In reply to a post by XRaySpeX:

Can you log in to your newly "acquired" Google a/c's, even if you pretend to have forgotten your pwd?

So I try to log into the gmail one and the Forgotten password page, when given name1@mydomain says

No account found with that email address.

Then I tried to log into name1@mydomain. Same result.

Looks like people are having a go at Gmail.
Here's an image/tweet of a Gmail phishing attempt sent earlier to a Mozilla developer : https://twitter.com/i/#!/codepo8/media/slideshow?url...

@Yarwell
If the email was via Gmail then I don't believe you can find the originators IP - Gmail doesn't give that away (last time I checked) and all addresses will be for Google.

'View source' and look to see if the links are taking you somewhere malicious etc.

I've had a couple of these too, and have noted reference to them on another forum. As you say, somebody's having a go at Google, but it's difficult if not impossible to report the spoofs. Understandable perhaps given the millions of accounts out there.

If you are using the Gmail interface you can report phishing or scams with a couple of clicks: http://support.google.com/accounts/bin/answer.py?hl=...

As mentioned previously, copy/pasting the email into this thread in its "raw" format would give the best diagnosis (edit out personal info).

How to do this varies in each email client. In Windows Live Mail it's:
Right-click > Properties > Details > Message Source

I've no problem with that, except for one question. I did start a PM to yarwell with them, but it was late and I was expecting a hectic day today, so packed it in. (In fact today has been a nightmare).

It's easy enough to edit out my private domain, but what about the MIME gibberish that AIUI contains most of the email in a coded form. I was worried about posting that stuff in case decoding it gave that domain.

Post deleted by RobertoS

Edited by RobertoS (Thu 04-Oct-12 18:45:48)

FYI - your l.... domain is visable from the Google links.
You might want to strip out the links?

If you ignore a force Google verification you should stay safe unless someone else knows your password to verify.

Edited by b4dger (Thu 04-Oct-12 18:11:43)

The critical line is the first "Received: from" and as you say it looks legit; the IP address is definitely one of google's.

The next question is how someone is adding email addresses to your google account. I think this can only be done by logging into google, so change your google account password(s) and scan for viruses.

Lastly, log into gmail and check your login history (details link, bottom right). You can also set it to alert you on suspicious activity.

Edited by Oliver341 (Thu 04-Oct-12 16:49:38)

Also, go here and check what email addresses are added (or waiting validation):
https://www.google.com/settings/account