Network addresses (e.g., IP addresses) are considered candidates for association with organizational entities (organizations or various subgroups thereof), based on some evidence of a relationship between them. The candidate addresses are scored based on one or more factors that indicate a probability that the candidate address actually belongs to the organizational entity. The candidate addresses with sufficient scores are stored as actual associations between the candidate address and the organizational entity.