A computer system comprising: one or more processors; and one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to determine impossible travel for a specific user entity associated with an on-premises site of an organization network, wherein the organization network comprises a plurality of on-premises networks at different locations that share networking resources including a corpus of internal IP addresses each of which can be assigned to a user entity connected to the organization network without regard to which on-premises network the user entity is connected, so that devices locally connected to the on-premises site using the internal IP addresses from the corpus are unlocatable via geolocation, including instructions that are executable to configure the computer system to perform at least the following: identify an estimated location of an on-premises site by inferring a geolocation of the on-premises site by aggregating geolocations based on external IP addresses of remote devices, which connect to the on-premises site from said external IP addresses, wherein a remote device connects to an on-premises site that is most proximate geographically to said remote device; and assign the inferred geolocation as the estimated location of the on-premises site; identify information related to an on-premises connection event to the on-premises site including the estimated location, first time information, and a first user identification for the user entity; identify information related to a different connection event, where the information comprises location information of the user entity attempting the different connection, second time information and a second user identification for the user entity; and use the information related to the on-premises connection event and the information related to the different connection event, detecting impossible travel for the user entity; and provide an alert indicating an impossible travel condition. one or more processors; and one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to determine impossible travel for a specific user entity associated with an on-premises site of an organization network, wherein the organization network comprises a plurality of on-premises networks at different locations that share networking resources including a corpus of internal IP addresses each of which can be assigned to a user entity connected to the organization network without regard to which on-premises network the user entity is connected, so that devices locally connected to the on-premises site using the internal IP addresses from the corpus are unlocatable via geolocation, including instructions that are executable to configure the computer system to perform at least the following: identify an estimated location of an on-premises site by inferring a geolocation of the on-premises site by aggregating geolocations based on external IP addresses of remote devices, which connect to the on-premises site from said external IP addresses, wherein a remote device connects to an on-premises site that is most proximate geographically to said remote device; and assign the inferred geolocation as the estimated location of the on-premises site; identify information related to an on-premises connection event to the on-premises site including the estimated location, first time information, and a first user identification for the user entity; identify information related to a different connection event, where the information comprises location information of the user entity attempting the different connection, second time information and a second user identification for the user entity; and use the information related to the on-premises connection event and the information related to the different connection event, detecting impossible travel for the user entity; and provide an alert indicating an impossible travel condition. identify an estimated location of an on-premises site by inferring a geolocation of the on-premises site by aggregating geolocations based on external IP addresses of remote devices, which connect to the on-premises site from said external IP addresses, wherein a remote device connects to an on-premises site that is most proximate geographically to said remote device; and assign the inferred geolocation as the estimated location of the on-premises site; identify information related to an on-premises connection event to the on-premises site including the estimated location, first time information, and a first user identification for the user entity; identify information related to a different connection event, where the information comprises location information of the user entity attempting the different connection, second time information and a second user identification for the user entity; and use the information related to the on-premises connection event and the information related to the different connection event, detecting impossible travel for the user entity; and provide an alert indicating an impossible travel condition.