I got 3 mails from Gmail today; one each for my 3 seperate Gmail accounts, saying someone from this IP: tried to log-in and it was prevented, and that I should reset my password by following the given link if I don't recognize the address.

Is it real or is it phishing? Is this because I signed into one of Gmail accounts with a VPN? But then again why would I get notices for the other two?

  • Instincts say phishing. If you are concerned you should go to google.com (manually) and change it.
    – Rig
    May 8 '12 at 0:48
  • I think GMail shows an alert when you log in. I don't recall receiving an email last time I was affected. See: support.google.com/accounts/bin/…
    – iglvzx
    May 8 '12 at 0:53
  • Attach the complete email header and the complete contents of the e-mail; we can tell you various ways to identify fraud emails.
    – user19533
    May 8 '12 at 8:31
  • 2
    This seems to be legit.. techie-buzz.com/online-security/…
    – Sathyajith Bhat
    May 8 '12 at 18:12
  • I doubt this is legit, too. I started receiving this message couple of weeks ago and now receive it 1-3 times a week. The message never specifies which of my google accounts is in question either. I find it hard to believe that all of a sudden people are trying to log in to either of my google accounts, several times a week, on the other side of the world.
    – user21170
    Jun 16 '12 at 6:17

I am the Gmail Community Manager, and I can confirm that we do send email notifications in certain cases such as described here.

Always carefully check the URL and never enter your Google password on a page that is not hosted at google.com. For example, it is OK to enter your password at https://accounts.google.com or https://mail.google.com, but not gooogle.com, g00gle.com, etc.

  • 5
    If a user receives such an email, does that mean the sign-in attempt at the suspicious address was made with the correct password? Or merely that a sign-in was attempted, which could have been with some random incorrect guess at the password? Jun 10 '12 at 0:35
  • 2
    I received this google email. It does not provide sufficient information, just a date and location. It doesn't say if there was a third-party app (like dropbox) trying to make the login, or if the user actually knew my password or not. Etc. Not enough information to go on. Bad email. Jan 14 '13 at 2:27
  • 2
    I received this email when I tried to access my account to send out email through gmail's SMTP server. The trouble shooting steps are of no help to me as I am legitimately trying to access me account from my C# code and Google is preventing it. How do I tell google the sign attempt should be allowed? Dec 29 '13 at 1:52
  • Same issue here. I moved to Singapore and cannot login to my account. It requires activation by phone (I NEVER set it up), which I left in my home country. Luckily I can ask my brother read the activation code for me, but it would be bad otherwise. Mar 24 '16 at 3:17
  • I understand that a log-in from a different country is suspicious, yet my case is not rare... How can I solve issues like this? Google should know that if I travelled to another country, likely my old phone number will not work right? Mar 24 '16 at 3:19

I would never follow a link in an email to reset a password, where said reset page asked for my original password.

As for Google, I have never seen any such email, and frequently log into many accounts behind various VPNs in various locations. Where I to receive such an email I would consider changing my password, but would only do so by going directly to Google, not by following such a link.

Did the page also ask for your SSN, mothers maiden name, bank account number for verification of course?

  • 1
    Never clicked on the link.
    – verve
    May 8 '12 at 1:07

I've logged in from multiple locations and I have only once been warned that my account may be compromised. Google does not send emails for these at all (see support page). For me it came up as a little warning message at the top. I would highly suggest not following the link given in the email!

  • Things have chanhed. They do send these now and there's no way around them, to say, for instance, acknowledge that it was you. Feb 10 '17 at 23:07
  • @DanWhaley You are correct, it has changed. Feb 11 '17 at 4:00

The email was legit but I still won't click links from emails like that. When I signed into gmail, a notice was waiting with the same message, on a highly visible red background, and I went in and changed the pw manually. As long as you stick with known URLs, you shouldn't have a problem. I'm glad Google is doing a good job with this. It's not their fault that every email should be viewed suspiciously. If it's real, it will probably be made known to you in more than one way.


I just received an email of this type, and in this case its definitely a fishing attempt. The URLs in the message body do all point to valid Google resources, but the attached 'report' on the problem contains a single file Google_Accounts_Alerts.exe, with a SHA1 of e1e52935037f8d995436015774dfad413966cb57.

Cisco has a recent report on these emails, though they don't reveal the specific nature of the threat: http://tools.cisco.com/security/center/viewThreatOutbreakAlert.x?alertId=26753


Received same email. Interesting part is that I received the email in the evening on May 7. The 'suspicious activity' noted in the email supposedly occured May 8 in the early morning. Good indicator it is spam or Google can now see into the future. Also, the links in the email itself are good spam indicators.

Here is the content of the email I received:

Someone recently tried to use an application to sign in to your Google Account, xxxxxx@gmail.com. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

May 8, 2012 2:59am GMT
IP Address:
Location: Sunnyvale, California, United States

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

The Google Accounts Team

© 2012 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043

You have received this mandatory email service announcement to update you about important changes to your Google product or account.

  • 2
    Is it possible that you are in different time zone and that is why your local date/time is different? They sent the time in GMT.
    – Tschareck
    May 8 '12 at 14:10

It appears to be legit. I looked at the routing address and they are all Google.com addresses and if you do the date and time conversion from GMT to local time it is correct.

I am in agreement with everyone else to take this a a good notice, and to manually type in the URL for Gmail and change the password there.


I'm sure that is not legitimate. If you are concerned, go to your accounts themselves and change your passwords there. DO NOT FOLLOW THOSE LINKS.

  • Ya, changed them manually. I can't believe someone found all 3 of my Gmail addresses of mine to spam to!? How did they know?
    – verve
    May 8 '12 at 1:09
  • There are all sorts of spyders searching for email addresses.
    – Xavierjazz
    May 8 '12 at 1:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.