Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/).

The aggregations of popular logins and IP locations seem interesting.

From that site:

    Files uploaded 25,522 (46 unique)
    Malware uploaded 7,735 (43 unique)
I wonder what 3 files were so common that they were uploaded 17,787 times instead of malware.

Probably the ssh key