A server includes a service processor hosted by a baseboard management controller (BMC) and independent of a CPU of the server. The server hosts web files. The service processor performs a set of monitoring tasks including receiving packets forming access requests made to the web files. A learning block is updated with information about suspicious packets. A counter is updated indicating a number of times a packet with a signature of a suspicious packet was received. When the counter reaches a threshold, a suspicious packet is analyzed in conjunction with other previously received suspicious packets. The analysis includes rearranging an arrival order of the suspicious packets into a new arrival sequence. The new arrival sequence of suspicious packets is matched to attack patterns in an attack pattern database. When the new arrival sequence matches an attack pattern, source IP addresses associated with the suspicious packets are added to a blacklist.