the tool in your cookie banner and privacy notice, keep identification at company level, and don't email individuals because of what they browsed. You'll hear that company-level processing can rest on legitimate interest under GDPR. That may hold for your case, but it's a decision for whoever owns privacy, and it doesn't remove the separate ePrivacy question about the script. US rules like the CCPA work differently, so a setup copied from an American playbook won't automatically fit.

Turning a company name into a conversation

A name in a dashboard does nothing. The value comes from what happens in the hour after the visit, and that's a chain you can automate.

First, enrich. Data enrichment turns a bare company name into a profile with size, industry, location and firmographic data, plus the people in the roles you sell to.

Then check fit. Only accounts that match your ICP go further. Everyone else stays in reporting, where they can't waste a rep's morning.

Then weight the behaviour. Three pricing-page visits in a week from a fitting account is a real intent signal. A single blog visit from the same company is a maybe. Let page depth and frequency set the priority, not the fact of a visit.

Then move. Interest is warmest right after the visit, so this is speed to lead applied to anonymous traffic: an alert to the account owner the same day, with the pages viewed and a suggested contact.

This chain is the fuel for inbound-led outbound, where a company showing inbound interest gets thoughtful outbound from the right person instead of a cold sequence. We describe the full build in our website visitor tracking workflow, and the website visitor workflow examples show how an identified account becomes an enriched, qualified and contacted opportunity without anyone digging by hand. When that account books a call, an inbound meeting workflow makes sure the rep walks in knowing what they read.

Where teams waste the signal

The most common mistake is planning around a vendor's match rate. A pipeline forecast built on a headline percentage falls apart when the real list is shorter and a good part of it turns out to be internet providers. Measure first, then plan.

Close behind is treating a company match as a person. Knowing that a company like Meridian Systems visited still leaves the work of finding who there cares, and guessing wrong turns a warm signal into a cold email to the wrong department.

Then there's chasing everyone. Without a fit filter, reps burn days on students, competitors, agencies and companies that could never buy. And finally, relying on IP alone. As more traffic arrives from home and mobile networks, a pure IP setup misses most visitors, so it works best as one input next to form data, first-party sessions and the rest of your buying signals.

In short

Reverse IP lookup names some of the companies reading your site, and only some. It works best on visitors in office networks, it tells you the company rather than the person, and its reach shrinks a little each year as work moves to home and mobile connections.

That's still worth having. A fitting account quietly comparing your pricing is one of the clearest signs of interest you'll get, and catching it the same day beats waiting for a form that may never come. The work is in the parts around the lookup: an honest match rate, a fit filter, a consent setup that holds up in Europe, and a fast handoff to a rep.

If you'd like that built, we connect visitor identification to your own CRM and outreach tools, set the filters and alerts with your team, and hand over a system you can run and adjust without us.

Frequently asked questions