1. A method, comprising: by a network server, monitoring network traffic destined for a dark network address assigned to a trap in a virtual private network; by the network server, gathering data regarding the network traffic including determining a level of the network traffic destined for the network address; and by the network server, comparing the level of traffic to a predetermined threshold level to determine whether the network traffic is unauthorized.