UP ATS seized a mobile phone and laptop containing Excel files with roughly 500,000 fake email IDs linked to proxy servers and crypto wallets—an inventory that exposed the syndicate's scale.
These accounts, forged via Wi‑Fi and proxy networks, were sold to buyers in Pakistan, Bangladesh, Turkey, Egypt, and the U.S., and used to send bomb threats to schools, a Diljit Dosanjh concert, and a Bollywood actor's home.
The investigation revealed Binance‑linked wallets, including a 6,000 USDT payment by Bangladeshi buyer Alamin Islam, and traced the threat emails to incidents in Gautam Buddh Nagar, Delhi, and Gurugram.
UP ATS has filed a case in Lucknow and is seeking remand for further interrogation, while investigators map the full international network and pursue additional suspects.