mockup: ip to honeypot incident transform