An impossible travel detection system configured to mitigate false positives for impossible travel alerts, the system comprising: a data store (116; 416); and a user behavior analytics service coupled to the data store, wherein the user behavior analytics service is configured to: access a first user access location for a user, for a first user access of computing resources identified using a first identification process, to a user behavior analytics service, the first identification process identifying a real world indicator of location for a user device (104; 404) associated with the first user access; store the first user access location in the data store correlated to an access time for the first user access; access a second user access location for the user, for a second user access of computing resources, to the user behavior analytics service, using a second identification process, wherein the second identification process identifies a location associated with an egress point to which communication to and from a user device is routed to access computing resources, such that the user behavior analytics service receives a location associated with the egress point as the second user access location; and filter out the second user location from being used for impossible travel detection. a data store (116; 416); and a user behavior analytics service coupled to the data store, wherein the user behavior analytics service is configured to: access a first user access location for a user, for a first user access of computing resources identified using a first identification process, to a user behavior analytics service, the first identification process identifying a real world indicator of location for a user device (104; 404) associated with the first user access; store the first user access location in the data store correlated to an access time for the first user access; access a second user access location for the user, for a second user access of computing resources, to the user behavior analytics service, using a second identification process, wherein the second identification process identifies a location associated with an egress point to which communication to and from a user device is routed to access computing resources, such that the user behavior analytics service receives a location associated with the egress point as the second user access location; and filter out the second user location from being used for impossible travel detection. access a first user access location for a user, for a first user access of computing resources identified using a first identification process, to a user behavior analytics service, the first identification process identifying a real world indicator of location for a user device (104; 404) associated with the first user access; store the first user access location in the data store correlated to an access time for the first user access; access a second user access location for the user, for a second user access of computing resources, to the user behavior analytics service, using a second identification process, wherein the second identification process identifies a location associated with an egress point to which communication to and from a user device is routed to access computing resources, such that the user behavior analytics service receives a location associated with the egress point as the second user access location; and filter out the second user location from being used for impossible travel detection.