A method of monitoring and protecting access to an online service from Account Take Over, including the steps of: - providing a Traffic Inspector in signal communication with at least one client device for Internet browsing and with a web server having an online service residing therein, - providing a Traffic Analyzer in signal communication with the Traffic Inspector; - identifying each browsing session of the client device on the online service by the Traffic Inspector; - extracting and identifying at least one username, by the Traffic Analyzer, when a user performs authentication to the online service by analyzing the traffic exchanged between the client device and the web server; - collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the Traffic Analyzer, the first characteristic data with a respective identified username and with the client device; - storing the first characteristic data in a database associated with the Traffic Analyzer; - identifying, by the Traffic Analyzer, each anonymous application browsing session of the client device on the online service and each anonymous web beacon generated in a respective anonymous virtual session of the client device on the online service, said web beacon being indicative of the fact that the client device has started a fraudulent browsing session on a phishing web server; - collecting, by the Traffic Inspector, second characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the second characteristic data with the anonymous application browsing session or with the anonymous web beacon identified in the previous step; - associating an identified username with the anonymous application browsing session or with the anonymous web beacon in case of a similarity or substantial coincidence between the first characteristic data and the second characteristic data compared by means of a user prediction algorithm residing in the Traffic Analyzer; - taking security measures on the anonymous application browsing session or the anonymous virtual session of the client device when the number of identified usernames associated with the anonymous application browsing session or the anonymous web beacon in the previous step exceeds a predetermined threshold value. - providing a Traffic Inspector in signal communication with at least one client device for Internet browsing and with a web server having an online service residing therein, - providing a Traffic Analyzer in signal communication with the Traffic Inspector; - identifying each browsing session of the client device on the online service by the Traffic Inspector; - extracting and identifying at least one username, by the Traffic Analyzer, when a user performs authentication to the online service by analyzing the traffic exchanged between the client device and the web server; - collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the Traffic Analyzer, the first characteristic data with a respective identified username and with the client device; - storing the first characteristic data in a database associated with the Traffic Analyzer; - identifying, by the Traffic Analyzer, each anonymous application browsing session of the client device on the online service and each anonymous web beacon generated in a respective anonymous virtual session of the client device on the online service, said web beacon being indicative of the fact that the client device has started a fraudulent browsing session on a phishing web server; - collecting, by the Traffic Inspector, second characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the second characteristic data with the anonymous application browsing session or with the anonymous web beacon identified in the previous step; - associating an identified username with the anonymous application browsing session or with the anonymous web beacon in case of a similarity or substantial coincidence between the first characteristic data and the second characteristic data compared by means of a user prediction algorithm residing in the Traffic Analyzer; - taking security measures on the anonymous application browsing session or the anonymous virtual session of the client device when the number of identified usernames associated with the anonymous application browsing session or the anonymous web beacon in the previous step exceeds a predetermined threshold value.