Repeated SSH password authentication attempts observed within the same activity window, indicating automated credential guessing against the SSH service. The behavior reflects authentication-based access attempts derived from observed password login events without assuming successful compromise.

Identifies HTTP requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration.