The Uttar Pradesh Anti-Terrorism Squad (ATS) has arrested Ankit Shankhwar, 24, a resident of Ghatampur in Kanpur Nagar, accusing him of creating and selling fake email accounts to foreign buyers, some of which were allegedly later used to send bomb threats to schools and other establishments, The Times of India reported, quoting the ATS. The CSR Journal also reported the arrest, saying a mobile phone and a laptop were recovered from him.
Source: The Times of India (via Twasl News syndication)
This arrest is a follow-up development in a case Awaaz Punjab readers have seen before: threatening emails were sent earlier this month to schools in Gautam Buddh Nagar (Noida), Delhi and Gurugram, and a separate threat email reached the Mumbai Mayor's office on October 23 naming schools, offices and public figures. According to the ATS, technical analysis of one threat account led investigators to Kanpur and to Shankhwar, whom they identify as its alleged creator and supplier.
Five lakh IDs on a laptop, the ATS says
Investigators seized a laptop and a mobile phone from the accused. An examination of the devices reportedly found Excel files containing approximately five lakh (500,000) email IDs, along with cryptocurrency wallet details, the ATS said. It alleges Shankhwar supplied accounts through spreadsheets containing the email ID, password, recovery email address and two-factor authentication codes, so a buyer could take control of an account immediately.
Source: The 420
According to the ATS, Shankhwar had allegedly been creating fake email accounts since 2021, using Wi-Fi connections and proxy networks to conceal identities, and sold them in exchange for cryptocurrency. He allegedly found customers through Facebook groups for buying and selling online accounts, and established contacts with individuals in Bangladesh, Pakistan, Turkey, Egypt and other countries.
The threat accounts and the Bangladesh link alleged
The ATS said the probe began after schools in Gautam Buddh Nagar, Delhi and Gurugram received threatening emails from the account simenbriones9265@gmail.com. The messages allegedly threatened bomb attacks on schools in the name of the Khalistan National Army and Babbar Khalsa, and also referred to a proposed Delhi-NCR show by singer Diljit Dosanjh and the residence of a prominent Bollywood actor. Investigators allege Shankhwar supplied that account to a Bangladeshi national, Alamin Islam, who allegedly paid him 6,000 USDT (a dollar-linked cryptocurrency token) for fake email IDs, and that the account was used to send threats to schools in Noida on October 12.
Another account found on his laptop, smithjohnson6889@gmail.com, was allegedly used to send a bomb threat to the Mumbai Mayor's office on October 23, the ATS said. Shankhwar's WhatsApp was also reportedly connected to phone numbers from several countries, including Bangladesh, Pakistan, Egypt, Turkey and the United States, and investigators say they detected substantial cryptocurrency transactions.
What happens next
A case has been registered at the ATS police station in Lucknow under relevant legal provisions. The agency is seeking police custody remand of the accused to question him about other people allegedly involved, trace the cryptocurrency transactions and identify other buyers and suppliers, and to establish the links between the fake accounts and each threat. The allegations against Shankhwar remain subject to investigation and court proceedings.