A computer-implemented method for communication analysis includes monitoring communication sessions, which are conducted by entities in a communication network. Identifiers that identify the entities are extracted from the monitored sessions. The identifiers extracted from the sessions are grouped in respective identity clusters, each identity cluster identifying a respective entity. A subset of the identity clusters, which includes identifiers that identify a target entity, is merged to form a merged identity cluster that identifies the target entity. An activity of the target entity in the communication network is tracked using the merged identity cluster.