LeukQuant - Deception Security Platform

When hackers break in,
they find a fake company.

LeukQuant plants fake files, fake credentials, and a fake intranet inside your network. Attackers think they found something real. You catch them twice.

Free 2-week pilot No credit card Setup in 30 minutes

Simple pricing.
Cancel any time.

Starter

₹4,999/mo

For solo CA firms, small clinics, and individual consultants.

3 honeypot protocols
Slack alerts
Dashboard access
500 events per month

Most popular

Growth

₹9,999/mo

For fintech startups, small IT companies, and growing CA firms.

All 7 protocols
Ghost-Net fake intranet
PDF incident reports
DPDP compliance docs
5,000 events per month

Enterprise

₹24,999/mo

For mid-size IT firms, microfinance institutions, and cooperative banks.

Everything in Growth
Dedicated IP per client
Monthly security briefing
Custom Ghost-Net profile
Unlimited events

If we don't catch at least one attack attempt in your first two weeks, we'll extend the pilot for free until we do. All plans include a free 2-week pilot.

Five steps.
30 minutes to deploy.

Deploy the honeypot engine

One command starts seven protocol emulators. Each looks identical to the real service it impersonates - our SSH looks like Ubuntu's OpenSSH, our MySQL responds exactly like MySQL 8.0.35.

Ghost-Net generates your fake company

Our local AI creates files tailored to your industry. A fintech company gets fake payment processing logs. A CA firm gets fake client tax records. Everything looks like it belongs to your actual company.

Attackers find the fake company

When someone brute-forces your login portal, they enter the Ghost-Net fake intranet. They believe they have access to your real network. They begin exploring.

Tripwires fire instantly

Every fake file is a monitored tripwire. The moment an attacker reads your fake AWS credentials or your fake database password, you receive a Level 5 alert in Slack within 8 seconds.

Credential canaries catch them twice

If the attacker reuses a fake password from wp-config.php on your database port, LeukQuant cross-correlates the sessions and confirms the same attacker hit two different systems.

What attackers find.
What you see.

Toggle between the attacker's experience and your real-time Slack alert. The entire concept in 30 seconds.

company-intranet - bash

attacker@192.168.1.1:~$ ls -la /var/www/html/

total 48

api_keys.json tripwire

customer_db.sql tripwire

financial_report.xlsx tripwire

ssh_config tripwire

Hover any file to reveal tripwire status

LeukQuant Alert

Today at 09:44 AM

LEVEL 5 THREAT DETECTEDCAUGHT TWICE

IP: 185.220.101.47 Country: Russia ISP: Frantech Solutions
AbuseIPDB Score: 98/100
File accessed: customer_db.sql database backup credential extracted
Cross-protocol: Same credential reused on MySQL port 3306 8 seconds later

Attacker confirmed on two systems. Evidence log generated.

09:41

HTTP login to fake intranet

09:43

customer_db.sql accessed - database backup credential extracted

09:44

Tripwire fired - Level 5 alert sent to Slack

09:45

Credential reused on MySQL 3306 - caught twice confirmed

Developer Portal & API Config

Deploy tripwires, adjust emulations, and configure canary tokens inside your network segments.

Getting Started

Deploy the LeukQuant decoy environment into your network in under 3 minutes.

bash

curl -sSL https://api.leukquant.com/install.sh | sh
leukquant init --key=lq_live_f893jcba921

Once initialized, seven protocol emulators start listening on high-value target ports instantly.

Emulation Configuration

Modify ports and system banner strings in /etc/leukquant/config.yaml to match your network persona.

yaml

protocols:
  ssh:
    port: 22
    banner: "SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1"
  mysql:
    port: 3306
    version: "8.0.35"
    database_name: "prod_sales_history"

Honey Credentials

Plant bait files containing AWS, database, or SSH keys on endpoints to trigger alerts when they are accessed.

json

{
  "canary_type": "AWS_KEYS",
  "access_key": "AKIAXF422X8FJK71C01L",
  "trigger_action": "ALERT_SLACK_SECTOR_3",
  "label": "Fake database backup crawler credential"
}

Webhook Tuning

Forward detected intrusion alerts from LeukQuant directly to your security operational center.

json

POST /api/alerts HTTP/1.1
Host: your-soc-endpoint.com
Content-Type: application/json

{
  "event_id": "evt_90f23cb",
  "severity": "CRITICAL",
  "protocol": "MySQL-Canary",
  "intrusion_ip": "185.220.101.47"
}

When hackers break in,
they find a fake company.

Simple pricing.
Cancel any time.

DPDP Act 2023 - full enforcement begins May 2027

Deploy Ghost-Net on your network today.

Five steps.
30 minutes to deploy.

What attackers find.
What you see.

Developer Portal & API Config

Getting Started

Emulation Configuration

Honey Credentials

Webhook Tuning

When hackers break in,they find a fake company.

Simple pricing.Cancel any time.

DPDP Act 2023 - full enforcement begins May 2027

Deploy Ghost-Net on your network today.

Five steps.30 minutes to deploy.

What attackers find.What you see.

Developer Portal & API Config

Getting Started

Emulation Configuration

Honey Credentials

Webhook Tuning

Welcome back

Start your free pilot

Edit Profile

Settings

When hackers break in,
they find a fake company.

Simple pricing.
Cancel any time.

Five steps.
30 minutes to deploy.

What attackers find.
What you see.