Who are phantom 'bombers' haunting Delhi schools and why tracing them is 'next to impossible'?

• Delhi schools and offices face repeated hoax bomb threats via anonymous emails
• Culprits use VPNs, encrypted emails, and the dark web to evade police detection
• Rare arrests occur; tracing senders is hard due to foreign servers and technology.

Did our AI summary help?

Hoax bomb threats continue to plague Delhi's schools and government institutions, with a fresh wave striking several schools on Monday morning, February 9, 2026. The Delhi Fire Service received the first call at 8:33 am, prompting rushed deployments of fire tenders and bomb squads to the sites, while the emails reportedly bore provocative messages claiming "Delhi will become Khalistan. Punjab is Khalistan. In memory of Afzal Guru."

These threats, often via email from anonymous groups like "Terrorizers111" or individuals, have hit multiple schools in single days, including prominent ones like DPS branches and CRPF schools. Despite thorough searches by police, bomb squads and fire services, no explosives are ever found, confirming them as hoaxes.

Bomb hoax threats in Delhi-NCR began escalating in early 2025, starting with schools receiving emails in early January that prompted immediate evacuations. The pattern resurfaced in February, targeting institutions in Delhi and Noida on consecutive days, including prominent colleges alongside schools.

Early 2025 escalation wave


A sharp surge hit in July, when over several days, more than 45 schools across south, west, central and north Delhi — especially in Dwarka — received near-identical threat emails in waves, pulling colleges into the chaos. August saw another intense wave, with dozens of schools alerting fire services within hours, peaking again at over 45 institutions on a single day.

The most massive attack came in late September, when over 300 schools, institutions and even airports were hit with morning emails, dwarfing prior incidents. Clusters of smaller threats persisted through October, November and December, including CRPF schools and DPS branches, before a fresh NCR alert marked the new year, signalling the hoax pattern's stubborn endurance

A January 2026 report noted the hoax wave spreading to Delhi-NCR colleges, while a teen was linked to over 400 threats in the prior year.

How senders evade capture

Cyber experts from the Delhi Police believe perpetrators use Virtual Private Networks (VPNs) and the dark web to mask their identities. A Delhi Police officer described tracking someone on the dark web as akin to pursuing a shadow in a hall of mirrors, where leads vanish behind layers of anonymity.

The dark web, a hidden internet segment not indexed by regular search engines, facilitates illegal activities like cybercrime, drug trafficking and human trafficking.

Senders shield themselves primarily through VPNs, which mask IP addresses by routing connections via foreign servers that refuse to share user logs with Indian authorities.

Encrypted email services like Proton Mail, combined with VPNs, make tracing "next to impossible," as they provide end-to-end encryption and no cooperation from providers based in places like Panama.

Advanced tools, anonymous email providers, dark web routing and proxy chains further obscure origins, rerouting signals across countries and baffling Delhi Police's cyber units.

Notable cases and breakthroughs



A Delhi teen evaded detection for a year by using VPNs, encrypted emails and high-tech devices to send threats to 400+ schools, claiming exam delays, but was caught via advanced cyber forensics in January 2025.

Police struggle with VPN chains and non-cooperative foreign firms, though rare arrests — like a 12-year-old in July 2025 — show persistence pays off sometimes. Experts urge banning uncooperative VPNs for critical threats, as current tracing is lengthy with bleak odds.