A method comprising: accessing a first intelligence feed comprising a plurality of cybersecurity incidents, including at least one of threats or attacks, observed on at least one internet-connected computing system and respective indications of from where the plurality of cybersecurity incidents originated; generating a second intelligence feed comprising a plurality of technical indicators defined on at least one virtual private network internet point of presence, VPN internet PoP, (102; 106) that connects a plurality of virtual private network, VPN, tunnels (214; 216) to an internet; comparing the first intelligence feed to the second intelligence feed; determining a particular incident of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed to the second intelligence feed; determining a time frame of the particular incident based on at least one of the first intelligence feed or the second intelligence feed; monitoring use of a particular virtual private network internet point of presence, VPN internet PoP, by a plurality of sources comprising a plurality of clients to determine a plurality of time-based behaviors; comparing the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident to determine a match of a particular behavior of the plurality of time-based behaviors from a particular source comprising a particular client of the plurality of sources to the particular incident; and blocking the particular source at the particular VPN internet PoP based on the determination of the match of the particular behavior from the particular source to the particular incident. accessing a first intelligence feed comprising a plurality of cybersecurity incidents, including at least one of threats or attacks, observed on at least one internet-connected computing system and respective indications of from where the plurality of cybersecurity incidents originated; generating a second intelligence feed comprising a plurality of technical indicators defined on at least one virtual private network internet point of presence, VPN internet PoP, (102; 106) that connects a plurality of virtual private network, VPN, tunnels (214; 216) to an internet; comparing the first intelligence feed to the second intelligence feed; determining a particular incident of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed to the second intelligence feed; determining a time frame of the particular incident based on at least one of the first intelligence feed or the second intelligence feed; monitoring use of a particular virtual private network internet point of presence, VPN internet PoP, by a plurality of sources comprising a plurality of clients to determine a plurality of time-based behaviors; comparing the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident to determine a match of a particular behavior of the plurality of time-based behaviors from a particular source comprising a particular client of the plurality of sources to the particular incident; and blocking the particular source at the particular VPN internet PoP based on the determination of the match of the particular behavior from the particular source to the particular incident.