One Pro-Beijing Email Account, 114 Days: A Sustained Threat Campaign Targeting Falun Gong and Shen Yun

Threats Spanning Six Countries Forced Theater Evacuations, Performance Cancellations, and Targeted Individuals by Name—All Traceable to a Single Gmail Account Linked to Mainland China

Published May 7, 2026

When a bomb threat forced the evacuation of Toronto’s Four Seasons Centre for the Performing Arts on March 29, 2026, and the theater subsequently canceled six Shen Yun performances, it was not an isolated incident. It was one moment in a 114-day campaign of threats, harassment, and psychological operations, all traceable to a single Gmail account: [email protected], linked to mainland China through multiple technical and behavioral indicators.

Between January 1 and April 24, 2026, that account sent at least 28 documented malicious emails across six countries and three continents, targeting Falun Gong practitioners, Shen Yun Performing Arts, theaters, and government officials and institutions, including Buckingham Palace and Canada’s Parliament Hill. Its tactics included bomb threats, death threats, brazen harassment emails boasting of prior disruptions, and false-flag operations designed to frame the Falun Gong community itself.

What makes this account significant is not only its operational persistence, but what its communications reveal: a traceable, ideologically explicit operation with clear indicators of origin in mainland China and alignment with the Chinese Communist Party (CCP). Amid a broader campaign of anonymous threats that began in early 2024, this is the first single email account documented by the Falun Dafa Information Center (FDIC) to sustain this type of campaign continuously for over three months.

This research brief outlines the available evidence linking the account to mainland China, the full scale and scope of its activity, and the real-world impact of its threats and harassment. It draws on FDIC analysis of original data, as well as publicly available information from the Vancouver Police Department and local news outlets.

Key findings

• Origins pointing to mainland China: Multiple technical and behavioral indicators point to an operator based in mainland China, including timestamp patterns, a China-registered phone number, VPN routing, and the sender’s own admissions.
• Explicit CCP alignment: The account explicitly declared allegiance to the CCP in the wording of certain messages, framing its activities as fighting “for the glory of my motherland and the Communist Party.” The username itself reflects militant CCP political rhetoric (see full explanation below).
• Unprecedented persistence: 114 days of documented activity from a single account, unprecedented in FDIC’s dataset.
• Confirmed operational impact: Six Shen Yun performances canceled in Toronto following a bomb threat send from this account.
• Full tactical range consistent with broader CCP campaign: Bomb threats, death threats, impersonation, and false-flag operations targeting Falun Gong institutions, theaters, and government landmarks across six countries, highly consistent with a broader CCP-linked transnational repression campaign against Falun Gong.
• Sender’s own admissions as evidence: The sender’s own boasting emails provide unusually direct evidence linking the account to specific incidents and confirming CCP alignment.

Persistent actor in broader campaign

Since March 2024, individuals believed to be CCP-tied have waged a sustained campaign of transnational repression against Falun Gong practitioners and their initiatives. They have deployed tactics including anonymous bomb threats, individual death threats, mass-casualty scenarios, and threats targeting government officials and landmarks—all carried out through a rotating array of disposable email addresses designed to evade detection.

According to FDIC’s Incident Tracker, which monitors the CCP’s transnational repression and disinformation campaigns against Falun Gong, the scale of this effort as of April 30, 2026 is significant: since March 2024, a total of 279 incidents have been documented, including threats directed at Falun Gong practitioners and institutions (199 total incidents, 151 Shen Yun-related), government officials or institutions globally (186 incidents, 128 Shen Yun-related), and U.S. government officials or institutions specifically (90 incidents).

The cyber campaign emanating from this specific email address has unfolded alongside a parallel diplomatic offensive. Since January 1, 2026, Chinese diplomatic missions in at least five countries—the United Kingdom, Australia, France, Denmark, and Mexico—have issued official statements smearing Shen Yun. This pattern positions the email-based threats as one prong of a coordinated, multi-track operation rather than the work of an isolated actor.

Most threatening email accounts used in the longer running campaign have been short-lived, often disappearing within days. Against this backdrop, [email protected] stands out: it is the first known account to sustain this type of activity continuously for over three months.

Indicators of origin and alignment

Unlike most accounts involved in similar campaigns, this one provides rarely seen, mutually reinforcing evidence of its origin and ideological alignment. Several technical and behavioral indicators point to an operator based in mainland China or operating within its digital ecosystem:

• Timezone signature: Most emails carry timestamps consistent with China Standard Time (UTC+8).
• Linguistic fingerprint: Linguistic analysis across six languages points to a native Chinese speaker using machine translation for all non-Chinese targets. The 17 Chinese-language emails (61% of the total) contain colloquial idioms, culturally specific expressions, and stylistic flourishes consistent with native authorship. The French, Czech, Swedish, and English messages, by contrast, are stilted, mirror Chinese sentence structure, and use phrasing characteristic of machine translation. One Czech-language threat is particularly telling: its email headers (metadata indicating the sender’s language configuration) were set to Korean, while the body was machine-translated into Czech. Neither language is the sender’s own, indicating an operator drafting in Chinese and cycling through translation outputs for different target audiences. The pattern is consistent throughout: the operator writes natively in Chinese and switches to machine-translated output when targeting venues and institutions abroad.
• VPN admission: In one message, the sender explicitly claimed to use the Freegate VPN, a tool commonly used within China to bypass the Great Firewall’s internet restrictions and access overseas services like Gmail.
• Network Tracing and Phone Number: An investigation by the Vancouver Police Department (VPD) Cybercrime Unit determined that one threat email was sent to Vancouver Civic Theatres through VPN addresses linked to Asian regions, and found that a phone number associated with this Gmail account is a Chinese phone number based in China.
• Synchronized with consular interference: Simultaneously, representatives from the Chinese consulate in Vancouver were pressuring Vancouver Civic Theatres to cancel Shen Yun performances scheduled for April 8–12, a pattern of simultaneous diplomatic and cyber pressure targeting the same venue, reported by Global News on May 4, 2026. This convergence of consular interference and email-based threats against a single venue strengthens the case for coordinated, state-level operation rather than the work of a lone actor.
• Ideological statements: Multiple emails included explicit ideological statements that promote the CCP, such as acting “for the glory of my motherland and the Communist Party.”
• User name reflecting CCP’s rhetoric: The Gmail username itself carries ideological significance. The username “pinmingyongshi” appears to be a Pinyin romanization of the Mandarin phrase 拼命勇士 (pīn mìng yǒng shì), which translates as “fearless warrior” or “a warrior who fights to the death.” It describes someone who acts with reckless daring to achieve a goal, often disregarding their own safety. The choice of this phrase as a username reflects the CCP’s broader culture of militant political rhetoric, framing ideological campaigns as battles requiring sacrifice, and signals an operator who views this campaign in explicitly combative, party-aligned terms.

Taken together, these elements suggest either direct state coordination or strong ideological alignment with the CCP, though formal attribution remains under investigation.

Death threats and operational impact

Between January 1 and April 18, 2026, the account issued a sustained series of bomb threats, death threats, and coercive messages targeting Shen Yun performers, theaters, Dragon Springs (Shen Yun’s headquarters), Falun Gong practitioners, and government officials and institutions across North America, Europe, and Asia.

The following table summarizes the documented death threat incidents. Despite the graphic nature of the language in the threatening emails, no physical harm or attempted bombing has actually occurred. All incidents have been reported to law enforcement authorities and are under investigation.

Date	Target	Country	Threat (excerpt)
Jan. 1, 2026	The International Convention Centre, Birmingham	United Kingdom (Birmingham)	“We have planted a lot of plastic bombs; these bombs will explode in an hour.”
Jan. 8, 2026	Named FDIC staff members	United States (New York)	“They will see God one after another within two months… I swear before Almighty God, I am not joking.”
Jan. 9–10, 2026	Shen Yun ticketing services and presenters	France (Paris)	“If you insist on performing Shen Yun, there will be a terrorist attack. I’m not kidding you.”
Jan. 25, 2026	Theaters and Parliament Hill	South Korea; Canada	“If all future Shen Yun performances are not canceled within one day, the bombs will explode! Kill everyone!”
Mar. 11–12, 2026	Dragon Springs	United States (New York)	“If you don’t want Dragon Springs to be blown up into a blood-soaked ruin littered with corpses, cancel the Shen Yun performance immediately.”
Mar. 23, 2026	Buckingham Palace; British PM Keir Starmer	United Kingdom (Swansea)	“Several remote-controlled bombs have been planted throughout Buckingham Palace… As the Shen Yun performance begins, the bombs will be detonated.”
Mar. 29, 2026	Four Seasons Centre; Parliament Hill	Canada (Toronto)	“Many explosive devices have been placed at the Four Seasons Theatre and Parliament Hill in Canada. If the Shen Yun performance is not canceled and continues to be shown, explosions are planned.”
Mar. 30, 2026	Four Seasons Centre; Shen Yun performances	Canada (Toronto)	“Next time, I will enter the theater posing as an audience member; the moment Shen Yun begins its performance, I will open fire! …”
Mar. 30, 2026	Four Seasons Centre	Canada (Toronto)	[Three photos of bullets sent with no accompanying text.]
Mar. 30, 2026	Falun Gong practitioners	United States	“All Falun Gong practitioners worldwide, as well as the children under the age of 12 of supporters, will be abducted… assaulted… and thrown from skyscrapers.”
Apr. 2, 2026	Vancouver Civic Theatres	Canada (Vancouver)	“A large quantity of ammonium nitrate explosives and a remote detonation device have been placed. Please immediately cancel all future Shen Yun performances.”
Apr. 7, 2026	Prague Congress Centre	Czech Republic	“Once the performance begins, they will shoot at the performers! They will set fire to the venue!”
Apr. 7, 2026	Vancouver Civic Theatres	Canada (Vancouver)	“If Shen Yun insists on performing, some people will enter under the guise of watching, and once the performance begins, they will shoot at the performers!”
Apr. 18, 2026	Prague Congress Centre	Czech Republic	“A remote-controlled bomb is placed and if Shen Yun is not canceled, the bomb will explode!”

These incidents demonstrate a consistent coercive objective—to censor Shen Yun by forcing cancellations of performances and intimidating the broader Falun Gong community. They also reflect the same tactical playbook documented across the broader CCP-linked campaign: bomb threats to host venues, death threats targeting named individuals, threats against government officials and landmarks, and coercive demands for performance cancellations. What distinguishes this account are not the tactics themselves, but the sustained concentration of the full tactical range within a single persistent address over 114 days.

It is important to note that all of threats of violence to date have been false alarms, with no physical harm or attempt at mass violence materializing. Instead, the wording of the emails is meant to intimidate performers, pressure theaters to cancel shows because of security concerns, deter theatergoers, and reduce elected official support for Falun Gong and Shen Yun.

In practice, the campaign has caused show delays, building evacuations, and increased security costs for Shen Yun and venues. In Toronto, it achieved an even greater accomplishment: a run of six Shen Yun performances was canceled following the March 29 bomb threat, despite authorities determining it to be unfounded. The campaign succeeded in creating a disruption where diplomatic pressure has often failed, negatively affecting performers, audience members, and the organizations that support them—all without the sender setting foot in Canada.

Psychological operations and false-flag tactics

Beginning April 3, the account’s communications shifted from direct threats to harassment, taunting, and boasting about prior actions.

On April 3, emails sent to Shen Yun ticketing contacts in Canada openly boasted of prior actions:

“The Four Seasons incident in Toronto was my most successful one… Even the FBI can’t do anything to me.”

Subsequent messages mocked law enforcement for the impunity enjoyed by the sender to date and escalated rhetorical aggression:

“Police around the world have become my dogs… What can you do to me?”

On April 13, the operator introduced another tactic: impersonation. Emails sent to a Canadian Falun Gong association included screenshots purporting to show bomb threats submitted to third parties—including the CIA and the White House—using the association’s email address. The tactic suggests clear intent to fabricate evidence and potentially implicate Falun Gong victims in criminal activity.

On April 18, an additional message invoked explicit political motivation:

“For the glory of my motherland and the Communist Party… Just wait and die!”

The harassment continued on April 21 with a message describing prior false-flag operations in detail. The sender claimed to have used anonymized email services and VPN tools to impersonate a Falun Gong practitioner and issue threats to the Toronto theater:

“After the Four Seasons [Toronto theater] canceled [Shen Yun performances], I used Proton [Mail] to impersonate a practitioner and threaten the theater—saying that if they didn’t resume the performances, practitioners would kidnap and kill theater staff and open fire on Parliament Hill. I even used the name ‘Falun Dafa Is Good.’ […] You know Proton — high anonymity, no verification required. Even the email address was in pinyin, ‘Falun Dafa Is Good.’ And I was also using a Freegate VPN. All the signs point in that direction. What do you think they believed?”

On April 24, the operator sent a further boast to the Canadian Falun Gong association, claiming:

“I’ve sent bomb threats to airports, schools, and government agencies all over the world again. Use your email address…”

Assessment

Over the course of 114 days, the account’s activity moved from direct threats to harassment, impersonation, and false-flag operations—a progression that suggests an operator who grew more confident, not less, as the campaign continued.

The Toronto cancellations appear to have emboldened rather than satisfied the sender, triggering a shift toward psychological warfare designed to maximize fear, discredit law enforcement, and implicate victims in fabricated crimes.

The inclusion of screenshots purporting to show threats submitted under victims’ names, combined with detailed descriptions of anonymization methods, indicates the sender intended these communications to be taken seriously by both targets and law enforcement.

Taken together, the boasting emails serve a dual purpose: sustaining psychological pressure on targets while simultaneously documenting the sender’s own methods and ideological motivations, providing investigators with an unusually direct evidentiary record.

Call to action

The threats documented in this report potentially violate criminal laws across multiple jurisdictions, including statutes governing bomb threats, terrorist communications, and harassment in the United States, Canada, the United Kingdom, and the Czech Republic. They may also constitute violations of the civil rights of U.S. citizens and persons in other democratic countries.

Moreover, the ongoing impunity surrounding these activities risks allowing them to continue and escalate, as they have over the past year. They may also then expand from being focused on Falun Gong practitioners and Shen Yun to other communities and critics often targeted by the CCP.

The Falun Dafa Information Center therefore urges law enforcement agencies across these jurisdictions to treat this campaign as a coordinated, cross-border criminal operation and to dedicate investigative resources accordingly. Given the documented connections across the United States, Canada, the United Kingdom, Australia, and other allied nations, inter-agency coordination is warranted. The U.S. Department of Justice has previously pursued indictments of foreign nationals for cyber-enabled harassment and threat campaigns; where legally permissible, indictment in absentia should be considered as a tool of accountability even if the operator remains physically in China.

The FDIC also urges those researching transnational repression and censorship tactics, especially ones originating from China, to incorporate this case study into their analysis. All documented evidence, including original email headers, screenshots, timestamps, and the VPD’s technical findings linking the account to a Chinese phone number, has been preserved and is available to investigators upon request.

Organizations and individuals who receive threats from this or similar accounts are encouraged to report them to FDIC for tracking purposes and to implement appropriate security precautions in coordination with local law enforcement.

中文版：一個親北京電子郵箱帳號