Mapping anonymous Internet entities to known accounts. In an embodiment, events, representing online activity and comprising IP addresses, are received from a plurality of sources. Subsets of the events are aggregated into mappings that associate the IP address, shared by the subset, with an account. Each mapping is associated with statistics regarding the events. A confidence value is calculated for each mapping based on the statistics, and a final subset of the mappings is selected based on the confidence values. Subsequently, when a request with an IP address is received, the final subset of mappings is searched for the requested IP address, and an indication of the account associated with the requested IP address is returned in response to the request.