Otqcxvi

Can an ISP really detect this?

The ISP can see all data your systems exchange with the internet (but not the plain text from encrypted data). Based on this he can detect botnets which often show typical behavior.

Should I action on this and what to do?

Yes, you should action on this since there seems to be malware in your network which is used to disturb other systems on the internet (sending spam mails, DDoS attacks, used as VPN to hide malicious activity and others) and which might also affect your internal network (infect computers, steal data, take data as ransom ...).

If you don't fix the problem you might also risk that the ISP restricts your network or even completely disconnects you from the internet (depending on the terms of service).

Based on the information you've provided it is impossible to say what exactly the problem is though. It might be that your laptop is infected (Antivirus do not offer 100% protection) or that one of your phones or that the router itself. It might also be other devices in your network you are not really aware of, like a TV, printer, IP camera or other IoT devices. And it might be also caused by software you have knowingly installed yourself, but which has a hidden malicious functionality you are not aware of.

The links they provided in the mail seem to be fine so that you can follow these for more information and for the offered botnet removal tool. But if you are in doubt if the mail really originated by your ISP please contact the ISP - it is impossible for us to see based on the information provided what the real origin of the mail is.

The email address from which you have received the mail seems genuine. The body of the mail also adds to the genuineness. However, senders email addresses can be spoofed by using open mail relays. As per Department of Telecom , port 25 must be blocked to reduce surface area of spoofing, yet there are many open relay that are live still.

To confirm authenticity of mail, please copy the headers and see the reputation score of originating SMTP server. Reference to online tool , do not forget to delete your headers from this site after you have analyzed the source.

Alternatively you may call your ISP to confirm the authenticity of mail.

Now if the your ISP has really sent this mail to you, request you to follow below steps for mitigating the issue.

• Initiative a full malware scan on the laptop. you may use any one of these anti-malware software Trendmicro House call, MalwareBytes, Avast. After scan is completed, delete the detected files, if any.
• Install the tool Process Explorer to see what processes are running on the laptop. you have a really good option in this tool to check if the running process is malicious or not against Virustotal(60+ anti-malware software). If any processes flagged as malicious , kill it, open its location on your local drive and delete it.
• Check for any recently installed applications that you're not aware of ,or seems suspicious to you.
• Have your phones scanned for malware as well, with anti-malware mobile applications
• Report the findings of above steps followed to your ISP, and ask them , if they still see any botnet connections.

Hope the above solves your issue, if not, at-least you would have given your ISP a head-start in detecting the root cause of malware.

This looks like a legitimate email.

Someone detected that a computer with an Indian IP address was part of a botnet. This was shared with your National CERT (CERT-In). In turn, as they didn't know which user had that IP address at the time it was detected, they notified your ISP, which in turn found out which customer was responsible of that connection and forwarded that notice to your father.

As you see, they are pointing you to a botnet clearinghouse set up by CERT-In on https://www.cyberswachhtakendra.gov.in/

The piece I miss from that notification is that they don't mention when the connection happened, whic.

If you wanted to verify their claim or get further information, I would recommend you to contact directly with CERT-In (the Contact Us link on https://cert-in.org.in/ provides their email addresses).

I miss from the notification that they sent you the time on which the malicious behavior was detected or at least the IP address you had at the time, which would make it difficult for them to find out which of the hundreds of similar alerts they sent out is the one received by your father. Although if you have had the same IP address for some time, it is likely they could find events for your current IP address (you would have to provide it to them in your request).

Given that -supposedly- in that home there are only one computer and two mobile phones, my suspicion is that the infected device is the laptop, so I would begin by running there the Bot Removal Tool they recommend on the Cyber Swachhta Kendra for disinfection, as it should be able to disinfect the malware they are warning about. And in case it found out nothing, then ask the CERT-In for more detail.

There's nothing in that e-mail that would be of use to a black hat, thus it's almost certainly legitimate. You've got something on your system that's either attempting to infect other systems or it's communicating with a known botnet command-and-control server and I would think the former scenario is far more likely.

Is this a joke?

This is 100% a malicious email.

The (Too happy) language, as well as trying to explain to a user what a 'botnet' is, throwing random scary things such as extortion and encryption, then asking the user to search for 'free virus removal' software and run it.

Yeah, great idea! (no, it's an awful idea).