Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/).
The aggregations of popular logins and IP locations seem interesting.
From that site:
Files uploaded 25,522 (46 unique) Malware uploaded 7,735 (43 unique)
From that site:
I wonder what 3 files were so common that they were uploaded 17,787 times instead of malware.