From bomb threats to crypto payments: UP ATS uncovers 20-lakh fake email ID racket

A lead pertaining to repeated bomb threats faced by Delhi-NCR schools a few months ago, along with other similar warnings, took the Uttar Pradesh Anti-Terrorism Squad (ATS) to a house in Ghatampur in Kanpur Nagar district.

There, investigators discovered details of more than 20 lakh email IDs on 24-year-old Ankit Shankhwar’s laptop, while further investigation revealed that he had sold bulk email accounts to buyers in Pakistan, Bangladesh and other countries in exchange for cryptocurrency, The Indian Express reported.

On October 28, investigators descended upon the residence of the intermediate pass-out, whose father drives an e-rickshaw, and the examination of his second-hand laptop and mobile phone exposed a sprawling digital black market.

The ATS traced the email trail to Shankhwar after examining threatening messages sent on October 12 from a Gmail account in the name of the Khalistan National Army-Babbar Khalsa.

The threats targeted schools in Delhi-NCR, a performance by Punjabi singer Diljit Dosanjh and the residence of a prominent Bollywood actor. Another Gmail account was allegedly used to send a bomb threat to the Mumbai Mayor’s Office on October 23.

Shankhwar had been fabricating fictitious accounts since 2021 via proxy networks and Wi-Fi to mask user identities, and he also repurposed existing addresses before trading them on dedicated Facebook groups.

These illicit transactions connected him with operatives across Egypt, Turkey, Pakistan and Bangladesh, to whom he dispatched spreadsheets containing passwords, recovery details and two-factor authentication codes designed to bypass standard security protocols.

The investigation has also brought a Bangladeshi national, Alamin Islam alias Alamin, under the scanner. Shankhwar allegedly told the ATS that he had come into contact with Alamin through Facebook and WhatsApp and supplied him with the email account subsequently used to issue the October 12 threats.

Alamin allegedly paid him 6,000 USDT for the accounts, with investigators claiming to have recovered evidence of the cryptocurrency transaction from Shankhwar’s phone.

The ATS has formally petitioned Google’s California headquarters to block the compromised accounts, and the agency is now preparing to seek Shankhwar’s police custody remand to unearth the wider network behind this cross-border cyber conspiracy.