Techniques are provided for automatically detecting organizational affiliation of host addresses based on analysis of records. In an embodiment, computers store membership records and access records. Each membership record has an organization identifier that identifies an organization and a member identifier that identifies a member. Each access record has a member identifier that identifies a member and an address that identifies a host. The computers identify a localized subset of access records that have a particular address. The computers identify an involved subset of membership records having a member identifier that matches a member identifier of an access record of the localized subset. The computers determine statistical information based on the localized subset of access records and the involved subset of membership records. Based on the statistical information, the computers identify an organization identifier whose frequency within organization identifiers of the membership records of the involved subset exceeds a threshold.