LUCKNOW: The Uttar Pradesh Anti-Terrorist Squad (ATS) has arrested a 24-year-old man from Kanpur Nagar for creating and selling lakhs of fake email IDs to foreign contacts, including individuals in Bangladesh and Pakistan, some of which were subsequently used to send bomb threats to schools and key establishments in Noida, Delhi, Gurugram and Mumbai.The accused, Ankit Shankhwar, a resident of Ghatampur in Kanpur Nagar, was arrested on October 29.According to the ATS, he had been creating fake email accounts since 2021, using proxy networks and Wi-Fi connections to conceal users’ identities.He sold the accounts in exchange for cryptocurrency.The investigation was initiated after the ATS received intelligence about threatening emails sent from the account simenbriones9265@gmail.com to schools in Gautam Buddh Nagar, Delhi and Gurgaon.The emails reportedly threatened bomb attacks at schools in Noida and other cities in the name of the Khalistan National Army and Babbar Khalsa.They also contained threats targeting a proposed Delhi-NCR show by Punjabi singer Diljit Dosanjh and the residence of a prominent Bollywood actor.A technical analysis of the email account led investigators to Kanpur Nagar, where Shankhwar was identified as the alleged creator and supplier of the account.
Five lakh email IDs recovered
During the operation, the ATS seized a laptop and a mobile phone from the accused.An examination of the devices reportedly revealed several Excel files containing approximately five lakh email IDs, along with cryptocurrency wallet details.According to the ATS, Shankhwar supplied the accounts through spreadsheets containing email IDs, passwords, recovery email addresses and two-factor authentication codes.These details allegedly enabled buyers to access the accounts while attempting to circumvent authentication safeguards and conceal their identities.Investigators said Shankhwar used Facebook groups dealing in the buying and selling of online accounts to find customers.Through these groups, he allegedly established contacts with individuals in Bangladesh, Pakistan, Turkey, Egypt and other countries.
Bangladeshi contact paid 6,000 USDT
During interrogation, Shankhwar disclosed that he had come into contact with a Bangladeshi national identified as Alamin Islam through Facebook and WhatsApp.The individual allegedly sought fake email IDs from him and paid him 6,000 USDT in return. The ATS said evidence of the transaction was found on the accused’s mobile phone.Investigators found that Shankhwar had allegedly supplied the email ID simenbriones9265@gmail.com to Alamin Islam. The account was reportedly used to send threatening emails to schools and other locations in Noida on October 12.Another account, smithjohnson6889@gmail.com, was allegedly used to send a bomb threat to the Mumbai Mayor’s Office on October 23.The ATS said the credentials of both accounts, including passwords, recovery email addresses and two-factor authentication codes, had been shared with the Bangladeshi contact through WhatsApp in an Excel sheet.The agency also found that Shankhwar’s WhatsApp account was connected to phone numbers from several countries, including Bangladesh, Pakistan, Egypt, Turkey and the United States. Investigators reportedly detected substantial cryptocurrency transactions involving USDT.
Probe underway to identify wider network
A case has been registered at the ATS police station in Lucknow under relevant legal provisions.The agency is seeking police custody remand of the accused to question him about other individuals involved in the network and establish the full extent of the operation.The investigation will focus on tracing the cryptocurrency transactions, identifying other buyers and suppliers, and determining the links between the fake email accounts and the bomb threats issued to schools and other establishments.The allegations against Shankhwar are subject to investigation, and further details about the wider network are expected to emerge as the probe progresses.
