If it's the IP of a VPN the next step is to send legal requests to Microsoft, Apple, Facebook, Cloudflare, Steam, Google, popular MMOs, and video/music streamin

If it's the IP of a VPN the next step is to send legal requests to Microsoft, Apple, Facebook, Cloudflare, Steam, Google, popular MMOs, and video/music streaming services for all the information associated with that IP address around the same time. Unless someone spent a lot of effort to avoid it, any person with a IP address probably had something that established a connection at some point to one of those companies and that connection probably contained an identifier of some kind. It might have been a software update check, some user telemetry, a browser tab open to social media, a connection to icloud etc. Once you get a match you ask that company for a list of every IP address that was ever used by that user/account, and in that list you should get a bunch of connections from an IP that belongs to a regular ISP. Very few people are using a VPN 100% of the time.