The Uttar Pradesh Anti-Terrorism Squad has arrested a 12th-pass youth from Kanpur for allegedly creating approximately five lakh fake email accounts and selling them to buyers in overseas countries, including Pakistan and Bangladesh. Investigating agencies stated that several of these digital accounts were subsequently used to send bomb threats to schools in Delhi-NCR, public offices, and events linked to prominent figures. The arrested operative, identified as Ankit Shankhwar, a resident of Sakarapur in Dehli Sujanpur, Kanpur, was apprehended on Wednesday following technical surveillance that traced threatening email traffic back to the city. Investigators recovered digital evidence from his mobile phone and a second-hand laptop, including data on hundreds of thousands of generated addresses and active cryptocurrency wallets used to receive international payments.
Digital Network and Foreign Transactions
According to the preliminary findings of the UP ATS, Ankit had been operating the clandestine operation since 2021. To conceal his physical location and online footprint, he routinely relied on local Wi-Fi connections paired with proxy networks. He marketed the bogus accounts across buy-and-sell groups on Facebook and finalized arrangements through WhatsApp chats. Buyers were provided with complete access kits, including primary passwords, linked recovery accounts, and two-factor authentication details. In exchange for these bulk digital credentials, he accepted payments in US dollars and Tether (USDT) cryptocurrency. Digital records retrieved from his mobile device revealed sustained communication with numbers registered in Pakistan, Bangladesh, Türkiye, Egypt, and the United States. Investigators discovered that a Bangladeshi national, identified as Alamin Islam, alias Alamin, purchased multiple batches of IDs and transferred USDT tokens worth 6,000 US dollars directly into Ankit’s digital wallet.
Threat Dispatches and Targeted Locations
The inquiry gained momentum after security agencies tracked multiple high-profile hoaxes and terror warnings sent to public and private entities across India. The email address simenbriones9265@gmail.com was utilized on October 12 to dispatch bomb threats targeting educational institutions in Noida, Gurugram, and the wider Delhi-NCR region. The same address was deployed to issue warnings against an upcoming event of Punjabi singer Diljit Dosanjh in Delhi-NCR as well as the private residence of a prominent film actor. Furthermore, on October 23, another generated address, smithjohnson6889@gmail.com, was used to threaten a bomb attack on the Mumbai Mayor’s office. Forensic tracking revealed that these accounts had originated from Kanpur, directly implicating Ankit in the logistical chain that supplied threat actors with anonymous communication channels.
Domestic Concealment and Broader Inquiries
Despite processing substantial sums in foreign virtual currency, Ankit maintained a low-profile existence in a single-room residence alongside his family. His father, Prahlad, who works as a cycle-rickshaw puller, stated that Ankit had purchased an old laptop on instalments from a shop in Govind Nagar roughly six months ago. Relatives reported that he often spent entire nights behind the screen, claiming to be playing video games when questioned about his prolonged activity. To avert local suspicion, he occasionally took up daily-wage labour and avoided drawing attention to himself in the neighbourhood. The ATS has registered a formal case at its police station in Lucknow under relevant statutory provisions. Officials are now interrogating the accused to determine who trained him in these technical bypass methods, whether he functioned as a sleeper module for hostile foreign elements, and if his client lists intersect with major domestic cyber-fraud syndicates operating across state lines.
