LUCKNOW: Singer Diljit Dosanjh's proposed concert in Indore on November 15 and a court in Gwalior were among the latest targets of hoax bomb threats allegedly issued through fake email accounts created by a Kanpur-based youth, with the Uttar Pradesh Anti-Terrorist Squad (ATS) uncovering fresh details nearly two weeks after his arrest.
The ATS investigation into the activities of 24-year-old Ankit Shankhwar, a resident of Ghatampur in Kanpur Nagar district, has revealed that he operated a vast network for creating and selling fictitious email accounts using proxy servers and other anonymity tools.
Investigators suspect that several of these accounts were later used to send bomb threats to schools, government establishments and high-profile public events across multiple states.
Shankhwar was arrested by the ATS on October 28 after intelligence inputs linked a suspicious email account to a series of bomb threats sent to schools in Noida, Delhi and Gurugram. As investigators traced the digital trail, they allegedly uncovered a sophisticated operation involving the creation of fake email identities that could be used anonymously by buyers to conceal their real locations and identities.
According to ATS officials, the latest findings suggest that the network's footprint extended well beyond Uttar Pradesh. During the ongoing probe, investigators found evidence indicating that email accounts linked to the network were also used to issue threats concerning Dosanjh's proposed concert in Indore and a court complex in Gwalior, giving the case a significant interstate dimension.
The agency is now examining who ultimately used the accounts and whether multiple individuals were involved in orchestrating the threats after purchasing access to the fake email IDs.
Investigators claim that Shankhwar had been generating fictitious email accounts since 2021 and marketing them through social media platforms and online forums. During searches, the ATS recovered a laptop and mobile phone that allegedly contained digital records of the operation.
Forensic examination of the devices reportedly revealed spreadsheets containing details of nearly five lakh email IDs, along with passwords, recovery email addresses and two-factor authentication credentials. Officials believe these records allowed users to gain access to the accounts while avoiding conventional verification mechanisms.
The probe initially gathered momentum after authorities detected threatening emails sent to educational institutions in Noida, Delhi and Gurugram.
Investigators later found references to threats targeting celebrity events and prominent individuals. Some emails allegedly invoked the names of the Khalistan National Army and Babbar Khalsa while issuing warnings of explosions.
ATS officials also discovered that another email account allegedly linked to the network was used to send a bomb threat to the Mumbai Mayor's Office on October 23, broadening the scope of the investigation.
A major focus of the probe is the network's suspected international links. During scrutiny of digital communications, investigators identified exchanges between Shankhwar and a Bangladeshi national, Alamin Islam alias Alamin, through Facebook and WhatsApp. According to ATS sources, Shankhwar allegedly supplied fake email accounts to him in return for 6,000 USDT in cryptocurrency.
The agency suspects the accounts were sold to buyers in multiple countries, including Bangladesh, Pakistan, Turkey and Egypt, with payments allegedly routed through cryptocurrency platforms. Investigators are analysing transaction trails, communication records and international contacts to identify purchasers and establish their role in the bomb threats.
A case has been registered at the ATS police station in Lucknow under relevant provisions of the Information Technology Act and the Bharatiya Nyaya Sanhita.
