1. A method, comprising: reserving a plurality of network addresses within a public network; by a network server, creating a virtual private network using the plurality of network addresses; by the network server, assigning a network address to a trap, the network address being a dark address of the virtual private network; by the network server, monitoring network traffic destined for the network address; by the network server, gathering data regarding the network traffic including determining a level of the network traffic destined for the network address; and by the network server, comparing the level of traffic to a predetermined threshold level to determine whether the network traffic is unauthorized.