1. A computer-implemented method comprising: receiving interaction data associated with an action of a user on a network, the user associated with an organizational entity, the interaction data including a network address associated with the user at a time of the action; determining a score indicating a likelihood that the network address is associated with the organizational entity; and responsive to the score exceeding a threshold, storing an association of the network address with the organizational entity.