Most security companies do this; the term for a monitored, weakly-secured server like this is a "honeypot". It's a great way to find out about exploits in the wild, which is really valuable knowledge for every hat.

Having said that, it's amazing what OP could do with just one monitoring tool. Very impressive.

There is a company called Smart Honeypot (http://smarthoneypot.com) offering this service. I believe they are using combination of these techniques to track attackers. The point is to make so much of these honeypot so economically make it difficult for attackers to freely run these scripted attacks. Imagine out of 100 attempts for SSH, 90% be a honeypot. This will massively waste attacker's time and effort.