A system and method is disclosed for affecting action associated with machine-generated traffic. First historical information associated with Internet traffic to an Internet service at a first time is accessed and a first Internet Protocol Address (“IPA”) size representing a first number of devices sharing at least one IP address that accessed the Internet service at the first time is determined. Second historical information associated with Internet traffic to the Internet service that occurred at a second time is accessed and a second IPA size is determined. An algorithm is applied that uses the first IPA size to estimate a third IPA size, representing a third number of devices sharing at least one IP address at the second time. A difference between the third and the second IPA sizes is computed, and evaluated to a threshold. An action is taken at a resource-provider system when the difference exceeds the threshold.