Along the lines of mister_hn elsewhere here, I don't do tracking. I had to insist that my web developer disable cookies, and Google Analytics. So that's out.
I look at my logs. Many are to google-proxy-66-102-6-174.google.com and the like. Many more are for local ISPs like host208-179-dynamic.233-95-r.retail.telecomitalia.it .
But even if I can get a company name out of it, that's not a lead. Which of the 20,000 people in the company should I contact?
To preserve my anonymity, suppose I make software to improve headlight beam designs in cars. (I don't know if that's a thing, but why not?)
Most of my clients will be car companies, or car part companies. Of which only a small number of people will work on that task.
So, if I get an inbound link from Renault, which of the 181,000 people should I contact?
Going to my business, it seems I shot myself in the foot. I have a no-cost/open source version and a commercial version which is significantly better (faster, more capable, etc).
The no-cost version, available via PyPI and elsewhere (that people unknown to me did) has decent market penetration, based on conversations with people at meetings. But they don't know about the commercial version.
I am far from the first to find that packaging/distro sites, which sit between the user and vendor, make it very hard for users and vendors to know about each other.
You know your target customers but perhaps you also need to understand how they buy software. For us, a website and the usual inbound tactics are great but our target customers will expect sales reps, account execs, etc.
The biggest challenge is getting rid of fingerprinting and password-guessing.
On the other hand, being tracked all the time alters the information that some "algorithm" present to you while surfing on net, for instance Google Ads and Search