A method and a system for detecting an unauthorized activity at a user device are provided. The method comprises: analyzing a first request from the user device, the first request including original client cookie; in response to the original client cookie meeting a predetermined threshold: causing the user device to receive a Java Script Module, thereby enabling the user device to generate a second request, by: receiving server cookie indicative of a given activity associated with the user device being one of: a user activity and a bot activity; generating the second request including first client cookie and the server cookie; determining if the second request is to be transmitted to a web content server associated with the first web page; in response to the server cookie data being indicative of the bot activity: the second request is blocked.