Cyber Swachhta Kendra (CSK) is a Government of India initiative that helps detect botnet and malware infections, notify potentially affected internet users and provide free tools and guidance to secure their devices. It operates under the Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology (MeitY), as part of the Digital India initiative.
The initiative focuses on a problem that many device owners may not even notice: malware can infect a computer, mobile phone or other internet-connected device and allow criminals to misuse it without the owner's knowledge. An infected device may become part of a botnet, steal information, distribute spam or participate in cyberattacks.
Cyber Swachhta Kendra connects threat analysis with practical assistance. It works with internet service providers (ISPs), industry, academic institutions and antivirus companies to identify potentially compromised systems, notify users and make malware-removal resources available. Its website also publishes security alerts and practical guidance to help people maintain safer devices.
What Is Cyber Swachhta Kendra?
Cyber Swachhta Kendra is the Botnet Cleaning and Malware Analysis Centre (BCMAC) operated by CERT-In. It is a specialised initiative that focuses on analysing botnet and malware threats, helping identify compromised systems and enabling users to clean and secure their devices.
The Government of India launched the centre on 21 February 2017 to strengthen cybersecurity and promote better cyber hygiene among internet users. CERT-In's official annual report records the establishment of the Botnet Cleaning and Malware Analysis Centre and its work with internet service providers, industry and academia.
The official Cyber Swachhta Kendra website provides information about malware threats, security alerts, recommended removal tools and preventive practices. Users can access these resources to understand potential infections and take appropriate steps to protect their systems.
Unlike a conventional antivirus product, Cyber Swachhta Kendra is a government-led cybersecurity initiative. It combines threat analysis, cooperation with service providers, user notifications, cleaning assistance and awareness activities.
Who Runs Cyber Swachhta Kendra?
The Indian Computer Emergency Response Team (CERT-In) operates Cyber Swachhta Kendra under Section 70B of the Information Technology Act, 2000. CERT-In functions under the Ministry of Electronics and Information Technology (MeitY), Government of India.
CERT-In is India's national agency for coordinating responses to cybersecurity incidents. Its wider responsibilities include analysing cyber threats, issuing security alerts and advisories, coordinating incident response and promoting information security practices.
Cyber Swachhta Kendra carries out a focused part of this wider cybersecurity work. It concentrates on botnet and malware-related threats, device cleaning assistance and public awareness about cyber hygiene.
The Government identifies CSK as a citizen-centric service operated by CERT-In. Its role is explained in the official CERT-In backgrounder published by the Press Information Bureau.
When Was Cyber Swachhta Kendra Launched?
The Government of India launched Cyber Swachhta Kendra on 21 February 2017. CERT-In established it to help identify compromised devices, notify potentially affected users and support the removal of botnet and malware infections.
The initiative was developed as part of the Government's broader effort to create a safer digital environment. As internet use, online payments, mobile applications and connected devices became more widespread, the risk of malware infections and botnet activity also became an important cybersecurity concern.
Its establishment brought together technical analysis, ISP coordination and malware-cleaning assistance under a citizen-focused initiative. The centre also promotes awareness so that users can reduce the chances of their devices becoming infected again.
The launch and early activities are documented in CERT-In's annual report.
Why Was Cyber Swachhta Kendra Created?
Malware infections do not always produce visible warning signs. A computer or mobile device may continue to work normally even when malicious software is running in the background. In some cases, attackers use infected devices to carry out activities without the owner's knowledge.
A bot is malicious software that compromises a device and allows an attacker to control or misuse it. A botnet is a group of such compromised devices that can work together to perform malicious activities under an attacker's instructions.
For example, criminals may use infected devices to:
- Steal personal information, login credentials or other sensitive data.
- Send spam messages and malicious emails.
- Download and install additional malware.
- Spread infections to other devices connected to the same network.
- Launch denial-of-service attacks against websites and online services.
- Carry out other malicious activities through compromised systems.
The device owner may not realise that their computer, phone or router is being misused. This makes botnet infections a wider security problem rather than just an issue affecting one device.
Cyber Swachhta Kendra addresses this challenge by connecting threat analysis, ISP notifications and remedial assistance. Its official mission is to enhance the cybersecurity of Digital India's IT infrastructure by providing information about botnet and malware threats and suggesting appropriate remedies.
Therefore, the initiative has two closely connected objectives: helping affected users secure their devices and reducing the wider harm that compromised systems can cause to other internet users and organisations.
What Are the Main Roles and Responsibilities of Cyber Swachhta Kendra?
Cyber Swachhta Kendra performs several activities related to malware analysis, infection identification, user notification, cleaning assistance and cybersecurity awareness. These activities work together to help users respond to potential infections and improve the security of their devices.
Analysing Botnet and Malware Threats
One of the centre's primary responsibilities is to analyse the characteristics and behaviour of bots and other malicious software. This technical analysis helps identify how malware operates, what systems it may affect and what remedial measures users should consider.
Different types of malware create different risks. Some attempt to steal passwords and financial information, while others allow attackers to control infected devices or download additional malicious programs.
Cyber Swachhta Kendra uses information about these threats to support detection, notification and cleaning activities. Its official description of its mission and work identifies bot and malware analysis as a central part of the initiative.
Helping Identify Potentially Infected Systems
Cyber Swachhta Kendra works with industry, academic institutions and other cybersecurity stakeholders to identify systems that may be infected with bots or malware.
Its notification mechanism uses information about suspicious malicious activity associated with internet protocol (IP) addresses. When an IP address is identified as potentially associated with an infected system, the centre can share the relevant alert with the concerned internet service provider.
This cooperation helps extend the initiative's reach beyond the official website. It allows information about potential infections to reach internet subscribers through their service providers.
The Government's official overview of Cyber Swachhta Kendra also describes its cooperation with industry, academia and ISPs to identify compromised systems and alert users.
Supporting Malware Removal and System Security
Identifying a potential infection is only the first step. Users also need practical assistance to check their devices and remove malicious software where necessary.
Cyber Swachhta Kendra provides information and access to free bot-removal tools developed or provided by its partner antivirus companies. These tools can help users scan supported devices, identify certain malware infections and take appropriate cleaning action.
The initiative also encourages users to improve their overall security after cleaning a device. Removing malware without addressing outdated software, weak passwords or unsafe browsing practices may leave the system exposed to further attacks.
Users can visit the official Security Tools section to check the available tools and their supported devices. The CSK homepage also directs visitors to its cleaning resources and security guidance.
Publishing Threat Alerts and Preventive Guidance
Cyber Swachhta Kendra publishes security alerts to inform users about malware, botnets and other cybersecurity threats. These alerts explain the nature of identified malicious programs and provide relevant information about their behaviour and possible impact.
The centre's alerts cover different types of threats, including:
- Information-stealing malware and credential theft.
- Banking trojans that target financial information.
- Ransomware that can restrict access to files or systems.
- Remote access trojans that allow unauthorised control of devices.
- Botnets that connect infected devices for coordinated malicious activity.
- Malicious software distributed through phishing campaigns and compromised applications.
For example, its StealC information-stealer alert explains the risks associated with malware that targets credentials and other sensitive information.
Users can check the official Cyber Swachhta Kendra Alerts section for published threat information and recommended security measures.
Promoting Cyber Hygiene and Reducing Reinfection Risks
Cyber hygiene refers to the regular habits and security practices that help protect computers, mobile phones, networks and online accounts. It is important because even after removing malware, unsafe device settings and outdated software can create opportunities for another infection.
Cyber Swachhta Kendra promotes safer digital practices through educational resources covering computers, mobile devices, broadband connections, phishing and digital payments.
Its Security Best Practices section provides guidance for different users, including children and senior citizens. It explains practical steps that can help users reduce common cybersecurity risks.
Some important practices include:
- Use genuine and updated operating systems and applications.
- Install and regularly update a trusted antimalware solution.
- Keep operating systems, browsers and applications updated with security patches.
- Avoid opening suspicious email attachments and unknown links.
- Use strong and unique passwords for important accounts.
- Disable unnecessary AutoPlay or Autorun features for removable drives.
- Maintain backups of important files to reduce the impact of ransomware or data loss.
- Secure home routers and other internet-connected devices with strong passwords and updated firmware.
Cleaning removes an existing infection, while good cyber hygiene helps reduce the risk of future infections. Both are important parts of maintaining a secure digital environment.
What Services and Facilities Are Available on the Cyber Swachhta Kendra Portal?
The official Cyber Swachhta Kendra portal provides several resources for people who want to understand malware threats, check security alerts or improve the safety of their devices.
| Portal facility | What users can access |
|---|---|
| Security Tools | Free bot-removal and related security tools made available through the initiative and its partners. |
| Security Alerts | Information about botnets, malware, ransomware, information stealers and other cybersecurity threats. |
| Security Best Practices | Practical guidance for securing computers, mobile devices, broadband connections and online activities. |
| Partners | Information about the organisations and stakeholder groups that collaborate with the initiative. |
| Frequently Asked Questions | Answers about the initiative, malware notifications, privacy, removal tools and device security. |
| Announcements | Official updates and awareness-related information published through the portal. |
| Contact Us | Official contact information for queries relating to Cyber Swachhta Kendra. |
Users can access these facilities through the official Cyber Swachhta Kendra portal. The availability of a particular removal tool may depend on its supported operating system, device type and the partner's current offering.
Free Bot Removal Tools
One of the most useful facilities of Cyber Swachhta Kendra is its access to free malware and bot-removal tools. The centre works with antivirus companies to make selected tools available to users who need to check and clean their devices.
The tools are intended to detect and remove certain known bots or malware from supported systems. Users should check the product description, supported operating systems and instructions before downloading or running a tool.
The Ministry of Electronics and Information Technology's Citizen's Charter for 2025–26 identifies free bot-removal tools for Windows and Android devices as part of the Cyber Swachhta Kendra service. It also lists the M-Kavach smartphone safety toolkit for Android among the available resources.
Users can check the current offerings on the official Security Tools page rather than relying on old download links or third-party websites.
Security Alerts and Malware Information
The portal's alert section helps users understand current and previously reported malware threats. It publishes information about the characteristics of malicious programs and the risks they may create for affected devices.
These alerts are useful not only for individual users but also for system administrators and organisations that need to understand malware-related risks.
Visit the official Alerts page to explore the available threat information.
Security Best Practices
The portal also provides educational material that explains how users can protect their devices and online activities. The guidance covers topics such as secure browsing, mobile safety, phishing prevention, digital payments and other common security concerns.
These resources are particularly useful for people who are not cybersecurity professionals but want to follow practical steps to reduce their exposure to online threats.
Users can read the recommendations in the Cyber Swachhta Kendra Security Best Practices section.
How Does Cyber Swachhta Kendra Work with ISPs and Other Partners?
Cyber Swachhta Kendra follows a collaborative model because identifying malware, notifying internet subscribers and helping users clean their devices involve different organisations.
The centre works with industry, academia, internet service providers and antivirus companies. Each partner contributes to a different part of the process, helping technical information reach the people who can take remedial action.
Its official Partners page identifies the stakeholder groups involved in the initiative.
| Partner group | Contribution to the initiative |
|---|---|
| Industry and academia | Collaborate in analysing threats and identifying systems that may be affected by bots or malware. |
| Internet service providers | Receive relevant alerts and help communicate infection notifications to their subscribers using their records. |
| Antivirus companies | Contribute malware analysis expertise and cleaning solutions that help users detect and remove certain infections. |
| Department of Telecommunications | Participates as a government stakeholder in the wider collaborative framework. |
| CERT-In | Operates the centre and coordinates its malware analysis, notification, cleaning assistance and awareness activities. |
How Does the ISP Notification Process Work?
The official FAQs explain how Cyber Swachhta Kendra uses IP-address information to help notify potentially affected users.
The process can be understood in the following steps:
- Detection of suspicious activity: Cybersecurity organisations, law enforcement agencies or Computer Emergency Response Teams may identify malicious activity while analysing suspicious servers or network behaviour.
- Identification of a potentially affected IP address: Technical analysis may indicate that an internet address is associated with a device participating in botnet activity or another malware-related activity.
- Alert to the internet service provider: Cyber Swachhta Kendra shares the relevant IP-address information with the concerned ISP.
- Notification to the subscriber: The ISP uses its registered subscriber information to contact the relevant internet connection owner.
- Cleaning and protective action: The user can check the device, use suitable removal tools and follow the recommended security practices.
This mechanism helps connect technical threat information with the subscriber who may be able to identify and secure the affected system.
However, an IP address alert does not automatically identify a particular computer or mobile phone. A single internet connection may serve multiple devices, and the user may need to scan the relevant systems to identify the source of the suspected infection.
The process is explained in the official Cyber Swachhta Kendra FAQs.
What Should You Do If Your ISP Sends a Cyber Swachhta Kendra Infection Notification?
If your internet service provider sends a message advising you to visit Cyber Swachhta Kendra, do not ignore it. The notification indicates that suspicious activity associated with your internet connection may have been identified.
It does not necessarily mean that every device in your home is infected. However, you should take the warning seriously and check the devices connected to the relevant internet connection.
Follow these steps:
- Verify the notification: If the message claims to come from your ISP, confirm it through the provider's official customer support channel. Do not click unknown links in suspicious messages.
- Identify connected devices: Check computers, mobile phones, laptops, routers and other internet-connected devices that use the affected connection.
- Update your security software: Make sure your existing antivirus or antimalware software has the latest updates and malware definitions.
- Run a full security scan: Scan the relevant devices using a genuine security product or an appropriate removal tool available through the official CSK Security Tools page.
- Remove detected malware: Follow the security tool's instructions to quarantine or remove detected threats.
- Secure important accounts: If you suspect that passwords or account information may have been exposed, change the affected passwords from a trusted device and enable additional account security where available.
- Update your devices: Install operating system, browser, application and router firmware updates from their official sources.
- Monitor the system: Watch for unusual behaviour and repeat notifications. If the problem continues, seek help from a qualified cybersecurity professional.
Cyber Swachhta Kendra's official guidance recommends scanning devices with updated antivirus solutions and following security best practices. It also advises users to consult a security expert if repeated infections continue despite cleaning efforts.
For further guidance, visit the official FAQs and Security Best Practices page.
Does Cyber Swachhta Kendra Monitor Personal Browsing or Scan Devices?
Privacy is an important concern for users who receive a malware-related notification. They may wonder whether the Government has monitored their browsing history, inspected personal files or remotely scanned their computers.
According to the official Cyber Swachhta Kendra privacy FAQs, the centre does not monitor or scan individuals' online browsing activity or collect personal information relating to browsing or data stored on their computers and devices.
The initiative's notification mechanism is based on technical information about suspicious activity associated with IP addresses. Cyber Swachhta Kendra shares relevant alerts with ISPs, which can use their subscriber records to contact the concerned internet connection owner.
This process should not be confused with a security scan that a user chooses to run on their own device. If a user downloads a malware-removal tool, that software performs its own functions according to its product design and permissions. The centre's privacy statement should not be treated as a blanket description of every separate software product.
Users can read the centre's full explanation in its official privacy-related FAQs.
How Many People and Organisations Does Cyber Swachhta Kendra Reach?
Cyber Swachhta Kendra has expanded its work through cooperation with organisations across different sectors and by making malware-removal resources available to internet users.
According to the Government's CERT-In backgrounder published on 23 January 2026, the centre had achieved the following reported reach and usage figures as of December 2025:
| Indicator | Reported figure |
|---|---|
| Digital population coverage | 98% |
| Organisations onboarded | 1,427 |
| Malware-removal tool downloads | 89.55 lakh |
These figures demonstrate the scale of the initiative's notification, coordination and malware-removal activities. The reported 89.55 lakh figure refers to downloads of malware-removal tools; it should not be interpreted as the number of unique devices cleaned or individual infections resolved.
The figures are published in the Government's official CERT-In backgrounder dated 23 January 2026.
What Is the Difference Between Cyber Swachhta Kendra and CERT-In?
Cyber Swachhta Kendra and CERT-In are closely connected, but they are not two separate organisations with identical responsibilities.
CERT-In is India's national cybersecurity incident-response agency, while Cyber Swachhta Kendra is a specialised initiative operated by CERT-In.
| Basis | CERT-In | Cyber Swachhta Kendra |
|---|---|---|
| Nature | National cybersecurity incident-response agency. | Botnet Cleaning and Malware Analysis Centre operated by CERT-In. |
| Ministry | Ministry of Electronics and Information Technology. | Operates under CERT-In, which functions under MeitY. |
| Primary focus | Cybersecurity incident response, threat analysis, security advisories, coordination and preparedness. | Botnet and malware analysis, user notifications, cleaning assistance and cyber hygiene awareness. |
| Services | Incident response, technical guidance, alerts, advisories and other cybersecurity functions. | Malware alerts, free removal tools, security guidance and ISP-based notification support. |
| Legal framework | Performs its statutory functions under Section 70B of the Information Technology Act, 2000. | Operates as part of CERT-In's work under Section 70B. |
For example, CERT-In handles a broader range of cybersecurity incidents and national coordination activities. Cyber Swachhta Kendra focuses on a specific area of this work: helping detect and address botnet and malware infections and improving cyber hygiene among users.
More information about the parent agency is available on the official CERT-In website.
Frequently Asked Questions About Cyber Swachhta Kendra
When Was Cyber Swachhta Kendra Launched?
The Government of India launched Cyber Swachhta Kendra on 21 February 2017. CERT-In established it to help identify compromised systems, notify users and support the cleaning and protection of devices against botnet and malware infections.
Is Cyber Swachhta Kendra a Government Initiative?
Yes. Cyber Swachhta Kendra is part of the Government of India's Digital India initiative under the Ministry of Electronics and Information Technology. CERT-In operates the centre.
What Is the Full Form of CSK?
CSK stands for Cyber Swachhta Kendra. It is also known as the Botnet Cleaning and Malware Analysis Centre (BCMAC).
How Can I Access the Cyber Swachhta Kendra Portal?
You can visit the official website at www.csk.gov.in. The portal provides security tools, malware alerts, FAQs, partner information and cybersecurity best practices.
Who Operates Cyber Swachhta Kendra?
The Indian Computer Emergency Response Team (CERT-In) operates Cyber Swachhta Kendra under Section 70B of the Information Technology Act, 2000. CERT-In functions under MeitY.
How Is Cyber Swachhta Kendra Different from CERT-In?
CERT-In has a broad national role covering cybersecurity incident response, threat analysis, coordination and security guidance. Cyber Swachhta Kendra is a specialised initiative within CERT-In that focuses on botnet and malware analysis, infection notifications, cleaning assistance and cyber hygiene.
Is Cyber Swachhta Kendra an Antivirus Product?
No. It is a Government of India initiative, not a standalone antivirus product. It provides malware-related information, supports infection notifications and makes selected removal tools and security guidance available through its website and partner organisations.
Does Cyber Swachhta Kendra Provide Free Services?
Yes. The initiative provides its services and listed bot-removal resources free of cost. However, individual antivirus companies may offer separate paid products or services outside the initiative. Always check the terms of the specific product before using it.
Does Cyber Swachhta Kendra Provide Free Malware-Removal Tools?
Yes. It provides access to free bot-removal tools made available through partner antivirus companies. Users can check the supported operating systems and current download options on the official Security Tools page.
Does an Infection Notification Confirm That a Particular Device Is Infected?
Not necessarily. The notification process may identify a suspicious IP address associated with malicious activity. Since multiple devices may use the same internet connection, users may need to scan their connected devices to identify the potentially affected system.
Why Did My Internet Service Provider Ask Me to Visit Cyber Swachhta Kendra?
Your ISP may have received an alert about suspicious activity associated with an IP address linked to your internet connection. The notification asks you to check your devices and take suitable security measures. It does not automatically confirm that every device connected to the network is infected.
Does Cyber Swachhta Kendra Monitor My Browsing History?
According to its official privacy FAQs, Cyber Swachhta Kendra does not monitor or scan individuals' online browsing activity or collect personal information relating to their browsing or stored device data.
How Does Cyber Swachhta Kendra Know That My System May Be Infected?
Cybersecurity organisations, law enforcement agencies and Computer Emergency Response Teams may identify suspicious communication with malicious servers while analysing cyber threats. Based on this technical analysis, an IP address may be suspected of being associated with a particular bot or malware infection.
How Does My ISP Know That My Computer May Be Infected?
Cyber Swachhta Kendra sends an alert to the ISP containing the relevant IP-address information. The ISP can then use its registered subscriber records to contact the owner of the internet connection.
How Do I Clean My Computer or Mobile Device from Malware?
Start by updating your existing security software and running a suitable scan. You can also check the free tools available through the Cyber Swachhta Kendra Security Tools page. Follow the tool's instructions to remove detected malware and update your device afterwards.
Can I Use an Antivirus Other Than the Tools Listed on Cyber Swachhta Kendra?
Yes. The official FAQs allow users to use genuine antivirus software or removal tools from reputable companies. Make sure the software is updated and obtained from its official source before scanning your device.
Do I Need to Format My Computer If Malware Is Detected?
Not necessarily. Cyber Swachhta Kendra's official guidance does not recommend formatting the system as the first step. It advises users to scan the device with an updated antivirus solution and remove detected threats. If the infection continues, take a complete backup of important files and consider formatting the system or consulting a security professional.
Why Did I Receive Another Malware Notification After Cleaning My Computer?
A repeated notification may indicate that the infection remains, another connected device is affected or the system has become infected again. Update your security software, scan the relevant devices and follow the recommended security practices. If the problem persists, consult a qualified security expert.
What Should I Do If My Antivirus Is Already Installed but I Still Receive a Notification?
Your antivirus software or its malware definitions may be outdated, or the notification may relate to another device using the same internet connection. Update the antivirus software and run a complete scan on the relevant devices. If you cannot identify the source of the alert, seek technical assistance.
Where Can I Find Cyber Swachhta Kendra Security Alerts?
You can visit the official Alerts section to read information about botnets, malware, ransomware, information stealers and other cybersecurity threats.
How Can I Contact Cyber Swachhta Kendra?
For queries relating to Cyber Swachhta Kendra, you can use the contact details published by MeitY in its Citizen's Charter for 2025–26. The listed email address is [email protected] and the telephone number is 011-22902700. You can also visit the official Contact Us page.
Conclusion
Cyber Swachhta Kendra is an important citizen-focused cybersecurity initiative operated by CERT-In under the Ministry of Electronics and Information Technology. It helps address botnet and malware threats through technical analysis, coordination with internet service providers, user notifications and access to free malware-removal resources.
Its work is not limited to cleaning infected devices. The initiative also publishes security alerts, provides guidance for safer digital practices and encourages users to protect their computers, mobile phones, routers and other connected systems.
If you receive a malware-related notification from your ISP, take it seriously, check the devices connected to your internet connection and follow the official cleaning guidance. For reliable information and available resources, always use the official Cyber Swachhta Kendra portal.