The Uttar Pradesh Anti-Terrorist Squad has arrested a 24-year-old man from Kanpur Nagar for allegedly creating and selling fake email accounts that were later used to send bomb threats to schools and other establishments in Noida, Delhi, Gurugram and Mumbai. The arrest was made on October 29 after investigators traced one of the threatening email accounts to the accused.
The accused, identified as Ankit Shankhwar of Ghatampur in Kanpur Nagar, had allegedly been creating fake email accounts since 2021. According to the ATS, he used proxy networks and Wi-Fi connections to conceal the identities of users and sold the accounts in exchange for cryptocurrency.
The investigation began after the ATS received intelligence about threatening emails sent from simenbriones9265@gmail.com to schools in Gautam Buddh Nagar, Delhi and Gurgaon. The emails reportedly threatened bomb attacks and invoked the names of the Khalistan National Army and Babbar Khalsa. They also contained threats linked to a proposed Delhi-NCR show by Punjabi singer Diljit Dosanjh and the residence of a prominent Bollywood actor.
A technical analysis of the account led investigators to Kanpur Nagar, where Shankhwar was identified as the alleged creator and supplier. The ATS seized a laptop and a mobile phone during the operation. Investigators said the devices contained Excel files listing approximately five lakh email IDs, along with cryptocurrency wallet details.
According to the agency, the spreadsheets included email IDs, passwords, recovery email addresses and two-factor authentication codes. These details allegedly enabled buyers to access the accounts while attempting to bypass authentication safeguards and conceal their identities. The ATS said Shankhwar used Facebook groups dealing in the buying and selling of online accounts to find customers in Bangladesh, Pakistan, Turkey, Egypt and other countries.
During questioning, Shankhwar allegedly told investigators that he had been in contact with a Bangladeshi national identified as Alamin Islam through Facebook and WhatsApp. The contact allegedly paid 6,000 USDT for fake email IDs. The ATS said evidence of the transaction was recovered from Shankhwar’s mobile phone.
Investigators alleged that Shankhwar supplied the account simenbriones9265@gmail.com to Islam and that it was used to send threatening emails to schools and other locations in Noida on October 12. Another account, smithjohnson6889@gmail.com, was allegedly used to send a bomb threat to the Mumbai Mayor’s Office on October 23. The credentials of both accounts, including passwords, recovery email addresses and two-factor authentication codes, were reportedly shared through WhatsApp in an Excel file.
The ATS also found that Shankhwar’s WhatsApp account was connected to phone numbers from Bangladesh, Pakistan, Egypt, Turkey, the United States and other countries. Investigators reported substantial cryptocurrency transactions involving USDT while examining the alleged network.
A case has been registered at the ATS police station in Lucknow under relevant legal provisions. The agency is seeking police custody remand to question Shankhwar about other people involved in the operation. The ongoing investigation will examine the cryptocurrency transactions, identify other buyers and suppliers, and establish the links between the fake accounts and the threats issued to schools and public establishments. The allegations against Shankhwar remain subject to investigation.
