1. A method comprising: retrieving an event attribute associated with a data call involving an end user host, wherein the data call corresponds to a data service, and the event attribute specifies a network address of the end user host; comparing the event attribute with a predetermined value; and selectively generating, based on the comparison, an alert indicating possible unauthorized use of the data service.