awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

This pipeline counts access log lines per client IP: awk takes the first field, sort groups identical IPs, uniq -c counts each group, and sort -rn orders by count descending. The top entries reveal heavy crawlers, scanners, or your own monitoring. Repeat after an hour to spot attack patterns.