The Mumbai bomb hoax investigation has widened after the Uttar Pradesh Anti-Terrorism Squad linked threatening emails sent to prominent establishments in the city on November 12 to email accounts allegedly created by Kanpur-based Ankit Shankhwar, who was arrested last month in a fake email ID racket.
According to the UP ATS, Shankhwar created email accounts and sold them to a Bangladeshi national identified as Amin. The agency said those accounts were later used to send bomb threats to locations in Mumbai. The disclosure places the episode within a broader investigation into the creation, sale and use of email identities for threatening public institutions and prominent individuals.
The targets named in the November 12 emails included the Brihanmumbai Municipal Corporation headquarters, the Mumbai mayor’s office, Chhatrapati Shivaji Maharaj International Airport and actor Amitabh Bachchan’s bungalow, Jalsa, in Juhu. Mahalaxmi Stadium and several branches of nationalised banks were also mentioned in the messages, the ATS said.
The threats triggered security concerns in Mumbai, prompting local police and security agencies to intensify security arrangements around the named locations. The supplied report does not identify any explosives or physical attack connected to the emails, and the ATS account concerns the investigation into the threats and the email accounts allegedly used to send them.
The ATS has also claimed that Shankhwar received $50,000, approximately Rs 47.12 lakh, from Turkey and Egypt in connection with the supply of email accounts. The agency is examining whether the same network or infrastructure was involved in other recent threats, including messages concerning singer Diljit Dosanjh’s concert in Madhya Pradesh and a court complex in Gwalior.
The investigation began after intelligence inputs indicated that a suspicious email account, simenbriones9265@gmail.com, had been used to send threatening messages to schools in Gautam Budh Nagar, Delhi and Gurugram. The messages threatened blasts at schools in Noida and other cities, a proposed Delhi-NCR show by Dosanjh and the residence of a prominent Bollywood actor. The threats were issued in the names of the Khalistan National Army and Babbar Khalsa, according to the ATS.
Technical analysis of the account showed that it had been accessed from Kanpur Nagar, leading investigators to Shankhwar, the agency said. Investigators also recovered another email account, smithjohnson6889@gmail.com, from his devices. The ATS said this account was used to send a bomb threat to the Mumbai mayor’s office on October 23.
The Mumbai episode has therefore drawn attention to more than the security response at individual sites. The locations named in the emails included municipal administration, aviation, banking, sport and a high-profile residential address, requiring different authorities and security teams to respond to a common form of digital threat. The current investigation is focused on establishing how the accounts were created, transferred and used, and whether Shankhwar’s alleged role extends to the other threats being examined by the agency.
The UP ATS is continuing its probe into the alleged email account racket and the connections between the Mumbai threats and messages reported in other cities. Further findings from the agency are expected to establish the identities of other people involved and the full extent of the accounts’ use.
