Who is targeting Delhi schools with bomb threats? Trail leads to 20 lakh fake email IDs in Kanpur

On October 28, a team from the Uttar Pradesh Anti-Terrorism Squad (ATS) hurried towards a house in Ghatampur in Kanpur Nagar district. A credible intelligence input had led the ATS team to this house. Investigators had traced emails from a Gmail ID that threatened bomb attacks on schools in Delhi-NCR, a show by Punjabi singer Diljit Dosanjh and the house of a prominent Bollywood actor.

Inside, the team found a 24-year-old man named Ankit Shankhwar. And when they examined his devices — laptop and a phone — officials were in for a shock. Shankhwar had allegedly created more than 20 lakh fake email accounts using fictitious identities.

Officials said he then allegedly sold them in bulk to buyers in Pakistan, Bangladesh and other countries in exchange for payment in cryptocurrency. The ATS has now written to Google’s Gmail office in California. They have sought blocking of these accounts to prevent their possible misuse.

A senior officer said the agency had submitted an online request along with a list of the identified accounts. Sources said Shankhwar is an intermediate pass-out and had earlier worked in the share market. His father is an e-rickshaw driver and he is the youngest of three sons.

According to officials, the investigation began with a set of threatening emails sent on October 12 from the Gmail account simenbriones9265@gmail.com. The emails were sent in the name of the Khalistan National Army-Babbar Khalsa.

A second account, smithjohnson6889@gmail.com, was allegedly used to send a bomb threat to the Mumbai Mayor’s Office on October 23. Following a technical examination of the first email account, the ATS traced its access to Kanpur Nagar and identified Shankhwar as the alleged mastermind behind the operation.

The ATS seized a mobile phone and laptop from him. Sources said he had purchased the laptop second-hand from a local resident. An initial examination of the laptop revealed several Excel files and cryptocurrency wallets, along with nearly 5 lakh email IDs, the agency said.

Further examination of the devices led investigators to identify more than 20 lakh accounts. During questioning, Shankhwar allegedly told the ATS that he had been creating fake email IDs since 2021, generating lakhs of accounts over the years.

To create these accounts, officials said, he allegedly used WiFi and proxy networks which made it difficult to trace their actual users. He would also sometimes buy existing email accounts, reset their passwords and sell them to others, officials claimed.

According to the ATS, Shankhwar told them that he bought and sold fake email IDs through Facebook groups dedicated to trading such accounts. It was through these groups that he allegedly established contact with individuals and groups in Pakistan, Bangladesh, Turkey, Egypt and other countries.

Officials said he allegedly supplied the email IDs through Excel sheets containing email addresses, passwords, recovery email IDs and two-factor authentication codes, which could be used to bypass CAPTCHA and two-step authentication processes.

The ATS said it is also probing the role of another alleged key accused, a Bangladeshi national named Alamin Islam alias Alamin. His alleged role came to light during Shankhwar’s questioning.