Secure browsers, VPNs, delay in data sharing mar probes into bomb threats by Ludhiana police

The police investigation into the recent wave of anonymous hoax bomb threat emails to establishments in the city has unearthed the miscreants used proxy servers, Virtual Private Networks (VPNs) and the Tor network (an overlay network designed to enable anonymous communication) to cover their tracks.

Though the police have been able to trace the source of the emails to certain countries, they have not been able to determine the exact locations from which the emails were sent. Senior police officials cite delay in data sharing by email-hosting companies for not being able to ascertain more details.

The bomb threat emails have targeted schools, Municipal Corporation (MC) offices, Deputy Commissioner’s (DC) office and the Halwara International Airport.

Additional Deputy Commissioner of Police (Headquarters) Vaibhav Sehgal said cybercriminals frequently use proxy servers, VPNs and encrypted email services to send anonymous threats. By routing internet traffic through multiple domain servers—often located outside the police’s jurisdiction—they mask their IP addresses, making tracing complex for law enforcement.

Sehgal confirmed the cyber cell had already initiated an investigation into these bomb-threat emails and the locations of the senders were being traced to foreign countries.

“The police have already written to the hosting companies to identify the senders of the emails, the documents or numbers attached to the email accounts and the exact locations from which the emails were sent. Hosting companies based overseas are dilly-dallying in providing the information. Reminders are also being sent to the companies,” said Sehgal.

A cyber police official said the police had to deal with masked routes and proxies. As part of the investigation protocol, when the police requested IP logs from the email-hosting platforms, the data shared pointed to exit nodes in countries like the US and Bangladesh, along with some countries in Europe and Asia.

“Usually, the senders rely on VPNs, proxy servers and the Tor network to mask their identities. It poses challenges for the investigators,” added the official.