Records suspicious login attempts, 404s, and malicious requests, then blocks IPs after repeated attempts.