Security agencies probing the unprecedented number of bomb hoax calls this year have yet to make any breakthrough.

These calls were found to be linked to Virtual Private Networks (VPNs) to conceal the caller’s location, creating challenges for investigators trying to trace the source of these threats.

A security official with the Union home ministry said a preliminary probe has revealed that the majority of these threat mails were linked to IP addresses located in foreign countries, including London and Germany.

“We have managed to trace some IP addresses linked to the threats to locations in London and Germany but the use of multiple VPNs has made the exact origin difficult to ascertain,” the official said, adding that security agencies have roped in VPN service providers for assistance to track down the origin of the threats by gaining access to necessary user information from VPN services.

VPNs encrypt and reroute internet traffic, masking the user’s identity by making it appear as though they are located in different parts of the world, which complicates the efforts of law enforcement agencies.

“In most cases, the offenders mask their IP addresses and physical location using VPN. For instance, they may be sitting in Delhi and the IP will show as London and Germany or some other place. We have not been able to ascertain the actual origin of such accounts,” the official said.

At least six schools in Delhi received bomb threats via email early on Saturday, marking the third such incident targeting educational institutions in the national capital this week.

On Friday, nearly 30 schools were targeted, while similar threats were sent to 44 schools on Monday. All of them were found to be
false alarms.

On Thursday, the Reserve Bank of India had received an email threatening to blow up its head office, prompting an immediate police investigation. The threatening message, written in Russian, was sent to RBI governor Sanjay Malhotra’s email address.

Over 500 domestic and international flights (Air India, IndiGo, SpiceJet and Vistara) had received bomb threats between October 14 and October 30 which turned out to
be hoaxes.

“The probe into such bomb threats received through social media is very challenging as it requires cooperation between investigators and a host of entities, from social media giants to VPN companies and email service providers. The lack of co-ordination has put the brakes on the progress of the probe as VPN companies which are outside India, are not cooperating,” said an Intelligence Bureau official.

Most of the hoax threats targeting flights were received via social media.

Earlier, the Centre had pulled up social media platform X for “abetting” the spread of false alarms amid the spike in bomb threats received by airlines. The Union ministry of electronics and IT castigated X for its handling of hoax bomb threats to domestic and international flights as many of these hoaxes were circulated through its platform and questioned its representatives on the steps taken to stop such alarming rumours from spreading.

A Delhi police officer said over 40 FIRs had been lodged this year in connection with a spate of bomb threats besides FIRs have been filed by Mumbai police.

“The law enforcement agencies are actively pursuing all cases of bomb threats targeting airlines and schools but so far no breakthrough has been achieved in most of the cases,” said the Delhi police officer.