Beyond the Traffic Count: How to Interpret and Act on Monocle Session Enrichment Data

What a month of real website traffic reveals about anonymization, AI crawlers, suspicious infrastructure, and the importance of understanding who (or what) is behind a session.

—

A sudden increase in website traffic is usually good news. More visitors can mean revenue increases, greater brand awareness, successful marketing campaigns, or growing interest in your products and services.

But what if a significant percentage of those visitors aren't actually people? What if some are AI crawlers, others are connecting through anonymization services, and still others are part of coordinated automated activity?

Search indexing, content discovery, authorized AI assistants, and other automated services may deliver legitimate business value. At the same time, unwanted scraping and other automated interactions can consume resources, distort engagement metrics, and create operational or security concerns. The challenge is distinguishing expected automation from activity that requires closer examination.

Traditional website analytics can tell you how many visitors arrived, where they appeared to come from, and which pages they accessed. But those metrics alone don't necessarily explain the infrastructure behind those visits, whether sessions are associated with anonymization services such as VPNs or residential proxies, or whether unusual traffic patterns warrant further investigation.

That's where session enrichment becomes valuable.

Spur Monocle combines IP intelligence with live session telemetry to provide additional context about incoming traffic. By examining anonymization, network infrastructure, service attribution, geography, and automation-related signals together, security and fraud teams can use Monocle to better understand the traffic reaching their applications and make more informed decisions about how to handle it.

To illustrate how to use Monocle data in a real world context, let's examine a month of real website traffic observed using Monocle, what the data revealed, and how security teams can interpret and act on findings.

Starting with the Big Picture: Not All Traffic Is Equal

During a 30-day observation period in June 2026, Monocle analyzed approximately 930,000 website hits​ associated with a collection of online content.

At first glance, that might look like a healthy volume of engagement. But the underlying intelligence told a more nuanced story. Of the total observed traffic:

• 25% was associated with anonymization.
• 27% came from AI crawling.
• 38% originated from data center hosting infrastructure.

Note: Importantly, these categories are not necessarily mutually exclusive. An AI crawler might originate from a data center, while an anonymized connection could also be associated with hosting infrastructure. The percentages therefore shouldn't be added together.

These figures immediately raise questions that conventional traffic analytics cannot fully answer, such as:

• How much of this activity represents legitimate visitors?
• Are anonymized connections accessing content normally, or do they exhibit suspicious patterns?
• Which signals deserve further investigation?

Session enrichment is valuable in revealing the behavior of incoming traffic.

With Monocle, you can establish a baseline for the infrastructure and anonymization characteristics of normal traffic. Then, track changes in those characteristics alongside traffic volume, rather than treating every increase in visits as an increase in legitimate engagement.​

Anonymization Reveals What Traffic Counts Don't

During the observation period, the website experienced a significant increase in traffic following advertising activity and the publication of content that generated additional backlinks. That increase coincided with higher volumes of anonymized traffic and AI crawling activity. In fact, approximately a quarter of website traffic was associated with anonymization during the 30-day observation window.

A successful marketing campaign can attract legitimate visitors, but it can also attract automated systems discovering, indexing, scraping, or probing newly visible content. For example, a sudden increase in VPN traffic might be unremarkable if it reflects an influx of legitimate users. But a concentrated spike from a particular anonymization service, occurring at unusual hours and coinciding with other anomalies, deserves closer attention.

With Monocle, you can correlate anonymization trends with application events, marketing campaigns, authentication attempts, and changes in traffic volume. Then, investigate unusual concentrations by service, geography, and time rather than automatically blocking all anonymized traffic.​

Hosting Infrastructure Helps Distinguish Human Activity from Automation

Another notable finding from the 30-day observation period was that more than 355,000 visits (approximately 38% of the total) originated from data center hosting infrastructure.​ Data centers are commonly used by legitimate services, including search engines, monitoring tools, cloud applications, and AI crawlers. However, they are also used to host automated attack infrastructure. As a result, data center attribution isn't proof of malicious activity or even definitive proof that a visitor is non-human, but it is an important contextual signal.

Consider the difference between an individual customer browsing an e-commerce website and thousands of requests originating from cloud-hosted infrastructure. Both contribute to traffic totals, but their implications for application security, fraud detection, and business analytics can be very different.

Session enrichment helps expose these distinctions by providing intelligence about the infrastructure and services associated with incoming connections. Security teams can use this context to determine whether data center traffic aligns with expected application behavior or warrants additional scrutiny.

With Monocle, you can segment traffic by infrastructure type and examine how hosting-originated sessions interact with the application. For example, high-volume data center traffic targeting login endpoints, account creation forms, or inventory pages may justify further investigation, particularly when correlated with other suspicious signals.​

Geographic Anomalies Expose Unexpected Activity

The analysis also revealed an unusual geographic pattern. Between June 21 and June 23, traffic associated with Singapore increased sharply. Over the observation period, approximately 171,000 visits, or 18.5% of total traffic, were attributed to Singapore.​

What made this interesting was that the content wasn't specifically targeting that market.

An unexpected geographic concentration doesn't necessarily indicate an attack. Cloud infrastructure, VPN exit nodes, and legitimate international interest can all explain why traffic appears to originate from a particular location. But the geographic anomaly became more meaningful when considered alongside the elevated volumes of data center and AI-related traffic.

This illustrates an important distinction between simply knowing a connection's location and understanding its context. A geolocation result may indicate where an IP address is registered or observed, but it doesn't necessarily establish the physical location of the person (or automated system) behind the connection.

By correlating geographic information with infrastructure and anonymization intelligence, security teams can better evaluate whether an unusual location represents genuine customer interest or an artifact of the network infrastructure carrying the traffic.

With Monocle, you can compare geographic traffic patterns with expected markets and historical baselines. When unexpected concentrations appear, investigate the associated infrastructure, anonymization services, and session behavior before drawing conclusions about the origin or intent of the activity.​

Service Attribution Reveals Coordinated Campaigns

Perhaps the most interesting finding during the observation period came from examining the anonymization services associated with incoming traffic.

During the observation period, Monocle detected a noticeable spike associated with Vividhosting_VPN​, a relatively obscure anonymization service with infrastructure in the United States.

What made this activity notable was the combination of concentrated activity and the characteristics of the service itself. Based on Spur's observations, the IP addresses associated with this service exhibited approximately 33% daily churn​, meaning a substantial portion of its observed IP footprint changed from day to day.

This presents a challenge for security controls that depend primarily on static IP reputation lists. As an anonymization service rotates its infrastructure, individual IP addresses may appear or disappear faster than traditional detection datasets can reliably account for them. Rather than treating each new IP address as an unrelated connection, security teams can investigate traffic associated with the underlying anonymization service.

In this case, the observed spike was consistent with a possible coordinated discovery or reconnaissance campaign. However, the available evidence doesn't establish malicious intent or confirm that an attack occurred.

With Monocle, you can monitor traffic concentrations by anonymization service, not just individual IP address. Look for changes in service volume, IP rotation, geographic distribution, and the application resources being accessed. These correlations can help identify activity that would be difficult to recognize through individual IP lookups alone.​

Timing Patterns Add Another Layer of Context

Traffic volume, infrastructure, and geography provide valuable clues, but when activity occurs can be equally revealing. By examining traffic through a UTC-based activity heat map, the analysis identified another anomaly on June 18 and June 19.

The pattern included unusual activity around 1 a.m. UTC on Friday, outside the typical business-hour interaction patterns expected for the target audience. On its own, unusual timing doesn't establish malicious behavior. Legitimate customers operate across time zones, and automated services frequently run outside conventional working hours. But timing becomes useful when combined with other signals.

For example, an unexpected burst of activity originating from a rotating anonymization service, occurring outside normal usage patterns and targeting a narrow set of application resources, provides stronger grounds for investigation than any one characteristic in isolation.

Session intelligence enables teams to move beyond isolated indicators and examine relationships between them.

With Monocle, you can establish normal hourly and daily activity patterns, then correlate deviations with changes in infrastructure, service attribution, and session characteristics. Use these correlations to prioritize investigations and determine whether additional controls are warranted.​

AI Traffic Requires Its Own Interpretation

The final observation involved AI-related traffic. Approximately 27% of visits were attributed to IP addresses declared by AI scraping providers​. Additional analysis performed during the 30-day time period between September 14 and October 14 identified increasing AI agent-related activity, particularly associated with Meta Muse.

This highlights a growing challenge for organizations trying to understand who, or what, is interacting with their websites and applications.

Search indexing, content discovery, authorized AI assistants, and other automated services may deliver legitimate business value. At the same time, unwanted scraping and other automated interactions can consume resources, distort engagement metrics, and create operational or security concerns. The challenge is distinguishing expected automation from activity that requires closer examination.

A traffic spike following a marketing campaign, for example, might reflect genuine customer interest, increased AI crawler activity, or some combination of the two.

In this observation, increased AI-related traffic coincided with growing content visibility. That correlation is interesting, but it doesn't establish whether the activity was beneficial, unwanted, or fraudulent.

For marketing teams, the distinction matters because automated visits can inflate perceived engagement. For security teams, it matters because some automated traffic may require additional scrutiny or enforcement.

With Monocle, you can segment identified AI and crawler-related traffic from other website activity. Then, evaluate it against organizational policies and expected behavior, and correlate AI attribution with session-level signals before deciding whether to allow, monitor, challenge, or restrict particular interactions.​

Turning Session Intelligence into Action

The observations above illustrate why no single indicator is sufficient to determine whether a session is trustworthy. Anonymization isn't inherently malicious. Data center traffic isn't automatically suspicious. Geographic anomalies can have legitimate explanations. And AI automation can be beneficial or harmful depending on its purpose and behavior. The value comes from interpreting these characteristics together.

A practical workflow for security and fraud teams examining web traffic involves three steps:

1. Establish a baseline

Understand what normal traffic looks like across infrastructure types, anonymization services, geographic regions, AI activity, and time-of-day patterns. This creates a reference point for identifying meaningful changes.

2. Investigate correlated anomalies

When unusual activity appears, examine the supporting context. Answer:

• Is traffic concentrated within a particular service?
• Are IP addresses rotating?
• Does the activity originate from unexpected infrastructure or locations?
• Is the timing inconsistent with historical patterns?
• Do session-level signals suggest automation or other unusual behavior?

3. Apply proportionate controls

Use the resulting intelligence to inform decisions at the application or edge. Depending on the available evidence and business context, organizations might allow traffic, increase monitoring, introduce additional verification, rate-limit suspicious activity, or block connections that violate established policies.

How Monocle Helps: Better Visibility Improves Decisions

Over the course of a single month, what initially appeared to be approximately 930,000 website visits revealed a much more nuanced mix of activity. A quarter of the traffic was associated with anonymization. More than a third originated from data center infrastructure. AI-related activity represented a substantial share of visits. Geographic anomalies appeared, and a spike associated with a rapidly rotating anonymization service raised questions about possible coordinated activity.

None of these observations, individually, proves malicious intent. But together, however, they demonstrate why raw traffic counts and isolated IP indicators provide an incomplete picture of what is happening at the application layer.

For security and fraud teams, the goal is to understand which sessions are expected, which deserve investigation, and which may require intervention without unnecessarily disrupting legitimate users.

Monocle provides session enrichment that can support decisioning alongside existing CDN, WAF, bot management, and fraud prevention technologies by providing richer context about the connections and sessions they're evaluating.

Monocle helps organizations move from simply counting connections to understanding the infrastructure, services, and session characteristics behind them so they can investigate more effectively and make smarter enforcement decisions.

For organizations facing increasingly sophisticated anonymization, automated abuse, and AI-driven traffic, Monocle can help make that distinction clearer.

To see Monocle session enrichment in action, sign up for a free account today.