I once had an IP address connected to an SGI Irix machine (v 6.5!) pass a security audit because the tool automatically scanning it couldn't identify what the hell it was, why none of the standard SSH key exchange algorithms were accepted, and concluded it was likely a honeypot automatically.