VPN IP Company Identification: Why Proxied Visits Stay Hidden

Visits from VPNs, proxies and secure gateways usually cannot be tied to a company by IP, because the address belongs to the provider rather than the user’s employer. A careful service labels these ranges instead of naming a customer. Email domains and logged-in behaviour fill the gap.

What a VPN does to the address

When someone connects through a VPN or proxy, your server sees the address of the exit point, not the device. The registry lists whoever operates that exit. If it is a consumer VPN, the operator is a privacy company. If it is a cloud-hosted proxy, the operator is a hosting provider. If it is a corporate security gateway, the operator is the security vendor, even though thousands of staff from many employers share it.

The practical result: the visit is real, the person may be a perfect prospect, and the IP says nothing useful about their employer.

Four cases that look similar but are not

Case	Visible address belongs to	Can a service name the employer?
Consumer VPN	VPN provider	No
Cloud-hosted proxy or scraper	Hosting provider	No
Third-party secure gateway (SASE)	Security vendor	No
Company VPN exiting through own office	The company	Often yes

The last row is the exception, and it is why blanket rules such as “drop all VPN traffic” can discard good signal. Services that classify networks, such as BusinessMCP’s IP to company API, try to tell the cases apart. Its page says secure-egress and SASE ranges are flagged rather than attributed, and that non_business covers ISPs, mobile carriers, cloud hosts and VPNs.

Key takeaway: when a service refuses to name a company on a gateway range, that is correct behaviour, not a gap. Naming the gateway vendor as a prospect would be the real error.

Why this caps match rates

Remote work and zero-trust security have moved more enterprise browsing onto shared egress ranges. That is one reason published company-level match rates sit in the low double digits to mid-30s on B2B traffic. BusinessMCP’s guidance cites roughly 20 to 35 percent; see IP to company match rate for what moves the figure. If a vendor tells you it names most traffic, ask how it treats gateway ranges.

Reading the label

Network classes you may see include vpn, tor, hosting and mobile. For account reporting:

• Exclude VPN, Tor and hosting from named-company lists.
• Keep their visits in traffic and conversion metrics, since the people are real.
• Do not infer the employer from time zone, language or user agent; the evidence is too weak.

For the bot side of the same problem, see filtering bot and cloud traffic.

Signals that still work behind a proxy

You cannot see the network owner, but you can still learn about the visitor.

1. Form fills. A work email gives a company domain with certainty.
2. Tracked email clicks. A click from a campaign identifies the recipient’s domain, even if the IP is a gateway.
3. Logins and trials. Sign-ups with business domains are strong evidence.
4. Stitching. Once a first-party identifier is tied to an email, earlier anonymous sessions can be attached. BusinessMCP’s explanation of visitor identification calls this the deterministic layer. If you use a tracker that stores an identifier, check the consent requirements covered in GDPR and IP lookup.
5. Referrers and campaigns. UTM tags and referring domains sometimes point at an organisation or industry.

What not to do

• Do not buy a service that promises to unmask VPN users. It cannot do so from the address alone, and attempts to correlate other signals into names raise legal problems.
• Do not map a gateway vendor’s name to a CRM account.
• Do not alert sales on a visit that resolves only to infrastructure.
• Do not assume a hosted address means a bot; people use hosted desktops and proxies too.

A tiny experiment

To see the effect on your own audience:

1. Take a day of unique IPs.
2. Resolve them with a service that returns network class.
3. Count the share labelled VPN, hosting or non-business.
4. Compare it with the share labelled company.

If proxied traffic is a large slice, put more weight on forms and email click data. The procedure in how to test an IP to company API works here too.

Setting expectations with stakeholders

Executives often assume IP identification is a census. It is closer to a filter: it surfaces the minority of visits that can be named and gives honest labels to the rest. Explaining that early prevents disappointment and keeps the programme focused on acting on the accounts you do find.

If you want to see a classification in action, the free reverse IP lookup tool shows a hosting or ISP label for non-corporate addresses rather than guessing an employer.

How to talk about this with a vendor

When evaluating a service, ask three direct questions and note whether the answers are specific.

Question	Healthy answer	Warning sign
What do you return for a consumer VPN exit?	A non-business class, no company	A company name or no label at all
How do you treat secure-gateway ranges?	Flagged and not attributed	Attributed to the gateway vendor or a guessed customer
Can you identify people behind proxies?	No, and here is why	A claim that sounds too good, or silence

BusinessMCP’s IP to company API states its position on the first two: VPNs fall under non-business, and secure-egress ranges are flagged, not attributed. You can test that claim directly with a handful of known VPN and gateway exits, which takes minutes.

Practical advice for analysts

Keep a short list of addresses you know are VPN, hosted-proxy or gateway exits, perhaps from your own testing. Feed them through any candidate service as a control group. A service that names a company for any of them is leaking. Add this control set to your regular audits; it is cheap and tells you more than a vendor’s marketing figures. Then record results by date so you can see whether classification quality changes as the vendor updates its data.