Blockchain technologies are becoming increasingly popular for financial and business solutions thanks to their many features and adaptability. However, their security is not assured. Of particular concern are majority attacks, which exploit the consensus algorithm used to resolve competing chains to modify past and present transactions on the blockchain. Despite numerous in-the-wild majority attacks, detecting in-progress attacks remains difficult, with most attacks remaining undetected for hours or days. to understand better these attacks and why they are so difficult to detect, in this paper we present a series of increasingly sophisticated attacks performed in an experimental environment and analyze the resulting network traffic. We then propose a possible detection mechanism based on the shared characteristics of these attacks. The implementation of such an algorithm is finally tested in a variety of experimental environments.