The honeypot worked! I snagged a hacker Saturday night. Full net-sniff of the traffic in question. They tried to turn it into a warez site, but ran out of disk-space. Seems to be a different group that the last group that hacked us.