Ankit Shankhwar, 24, was taken into custody by the Uttar Pradesh Anti‑Terrorism Squad at 11:45 a.m. on October 23 in Kanpur's Ghatampur area after a sting operation uncovered a laptop brimming with 500,000 forged email accounts that he had been selling through Facebook groups to buyers in Pakistan, Bangladesh, Turkey and Egypt. The IDs were used to dispatch bomb threats to schools in Noida, Delhi‑NCR and Gurugram, and to high‑profile targets such as the Mumbai mayor’s office and a proposed Diljit Dosanjh concert.
The threats were traced back to a handful of IDs, most notably "smithjohnson6889@gmail.com" and "simenbriones9265@gmail.com", which the ATS traced to Shankhwar’s laptop. Technical analysis revealed that the accounts were accessed from Kanpur, and the emails invoked extremist groups like the Khalistan National Army and Babbar Khalsa, amplifying the terror appeal.
Shankhwar’s contacts extended beyond India. He communicated with Alamin Islam, a Bangladeshi national, through Facebook and WhatsApp, receiving 6,000 USD worth of Tether crypto via Binance wallets. The ATS says the payments were funneled through a chain of crypto exchanges, masking the true source of the funds.
The Uttar Pradesh Anti‑Terrorism Squad has filed a petition for a 60‑day remand order, arguing that Shankhwar poses an ongoing threat to national security. The court will hear the case on November 5, and the ATS will seek to keep him in custody pending further investigation.
A teacher at a primary school in Delhi‑NCR received a bomb threat email from "simenbriones9265@gmail.com" on October 18, forcing the school to postpone classes and alert the police. The incident was the first of many that highlighted how Shankhwar’s network exploited digital anonymity to spread terror across India.