This is similar to Is this Google mail from gaia.bounces.google.com legit?, except a) I have nothing in my life related to the language used (Indonesian), b) these are different notifications (and more than one: an account recovery notif., and then a password change notif. (came twice, might also happen with legit ones), all within 1 minute), and c) finally: the recovery addresses mentioned are not mine. (But the To-address is indeed my main account address.)
I'd dismiss it as junk, however:
- All the hosts in the mail route seem the be the usual legit Google servers.
- All the URLs in the mail point to Google, too.
- GMail didn't flag it as suspicious.
- Everything seem to be like with the legit notifications. (It was TLS-encrypted, too.)
- Also checked the entire original email text (via "Show original"), didn't see anything off.
So, it's quite alarming, or at least puzzling to me, and the accepted answer at the other question doesn't apply here, unfortunately.
(In my G. account's security activity there are no matching entries, which is good. But FWIW, it doesn't seem to show my own earlier ones either, so who knows. I've changed my password anew, and noticed that the "real" notification didn't actually mention the recovery addresses.)
So, what is this exactly? And how does it happen, especially if not legit?
And if a fraud, then what's the point? (Doesn't make sense as phishing: there's no hook.) I can think of maybe a botched phishing attempt, or even a lead to a subsequent targeted social engineering attack, but what's with all the healthy-looking email metadata, regardless?
Thanks a lot for any insights!
