LUCKNOW The Uttar Pradesh Anti-Terrorist Squad (ATS) has arrested a 24-year-old man from Kanpur Nagar for allegedly operating an international syndicate that supplied nearly five lakh fake email accounts to overseas buyers, including a Bangladeshi national linked to recent bomb threats against schools in Noida.
The accused, identified as Ankit Shankhwar of Ghatampur in Kanpur, was apprehended on Wednesday following a technical investigation into a series of hoax bomb threats sent to prominent schools in Noida, Delhi, and Gurugram.
According to ATS officials, forensic analysis of a laptop and mobile phone seized from Shankhwar revealed Excel spreadsheets containing close to 5,00,000 email IDs, along with cryptocurrency wallet details and international WhatsApp chats.
The breakthrough came when ATS teams tracked the digital footprint of an email account—simenbriones9265@gmail.com—which was used on October 12 to send bomb threats to multiple schools in Noida and neighbouring NCR cities. The emails also threatened explosions at a proposed Delhi-NCR concert by Punjabi singer Diljit Dosanjh and the residence of a prominent Bollywood actor, while invoking the banned outfits Khalistan National Army and Babbar Khalsa.
While tracing the IP logs, investigators discovered that the email account had initially been accessed from Kanpur, leading them to Shankhwar.
{{/usCountry}}While tracing the IP logs, investigators discovered that the email account had initially been accessed from Kanpur, leading them to Shankhwar.
{{/usCountry}}During the probe, officials also linked a second email address—smithjohnson6889@gmail.com—to the same network. That account was allegedly used on October 23 to send a bomb threat to the Mumbai mayor’s office.
During preliminary interrogation, Shankhwar reportedly confessed to creating bulk fake email accounts since 2021. Using public Wi-Fi and proxy servers to mask his location, he generated thousands of accounts under fictitious identities and advertised them on Facebook groups dedicated to trading digital credentials.
Unlike basic account sellers, Shankhwar allegedly provided buyers with complete access packages. He shared spreadsheets over WhatsApp containing email IDs, passwords, recovery email addresses, and two-factor authentication (2FA) backup codes, allowing overseas buyers to log in seamlessly without triggering security blocks.
Investigators found a Binance cryptocurrency wallet on his phone showing substantial incoming transactions in Tether (USDT).
The ATS identified one of Shankhwar’s primary overseas buyers as Alamin Islam, a Bangladeshi national. Officials said Islam connected with Shankhwar via Facebook and WhatsApp, paying him 6,000 USDT for batches of email accounts. The credentials for the specific Gmail account used in the October 12 Noida school threats were allegedly handed over to Islam via WhatsApp.
An FIR has been registered at the ATS police station in Lucknow. Officials stated they will apply for Shankhwar’s police custody remand to interrogate him further, trace the cryptocurrency trails and cross-reference the five lakh recovered email IDs with other unsolved cybercrimes across the country.