In reply to a post by ian72:

could be using IP addresses owned by their ISP

This is the bit I'm most curious about. If a company visited our website but they are smaller and only had a standard cheap business broadband connection then surely their name is not listed in a publicly accessible database of IPs?

In reply to a post by ian72:

However, be careful using this data for direct marketing as you need to make sure you are complying with GDPR and either have consent or can show "legitimate interests" - if you can't show either of these then you could be in trouble with the ICO.

To be fair I think my company would mostly be using this data for analysis purposes rather than actually making contact with visitors.

Yes, I agree. We do not expect browsers to allow it. That doesn't mean to say the file system is inviolable. Also, it's easy to find in what subdirectory any particular browser stores its cookies.

Edited by pluralist (Thu 10-Jun-21 15:18:13)

Many companies have their own static IP addresses for their Internet connection. A lot of small companies may have this just via their ISP in which case there would be no simple way to link this back (via whois database or indeed cookies) but if they for whatever reason have registered their own static IP address space then this would be available. Potentially if a company was publishing a web server on an ISP supplied static IP then that could be used to link back to the company but the chain of information starts getting more complex.

In reply to a post by ian72:

Many companies have their own static IP addresses for their Internet connection.

I was thinking this research company is going to pick up a lot of "Virgin Media Business" and "BTnet" and the other corporate ISPs. My corporate has just an IP, no DNS name, and the IP resolves back to our network supplier.

Garbage In - Garbage Out. ??

All IP addresses are governed by regional internet registries (RIRs), in Europe it is called RIPE. There's ARIN, APNIC and others too.

RIRs are responsible for issuing IP blocks to organisations, and also AS (Autonomous System) numbers as well. This is a public database, and you can see all of BT's IP blocks here https://bgp.he.net/AS2856#_prefixes for example. This shows RIPE has issued BT with AS# 2856 and all the IP blocks underneath it. Central routers use something called Border Gateway Protocol (BGP), which is a protocol that allows routers to communicate with eachother and update and 'broadcast' routing tables. This is what happens in places like LINX and usually any end point of any network when it meets another one. It's not broadcast to everyone, just those the ISP 'peers' with (ie an approved neighbourly network). And so as your packet hops along the internet it gets transferred between these routers all talking to each other and thus a connection is made. It's how the Internet works.

That data is all gathered by companies like MaxMind (https://www.maxmind.com/en/geoip2-databases), which publish both free and paid databases gathering all this information, plus other sources to be able to tell more information, location being the most valuable, on an IP address. The company you're engaging with is likely using this (or a similar) database.