My dad received a suspicious email from our ISP (mtnl.net.in). The email was from [email protected] and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP itself.

Email details below:

Subject:

"Intimation Regarding Malware/ Virus Infected Systems"

Body:

Dear Sir/Madam,
Greetings!
It is observed that your device connected with MTNL Mumbai broadband network with broadband number xxxxxxxx@a is infected with Malware. This is as per the analysis of Computer Emergency Response Team -INDIA (Cert-IN), under the Ministry of Electronics and Information Technology.
Malware (CNC) is unwanted software that is installed in users system without users consent while user is surfing on the Internet. An attacker or cybercriminal can remotely send commands to such systems which are compromised by malware. These compromised machines can be used to create powerful networks (botnet) of infected devices capable of carrying out distributed denial-of-service (DDoS) attacks, stealing data, deleting data or encrypting data in order to carry out an extortion scheme. The device becomes part of the botnet due to malware/virus installed on it.
To secure your devices , Kindly check your devices for malware/ botnet using Antivirus S/w.
For more information on malware/botnets and the counter measures kindly visit https://www.cyberswachhtakendra.gov.in. You can also download "Free botnet removal tools".
Thanks & Warm Regards,
MTNL, Mumbai

I extracted all links from the email and scanned them via the https://www.virustotal.com/ URL scanner but all were reported as safe.

Links:

• http://www.cert-in.org.in/
• https://www.cyberswachhtakendra.gov.in/
• https://www.quickheal.co.in/bot-removal-tool
• http://mtnlmumbai.in/index.php/broadband/triband/promotional-plans#unlimited-high-speed-plans
• https://selfcare.mtnl.net.in/mumbai/TribandRegistrationInstn.aspx

Looking online there is a similar question on Quora but a different scenario.

NETWORK AT HOME

• Two mobile phones (Android)
• One laptop (Windows 10 with Avira antivirus)

QUESTION:

• Can an ISP really detect this?

• Should I act on this and what should I do?

To answer some of the questions:

• Only the above 3 devices are connected to the wifi, no other IoT devices.
• My parents are the only users ... so you can rule out TOR browsers or any inappropriate searches.
• Also no VMs on the network.
• I will try to contact the ISP but they are a government one and have very bad support.

Also after doing some more research it seems that Quick Heal has a tie up with MTNL and BSNL, both government providers, so there is a chance they might be just promoting Quick Heal.

Links: Link1 Link2 Link3

Personal note: I find it very odd that MTNL is actually taking trouble to find bots !!