Investigations into alleged anti-national activities in Kanpur have revealed significant details regarding the digital operations of arrested suspect Ankit Sankhwar. Inquiry by the UP ATS indicates that Sankhwar had been actively embedded within a foreign digital network for approximately 10 months. During this period, an individual based in Bangladesh handled his assignments. Their initial interaction began through online gaming and stock trading platforms, after which Sankhwar began generating and selling fraudulent email accounts overseas to increase his earnings. Analysis of call detail records and digital forensics from his mobile phone revealed direct contact records with phone numbers originating from Pakistan, Bangladesh, Egypt, Turkey, and the United States, prompting agencies to probe the operational nature of these international ties.
Automated scripts and proxy routing for bulk accounts
Sankhwar started creating fake email addresses using proxy networks to obscure the origin of the traffic. According to findings from the ongoing investigation, he sold his first fraudulent email address to an individual named Alamin. Following this transaction, Alamin assisted him in establishing an expanded chain of contacts across multiple jurisdictions, including Pakistan, Turkey, and Egypt. Over time, Sankhwar escalated his operation into generating email accounts in bulk.
To maintain mass output, he utilized programming language scripts designed to bypass mandatory mobile number verification safeguards during registration. This automation enabled him to generate thousands of email credentials simultaneously. To conceal his physical location and online footprint, he continually altered his laptop IP address using virtual private networks and proxy servers. Forensic teams recovered approximately 500,000 email addresses stored on his laptop. Security agencies are examining these datasets to determine precisely which accounts were deployed to transmit threatening messages and execute other illicit communications.
Cryptocurrency transactions and social media trade groups
Financial tracing revealed that Alamin paid Sankhwar a total of 6,000 USDT for the generated accounts. Digital forensics conducted on his mobile device and digital wallets confirmed that the compensation was remitted through cryptocurrency transfers. Investigators are currently identifying the originating funding sources, the transaction trails, and any secondary recipients tied to these digital assets, alongside an audit of his domestic bank accounts.
Sankhwar also operated buy-and-sell groups on WhatsApp and Facebook, which have been placed under scrutiny. He utilized these social communication channels to connect with clients seeking bulk email credentials and passwords. Police Commissioner Raghubir Lal stated that along with the ATS, teams from the NIA are actively analyzing the retrieved digital repositories to examine suspected terror links, while tracing the foreign telephone numbers uncovered on the device.
Bomb threats targeting schools and the Mumbai Mayor office
The broader security investigation was initiated following incidents on October 12, when numerous schools across Delhi, Noida, and Gurugram received bomb threats via email. Those electronic communications referenced the Khalistan National Army and Babbar Khalsa, while extending threats to bomb the scheduled Delhi-NCR concert and residence of Punjabi singer Diljit Dosanjh. Subsequently, on October 23, another fraudulent email threatened a bomb attack on the Mumbai Mayor office.
Law enforcement traced the digital footprints and IP routing headers of those messages back to Ankit Sankhwar, a native of Anoiya village in Ghatampur. Following surveillance, an ATS unit raided his residence at Sakrapur in Dehli Sujanpur, Paschim Para, and took him into custody, leading to his formal arrest on October 29. The search yielded his primary laptop and supplementary digital hardware containing the repository of 500,000 email accounts, as central and state agencies continue mapping out the full scope of his foreign operational directives.
