Behind Delhi-NCR bomb threats: 20 lakh fake email IDs, buyers across borders, and a Kanpur link

On October 28, a team from the Uttar Pradesh Anti-Terrorism Squad (ATS) hurried towards a house in Ghatampur in Kanpur Nagar district.

A credible intelligence input had led the ATS team to this house. Investigators had traced emails from a Gmail ID that threatened bomb attacks on schools in Delhi-NCR, a show by Punjabi singer Diljit Dosanjh and the house of a prominent Bollywood actor.

Inside, the team found a 24-year-old man named Ankit Shankhwar. And when they examined his devices — laptop and a phone — officials were in for a shock.

Shankhwar had allegedly created more than 20 lakh fake email accounts using fictitious identities. Officials said he then allegedly sold them in bulk to buyers in Pakistan, Bangladesh and other countries in exchange for payment in cryptocurrency.

The ATS has now written to Google’s Gmail office in California. They have sought blocking of these accounts to prevent their possible misuse. A senior officer said the agency had submitted an online request along with a list of the identified accounts.

Sources said Shankhwar is an intermediate pass-out and had earlier worked in the share market. His father is an e-rickshaw driver and he is the youngest of three sons.

The email trail that led to Kanpur

According to officials, the investigation began with a set of threatening emails sent on October 12 from the Gmail account simenbriones9265@gmail.com. The emails were sent in the name of the Khalistan National Army-Babbar Khalsa.

Story continues below this ad

A second account, smithjohnson6889@gmail.com, was allegedly used to send a bomb threat to the Mumbai Mayor’s Office on October 23.

Following a technical examination of the first email account, the ATS traced its access to Kanpur Nagar and identified Shankhwar as the alleged mastermind behind the operation.

The ATS seized a mobile phone and laptop from him. Sources said he had purchased the laptop second-hand from a local resident.

An initial examination of the laptop revealed several Excel files and cryptocurrency wallets, along with nearly 5 lakh email IDs, the agency said. Further examination of the devices led investigators to identify more than 20 lakh accounts.

Story continues below this ad

During questioning, Shankhwar allegedly told the ATS that he had been creating fake email IDs since 2021, generating lakhs of accounts over the years.

To create these accounts, officials said, he allegedly used WiFi and proxy networks which made it difficult to trace their actual users.

He would also sometimes buy existing email accounts, reset their passwords and sell them to others, officials claimed.

How the accounts were sold

According to the ATS, Shankhwar told them that he bought and sold fake email IDs through Facebook groups dedicated to trading such accounts. It was through these groups that he allegedly established contact with individuals and groups in Pakistan, Bangladesh, Turkey, Egypt and other countries.

Story continues below this ad

Officials said he allegedly supplied the email IDs through Excel sheets containing email addresses, passwords, recovery email IDs and two-factor authentication codes, which could be used to bypass CAPTCHA and two-step authentication processes.

The Bangladeshi connection

The ATS said it is also probing the role of another alleged key accused, a Bangladeshi national named Alamin Islam alias Alamin.

His alleged role came to light during Shankhwar’s questioning.

Shankhwar allegedly told investigators that he had come in contact with Alamin through Facebook and WhatsApp, and that the latter had approached him for fake email IDs. Shankhwar allegedly shared the email ID simenbriones9265@gmail.com with Alamin — later used to send the bomb threats.

Story continues below this ad

Alamin allegedly paid Shankhwar 6,000 USDT for the email accounts. The ATS said evidence of the cryptocurrency payment was found on Shankhwar’s mobile phone.

Shankhwar also shared an Excel sheet containing details of the accounts with Alamin through WhatsApp.

The ATS also found that Shankhwar’s WhatsApp account was connected to several international numbers. Several USDT transactions were also detected on his phone, the agency said.

The agency is preparing to seek Shankhwar’s police custody remand following the recovery of fresh evidence from his phone and laptop.