I set up a honeypot once and logged the passwords of created accounts. I then used 'last' to find the incoming ip. I then used ssh to try and connect to the or

I set up a honeypot once and logged the passwords of created accounts. I then used 'last' to find the incoming ip. I then used ssh to try and connect to the originator (from an external box). I went back 5 jumps until I got to a windows server box on a well known hosting service that I could not get into. Lots of what looked like print servers and what looked like linux machines connected to devices. Maybe just the exploit at the time.