Vaultline watches every laptop and inbox in your company from one console in Chennai. Phishing, ransomware and stolen credentials are isolated in a median 1.8 seconds, and your CERT-In report is drafted long before the six-hour window is a worry.
Eight seconds of the feed, Wednesday 3 September, 02:14 IST. Times are from the first byte seen to the file, mail or session being isolated. The names are our customers'; the IPs are the attackers'.
| Time, IST | Source | Target | Vector | Verdict | To quarantine |
|---|---|---|---|---|---|
| 02:14:07 | 185.220.101.34 | accounts@sakthitextiles.in | Phishing, invoice lure, spoofed TNEB sender | Quarantined | 1.4 s |
| 02:14:19 | 45.155.205.12 | LAPTOP-CBE-0417 | Ransomware dropper, LockBit 3 variant | Isolated | 2.1 s |
| 02:15:02 | 103.21.58.77 | hr@aruvi-hospitals.in | Credential harvest, fake Microsoft 365 sign-in | Quarantined | 1.1 s |
| 02:15:40 | 91.92.240.19 | DESKTOP-MAA-1120 | Living-off-the-land, encoded PowerShell | Isolated | 2.6 s |
| 02:16:11 | 172.105.44.8 | billing@karurvysyaauto.in | Business email compromise, changed bank details | Held for review | 1.7 s |
| 02:16:53 | 194.26.29.101 | MBP-CBE-0088 | Malicious OAuth app, mailbox read scope | Revoked | 0.9 s |
| 02:17:24 | 62.204.41.55 | ops@thanjavurfoods.in | Phishing, QR code to credential page | Quarantined | 1.3 s |
| 02:18:05 | 198.98.51.20 | LAPTOP-MDU-0231 | Infostealer, RedLine family | Isolated | 2.3 s |
Four parts, wired in one direction. Below is the path a real LockBit dropper took through them on 3 September, from the moment our Mumbai MTA accepted the mail to the moment 340 laptops in Coimbatore had the hash blocked.
Drag sideways to follow the path.
Mail from 185.220.101.34 accepted for scan. Subject: TNEB invoice, August.
invoice_aug.pdf.exe detonated in the Mumbai sandbox. 41 behaviours recorded.
LockBit 3 dropper, 99.4% confidence. Mail quarantined, sender domain blocked.
Same hash already on LAPTOP-CBE-0417 from a USB. Killed, 812 files rolled back.
CERT-In form drafted from evidence the console already held.
K. Vasanth, Chennai SOC, picks it up and rings the customer in Tamil.
Vaultline is a Tamil Nadu company with a Tamil Nadu customer base, and the map says so. Every square is a paying site; the number beside it is seats under the agent tonight, not licences sold.
Drag sideways for the rest of the state.
Sakthi Textiles, Coimbatore. 340 seats on the Complete plan. Nobody at the mill was awake for any of the first two minutes, and the file never encrypted anything. Read down: the lit rail is whichever part of Vaultline had the ball.
185.220.101.34, using a hijacked TNEB billing template.
invoice_aug.pdf.exe opened in the Mumbai sandbox. 41 behaviours logged.
Sender domain blocked across all 412 tenants, not just this one.
LAPTOP-CBE-0417, Peelamedu mill. Arrived on a USB at 21:40. Tree killed.
812 files restored from the agent's own shadow copies. Device isolated.
Three assets and one mailbox attached, with all 41 indicators.
Timeline, indicators and affected assets, in CERT-In's own format.
Checks the USB origin against the endpoint's own history first.
Meenakshi Sundaram, Head of IT, in Tamil. Two minutes.
Signed by the customer. Five hours twenty-two still on the clock.
Two more copies, on MBP-MAA-0088 and a Madurai share. Both removed.
Every report is downloadable from the console the day it is issued. Data never leaves the Mumbai and Hyderabad regions.
Audited by Nangia Andersen, report dated March 2026.
Certificate IN-27001-08841, valid to Feb 2029.
Six-hour incident reports drafted and filed in-console.
Breach register, consent log and Board notification templates.
For clients with European customers. Data stays in ap-south-1.
“We had 340 laptops across three mills and nobody whose job it was to look at them. Vaultline caught a payroll-diversion mail on the second day, held it, and rang me. That one mail paid for the year.”
A seat is one person: their laptop and their mailbox. Thirty days free on any plan, every feature switched on, no card until you decide.
| Per seat / month | Endpoint only₹249 Core | Endpoint and email₹449 Complete | Complete plus SOC₹799 Managed |
|---|---|---|---|
| Endpoint agent | Included | Included | Included |
| Email gateway | — | Included | Included |
| Ransomware rollback | Included | Included | Included |
| Sandbox detonation | — | Included | Included |
| DPDP breach register | — | Included | Included |
| CERT-In report drafting | Included | Included | Included |
| 24×7 SOC in Chennai | — | — | Included |
| Minimum seats | 10 | 10 | 25 |
| Start a 30-day trial | Start a 30-day trial | Book a demo |
The agent installs in under a minute. Thirty days, every feature, no card.