Diagnose Google security warning?

Question

I have received the following from Google:

Critical security alert

Suspicious attempt to sign in with your password

Google prevented someone who knows your password from signing in to your account. If this wasn’t you, you should change your password immediately.

As this wasn't me (I don't think) I'm slightly concerned as this has happened a couple of times. Google has blocked it but is there any way of finding out who or where the attack occurred? When you view the alert it doesn't tell you what or who has triggered it which is rather unhelpful! I'd just like to be able to debug the details to see what is going on.

Furthermore after additional research, nothing appears after "If this wasn’t you, you should change your password immediately." and "Were you recently prevented from signing in to your Google Account?". The picture here https://ifunny.co/meme/security-activity-critical-security-alert-yesterday-pm-suspicious-sign-in-WBqYQmuT8 shows the actual user info (which is blank for me) so I'm wondering if its almost a false negative. Without the details of who has logged in I think Google typically include them?? Lots of people on the web reporting IP addresses etc.

Answer 1

If you scroll the the very bottom of gmail you should see the following link:

This should allow you to see the account activity for the last few days:

Out of an abundance of caution, I would most likely open a new Incognito window (clears cache, and forces new session ID), log into your gmail account by manually typing the address gmail.com, and changing your password. You should also change the passwords of any other sites that make use of this password (but we all know you didn't reuse that password on multiple sites ... )