The Uttar Pradesh Anti-Terrorism Squad has arrested a 24-year-old Kanpur man accused of creating and selling large numbers of fake email accounts to overseas buyers, some of which were allegedly later used to send bomb threats to schools and other establishments across major Indian cities.
The accused, Ankit Shankhwar, a resident of Ghatampur in Kanpur, was taken into custody after investigators traced the technical trail of a threatening email account back to Kanpur.
Police say a laptop recovered from him contained Excel files listing around five lakh email IDs, while investigators also found cryptocurrency wallets and evidence of overseas contacts.
The case shifts attention from the people sending individual bomb threats to another layer of the operation: suppliers who allegedly create ready-to-use digital identities that can later be handed to buyers seeking anonymity.
Threat Email Trail Leads Investigators To Kanpur
The investigation began after schools in Gautam Buddh Nagar, Delhi and Gurugram received threatening emails from a particular account.
The messages allegedly threatened bomb attacks at schools and also referred to a concert featuring singer Diljit Dosanjh and the residence of a prominent Bollywood actor.
Some of the messages purportedly invoked the names of Khalistan National Army and Babbar Khalsa.
Technical analysis of the email account led investigators to Kanpur, where Shankhwar was identified as the alleged creator and supplier of the account.
Police claim he used Wi-Fi connections and proxy networks to conceal the location and identities associated with the fake accounts.
Another email address recovered from his laptop was allegedly used to send a bomb threat to the Mumbai mayor’s office on October 23.
Investigators are now examining whether additional accounts linked to his devices were used in other threat campaigns.
Five Lakh Email Accounts Allegedly Created For Overseas Buyers
According to investigators, Shankhwar had allegedly been creating fake email IDs since 2021 and selling them to buyers in different countries in exchange for cryptocurrency.
Authorities say he connected with potential buyers through Facebook groups and later communicated with people linked to countries including Pakistan, Bangladesh, Turkey and Egypt.
The accounts were allegedly not sold as simple usernames and passwords.
Investigators claim buyers were supplied with complete access packages containing passwords, recovery email details and two-factor authentication codes.
That would allow a purchaser to take control of an account immediately without needing to create or verify it personally.
For investigators, such pre-built accounts can create an additional layer between the person actually sending a threat and the technical identity attached to the message.
If accounts are created using proxy servers, false identities and separate recovery details, tracing them back to the eventual operator becomes more complicated.
Cryptocurrency Payment Forms Part Of Investigation
Police say Shankhwar came into contact with a Bangladesh national identified as Alamin Islam through Facebook and WhatsApp.
Investigators allege that Islam paid him 6,000 USDT in exchange for fake email accounts.
USDT, or Tether, is a cryptocurrency token designed to track the value of the US dollar.
According to the ATS, an email account allegedly used to send bomb threats to schools in Noida on October 12 had been supplied to Islam by Shankhwar.
The account credentials, recovery information and two-factor authentication details were allegedly shared over WhatsApp.
Investigators also found WhatsApp contacts linked to phone numbers from several countries and evidence of substantial cryptocurrency transactions.
The money trail is now likely to become an important part of the wider investigation, particularly in determining who purchased the accounts, who eventually controlled them and whether payments can be linked to specific threat campaigns.
Fake Account Suppliers Become Part Of Cybercrime Chain
The case illustrates how cybercrime investigations are increasingly moving beyond the person who directly sends a malicious message.
A threat email may be the visible part of an incident, but several supporting services can exist behind it.
Someone may create the account, another person may provide proxy infrastructure, a third may supply recovery details, while the eventual operator uses the account for threats, fraud or other criminal activity.
That supply chain can allow the final user to remain further removed from the account’s original creation.
It also explains why seemingly ordinary services such as bulk email-account creation can become important to investigators when accounts are allegedly sold with authentication credentials and anonymity features.
Police have recovered a mobile phone and laptop and are expected to examine the devices for additional account lists, buyer communications, wallet activity and links to other threat cases.
A case has been registered at the ATS police station in Lucknow.
Investigators are also seeking police custody of the accused to identify other people allegedly involved and determine whether the account-selling operation formed part of a larger cross-border network.
The central question now extends beyond who sent individual bomb threats. Authorities are trying to establish how the digital identities behind those threats were created, sold and transferred before reaching the people who ultimately used them.
