[staticsafe]

You can guess some of it trivially, cloud services such as AWS are popular and mask the ORG using the IP addresses.

Example: any traffic to 17.0.0.0/8 = user probably has an Apple device