I got 3 mails from Gmail today; one each for my 3 seperate Gmail accounts, saying someone from this IP: tried to log-in and it was prevented, and that I should reset my password by following the given link if I don't recognize the address.

Is it real or is it phishing? Is this because I signed into one of Gmail accounts with a VPN? But then again why would I get notices for the other two?

  • Instincts say phishing. If you are concerned you should go to google.com (manually) and change it.
    – Rig
    Commented May 8, 2012 at 0:48
  • I think GMail shows an alert when you log in. I don't recall receiving an email last time I was affected. See: support.google.com/accounts/bin/…
    – iglvzx
    Commented May 8, 2012 at 0:53
  • Attach the complete email header and the complete contents of the e-mail; we can tell you various ways to identify fraud emails.
    – user19533
    Commented May 8, 2012 at 8:31
  • 2
    This seems to be legit.. techie-buzz.com/online-security/… Commented May 8, 2012 at 18:12
  • I doubt this is legit, too. I started receiving this message couple of weeks ago and now receive it 1-3 times a week. The message never specifies which of my google accounts is in question either. I find it hard to believe that all of a sudden people are trying to log in to either of my google accounts, several times a week, on the other side of the world.
    – user21170
    Commented Jun 16, 2012 at 6:17

8 Answers 8


I am the Gmail Community Manager, and I can confirm that we do send email notifications in certain cases such as described here.

Always carefully check the URL and never enter your Google password on a page that is not hosted at google.com. For example, it is OK to enter your password at https://accounts.google.com or https://mail.google.com, but not gooogle.com, g00gle.com, etc.

  • 6
    If a user receives such an email, does that mean the sign-in attempt at the suspicious address was made with the correct password? Or merely that a sign-in was attempted, which could have been with some random incorrect guess at the password? Commented Jun 10, 2012 at 0:35
  • 3
    I received this google email. It does not provide sufficient information, just a date and location. It doesn't say if there was a third-party app (like dropbox) trying to make the login, or if the user actually knew my password or not. Etc. Not enough information to go on. Bad email. Commented Jan 14, 2013 at 2:27
  • 2
    I received this email when I tried to access my account to send out email through gmail's SMTP server. The trouble shooting steps are of no help to me as I am legitimately trying to access me account from my C# code and Google is preventing it. How do I tell google the sign attempt should be allowed? Commented Dec 29, 2013 at 1:52
  • Same issue here. I moved to Singapore and cannot login to my account. It requires activation by phone (I NEVER set it up), which I left in my home country. Luckily I can ask my brother read the activation code for me, but it would be bad otherwise. Commented Mar 24, 2016 at 3:17
  • I understand that a log-in from a different country is suspicious, yet my case is not rare... How can I solve issues like this? Google should know that if I travelled to another country, likely my old phone number will not work right? Commented Mar 24, 2016 at 3:19

I would never follow a link in an email to reset a password, where said reset page asked for my original password.

As for Google, I have never seen any such email, and frequently log into many accounts behind various VPNs in various locations. Where I to receive such an email I would consider changing my password, but would only do so by going directly to Google, not by following such a link.

Did the page also ask for your SSN, mothers maiden name, bank account number for verification of course?

  • 1
    Never clicked on the link.
    – verve
    Commented May 8, 2012 at 1:07

I've logged in from multiple locations and I have only once been warned that my account may be compromised. Google does not send emails for these at all (see support page). For me it came up as a little warning message at the top. I would highly suggest not following the link given in the email!

  • Things have chanhed. They do send these now and there's no way around them, to say, for instance, acknowledge that it was you. Commented Feb 10, 2017 at 23:07
  • @DanWhaley You are correct, it has changed. Commented Feb 11, 2017 at 4:00

The email was legit but I still won't click links from emails like that. When I signed into gmail, a notice was waiting with the same message, on a highly visible red background, and I went in and changed the pw manually. As long as you stick with known URLs, you shouldn't have a problem. I'm glad Google is doing a good job with this. It's not their fault that every email should be viewed suspiciously. If it's real, it will probably be made known to you in more than one way.


I just received an email of this type, and in this case its definitely a fishing attempt. The URLs in the message body do all point to valid Google resources, but the attached 'report' on the problem contains a single file Google_Accounts_Alerts.exe, with a SHA1 of e1e52935037f8d995436015774dfad413966cb57.

Cisco has a recent report on these emails, though they don't reveal the specific nature of the threat: http://tools.cisco.com/security/center/viewThreatOutbreakAlert.x?alertId=26753


Received same email. Interesting part is that I received the email in the evening on May 7. The 'suspicious activity' noted in the email supposedly occured May 8 in the early morning. Good indicator it is spam or Google can now see into the future. Also, the links in the email itself are good spam indicators.

Here is the content of the email I received:

Someone recently tried to use an application to sign in to your Google Account, [email protected]. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

May 8, 2012 2:59am GMT
IP Address:
Location: Sunnyvale, California, United States

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

The Google Accounts Team

© 2012 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043

You have received this mandatory email service announcement to update you about important changes to your Google product or account.

  • 2
    Is it possible that you are in different time zone and that is why your local date/time is different? They sent the time in GMT.
    – Tschareck
    Commented May 8, 2012 at 14:10

It appears to be legit. I looked at the routing address and they are all Google.com addresses and if you do the date and time conversion from GMT to local time it is correct.

I am in agreement with everyone else to take this a a good notice, and to manually type in the URL for Gmail and change the password there.


I'm sure that is not legitimate. If you are concerned, go to your accounts themselves and change your passwords there. DO NOT FOLLOW THOSE LINKS.

  • Ya, changed them manually. I can't believe someone found all 3 of my Gmail addresses of mine to spam to!? How did they know?
    – verve
    Commented May 8, 2012 at 1:09
  • There are all sorts of spyders searching for email addresses.
    – Xavierjazz
    Commented May 8, 2012 at 1:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.