A method of monitoring and protecting access to an online service from Account Take Over, including the steps of: - providing a Traffic Inspector in signal communication with at least one client device for Internet browsing and with a web server having an online service residing therein, - providing a Traffic Analyzer in signal communication with the Traffic Inspector; - identifying each browsing session of the at least one client device on the online service by the Traffic Inspector; - extracting and identifying at least one username by the Traffic Analyzer when a user performs authentication to the online service by analyzing the traffic exchanged between the at least one client device and the web server; - collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the Traffic Analyzer, the first characteristic data with a respective identified username; - storing the first characteristic data associated with each identified username in a database associated with the Traffic Analyzer; - identifying each anonymous web beacon generated by the at least one client device on the online service by the Traffic Analyzer, said web beacon being indicative of the fact that the at least one client device has started a fraudulent browsing session on a phishing web server; - collecting, by the Traffic Inspector, third characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the third characteristic data with the anonymous web beacon; - associating an identified username with the anonymous web beacon in case of similarity or substantial coincidence between the first characteristic data concerning each identified username and the third characteristic data concerning the anonymous web beacon compared by means of a user prediction algorithm residing in the Traffic Analyzer; - entering each username associated with the anonymous web beacon in which a situation involving a risk of credential theft has been detected after a phishing attack, in a watch list by analyzing, by means of a detection algorithm residing in the Traffic Analyzer, each anonymous web beacon associated with one or more identified usernames; - monitoring the browsing sessions at risk associated with each username in the watch list when its respective user further performs authentication to the online service and identifying an Account Take Over attack by the at least one client device and protecting access to the online service when the browsing session relating to the anonymous web beacon and the subsequent authenticated session associated with the same username entered in the watch list are close in time. - providing a Traffic Inspector in signal communication with at least one client device for Internet browsing and with a web server having an online service residing therein, - providing a Traffic Analyzer in signal communication with the Traffic Inspector; - identifying each browsing session of the at least one client device on the online service by the Traffic Inspector; - extracting and identifying at least one username by the Traffic Analyzer when a user performs authentication to the online service by analyzing the traffic exchanged between the at least one client device and the web server; - collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the Traffic Analyzer, the first characteristic data with a respective identified username; - storing the first characteristic data associated with each identified username in a database associated with the Traffic Analyzer; - identifying each anonymous web beacon generated by the at least one client device on the online service by the Traffic Analyzer, said web beacon being indicative of the fact that the at least one client device has started a fraudulent browsing session on a phishing web server; - collecting, by the Traffic Inspector, third characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the third characteristic data with the anonymous web beacon; - associating an identified username with the anonymous web beacon in case of similarity or substantial coincidence between the first characteristic data concerning each identified username and the third characteristic data concerning the anonymous web beacon compared by means of a user prediction algorithm residing in the Traffic Analyzer; - entering each username associated with the anonymous web beacon in which a situation involving a risk of credential theft has been detected after a phishing attack, in a watch list by analyzing, by means of a detection algorithm residing in the Traffic Analyzer, each anonymous web beacon associated with one or more identified usernames; - monitoring the browsing sessions at risk associated with each username in the watch list when its respective user further performs authentication to the online service and identifying an Account Take Over attack by the at least one client device and protecting access to the online service when the browsing session relating to the anonymous web beacon and the subsequent authenticated session associated with the same username entered in the watch list are close in time.