Turn Anonymous Traffic Into Leads (And What That Can't Do)

Ninety-something percent of the people who visit your site leave without telling you who they are. For a B2B site that's the whole problem in one sentence: the buyer researched you for three weeks, read your pricing twice, sent the link to two colleagues — and you have a row in an analytics tool that says Direct / (not set).

Visitor identification closes part of that gap. It's also the most oversold category in growth tooling, so this post is mostly about the limits, because the limits are what determine whether it's useful to you at all.

What it actually does

The mechanism is unglamorous. When someone visits your site, their request arrives from an IP address. Some IP addresses are registered to companies — a corporate office, a university, a business ISP block. If you can look up who owns the IP, you can say: someone at Acme Corp read your pricing page.

That's the entire trick. No cookies, no cross-site tracking network, no mysterious "identity graph."

Which means it's worth being precise about what you get:

It identifies accounts, not people. Any tool claiming otherwise — "we'll give you the name and email of your anonymous visitors" — is either buying data from a source you should read very carefully, or fingerprinting in a way that is becoming illegal in an increasing number of jurisdictions. There's no clever version of this. An IP belongs to an organisation, not to a human.

The four cases where it returns nothing

This is the part vendors leave out of the demo. A large fraction of your traffic cannot be identified, and the honest ones tell you which fraction.

1. Home broadband

Someone reading your site from their sofa arrives on a residential ISP address. The IP resolves to Comcast or Jio or BT. That's the ISP's name, not a lead — you cannot pitch Comcast because someone in Ohio browsed your pricing page on their home wifi.

Residential IPs must be dropped, not reported. A tool that hands you "Comcast" as a company lead is padding its numbers with garbage, and the reason it does that is that "we identified 400 companies" demos better than "we identified 38".

2. VPNs, proxies and Tor

An IP behind a VPN resolves to whoever runs the VPN. If a real buyer at a real company visits you through NordVPN, the reveal says NordVPN. That's not a lead; it's a wrong answer that looks like a right one, which is worse than no answer at all.

3. Datacenters and bots

A big share of your traffic isn't human. Googlebot, uptime monitors, link scrapers, preview-fetchers — they all come from cloud IPs registered to AWS, Google Cloud, DigitalOcean, Hetzner.

These resolve beautifully. Google LLC. Amazon Technologies. They look like the most exciting leads on the list. They are a crawler. Filtering datacenter ranges out is the single biggest quality difference between one of these tools and another, and it's invisible in a demo — an unfiltered tool looks like it's finding more companies.

4. Consumer traffic generally

If you sell to individuals rather than businesses, this whole category does very little for you. Your visitors are on home broadband and mobile networks. That's case 1, at scale. Better to invest in understanding why they don't convert.

So: it's a B2B instrument. If a meaningful share of your traffic comes from people at work, on a corporate network, it's genuinely valuable. If not, no amount of clever engineering will make an IP into a company that doesn't exist.

A company name is not a lead either

Say you've filtered properly and you're left with real businesses. You now know Icomera visited your site. What's that worth?

On its own: not much. It's a fact, not an opportunity — the same symptom-versus-action problem that afflicts every dashboard. "Acme visited" is a chart. Here's what turns it into a lead:

• Which pages, in what order. Someone who read /pricing, then /security, then /pricing again is doing procurement. Someone who landed on a blog post and bounced is doing research, possibly for homework.
• How many separate days. One visit is curiosity. Four visits across two weeks is an evaluation, and probably more than one person.
• Whether they hit a goal. Started a trial, opened the demo video, began the contact form and abandoned it.
• How recently. A visit from six weeks ago is archaeology. Yesterday is a phone call.

This is why the journey matters more than the reveal. The reveal gives you a name; the journey tells you whether the name is worth acting on, and — crucially — what to say. "I noticed someone from your team was looking at our security documentation" is a specific, honest, useful opening. "I saw you visited our website" is creepy and says nothing.

Scoring that journey deterministically — pages weighted by intent, repeat days, goals, decayed by recency — turns a list of companies into a ranked pipeline. The score is a measurement, computed from behaviour you actually observed. That distinction matters when you're deciding who to call on a Tuesday morning.

The privacy posture is a feature, not a disclaimer

Here's the thing that surprised me while building this: the privacy-preserving version is also the better version. Not a compromise — an upgrade.

No cookies, no cross-site tracking

Identification by IP needs no cookie, so there's nothing to consent to under the cookie rules, nothing to break when third-party cookies finish dying, and no tracking script following your visitors around the web. The pixel is a few lines of JavaScript that reports a pageview to your own domain and nothing else.

The IP itself doesn't need to be kept

This is the important one. An IP address is personal data in most of the world. But you don't need to store it — you need to resolve it to a company and then you're done. So: resolve, keep the company, discard the IP.

Any retention beyond that is a liability you're carrying for no benefit. A database full of IP addresses is a database full of personal data that you can't use for anything and someone can eventually steal. Get rid of it on a schedule, unconditionally, whether or not the rest of the pipeline ran.

Role inboxes only — never named individuals

Once you know the company, you can enrich it with public contact details from their own website. This is where most tools quietly cross a line.

Crawl a company's contact page and you'll find two kinds of address:

• info@company.com, sales@company.com — role inboxes. Published for exactly this purpose. Nobody's personal data; a shared mailbox that exists to receive business enquiries.
• firstname.lastname@company.com — a person's work address. Personal data. Published for their colleagues and customers, not so a stranger's software could scrape it into a sales pipeline.

Keep the first. Drop the second. It's tempting not to — a named individual feels like a warmer lead than a shared inbox — but you have no lawful basis to store that person's address, they never agreed to be in your CRM, and the first thing they'll do is ask how you got it.

The cost of the rule is real and worth stating: you'll occasionally drop a genuine team inbox with an unusual name. That's the accepted trade. You still have the company, the journey, their LinkedIn and their public phone number. That is plenty to start a conversation like a human being.

Doing something with it

Identification only pays off if it changes what you do on Monday. Three uses, in increasing order of effort:

1. Confirm your ICP. Look at which kinds of company actually visit. Most people are quietly surprised — you'll find a segment you never targeted reading your pricing page every week.
2. Prioritise the outbound you're already doing. You have a call list. Sort it by "visited us in the last 7 days" and watch your connect rate change. This is the cheapest possible win and it requires no new process at all.
3. Trigger genuinely timely outreach. A company hitting your pricing page three times in a week is a now signal, and now is the only thing outbound has going for it.

If you do reach out, the thing that decides whether it works isn't the tool — it's whether you can send email that arrives at all. That's a separate, purely technical problem, and it's the one that quietly kills most outbound programs before the copy ever gets a chance: how not to burn your sending domain.

What to do this week

• Check whether this is even your game. Look at your traffic. If it's mostly home-broadband consumer traffic, skip this entire category with a clear conscience.
• If it is B2B: install a first-party pixel, wait two weeks, and just read the list of companies. Don't email anyone yet.
• Ask your vendor the uncomfortable question. "How many of the companies you report are datacenters, VPNs or ISPs?" The answer, or the lack of one, tells you most of what you need to know.
• Set a retention policy for raw IPs before you collect the first one. It is much easier to never keep the data than to explain later why you still have it.