1. A computer-implemented method comprising: receiving interaction data associated with an action of a user on a network and comprising a record of interaction with a message, the user employed by an organizational entity, the interaction data including an Internet Protocol (IP) address of the user when the message was interacted with, the interaction data representing a tentative association of the IP address and the organizational entity; determining a score indicating a likelihood that the IP address belongs to the organizational entity, the determining comprising identifying a time of day at which the action occurred or a day on which the action occurred; and responsive to the score exceeding a threshold, storing an association of the IP address with the organizational entity.