Suspicious activity, like IP addresses or ports being scanned sequentially, is a sign of which type of attack? ​

It depends, but it is definitely a networking attack.

Explanation:

After scanning for vulnerable ports, I could go in a number of different directions. I could initiate a DOS attack by flooding a vulnerable port with requests. I could also initiate a Man-in-the-Middle attack by intercepting their network traffic (usually through port 80(HTTP) if it's not encryped). Because of this, it is highly recommended to use a VPN, so hackers have a harder time getting your data

well you could find somebody who doesn't want theirs and ask for it or possibly trick a dealer into giving it to you for free.