My dad received a suspicious email from our ISP (mtnl.net.in) The email was from [email protected] and it had our userid (xxxxxxxx@a i masked it) in the email so it must have come from the ISP itself.

Email details below:

Subject:

"Intimation Regarding Malware/ Virus Infected Systems"

Body:

Dear Sir/Madam,
Greetings!
It is observed that your device connected with MTNL Mumbai broadband network with broadband number xxxxxxxx@a is infected with Malware. This is as per the analysis of Computer Emergency Response Team -INDIA (Cert-IN), under the Ministry of Electronics and Information Technology.
Malware (CNC) is unwanted software that is installed in users system without users consent while user is surfing on the Internet. An attacker or cybercriminal can remotely send commands to such systems which are compromised by malware. These compromised machines can be used to create powerful networks (botnet) of infected devices capable of carrying out distributed denial-of-service (DDoS) attacks, stealing data, deleting data or encrypting data in order to carry out an extortion scheme. The device becomes part of the botnet due to malware/virus installed on it.
To secure your devices , Kindly check your devices for malware/ botnet using Antivirus S/w.
For more information on malware/botnets and the counter measures kindly visit https://www.cyberswachhtakendra.gov.in. You can also download "Free botnet removal tools".
Thanks & Warm Regards,
MTNL, Mumbai

I extracted all links from the email and scanned them via https://www.virustotal.com/ url scanner but all were reported as safe.

Links:

• http://www.cert-in.org.in/
• https://www.cyberswachhtakendra.gov.in/
• https://www.quickheal.co.in/bot-removal-tool
• http://mtnlmumbai.in/index.php/broadband/triband/promotional-plans#unlimited-high-speed-plans
• https://selfcare.mtnl.net.in/mumbai/TribandRegistrationInstn.aspx

Looking online there is a similar question on Quora but different scenario.

NETWORK AT HOME

• Two mobile phones (Android)
• One laptop (Windows 10 with Avira antivirus)

QUESTION:

• Can an ISP really detect this?

• Should I action on this and what to do?

Edit(1Sep19_1)

To answer some of the questions:

• Only the above 3 devices are connected to the wifi no other IoT devices.
• My parents are the only users ... so you can rule out TOR browsers or any in appropriate searches.
• Also no VMs on the network
• I will try to contact the ISP but they are a government one and have very bad support

Edit(1Sep19_2)

Also after doing some more research it seems that QuickHeal has a tie up MTNL and BSNL both government providers, so there is a chance they might be just promoting Quickheal.

Personal Note: I find it very odd that MTNL is actually taking trouble to find bots !!

Links: Link1 Link2 Link3