Last account activity
Clicking the Details link next to the Last account activity line at the bottom of any Gmail page shows information about recent activity in your mail.
Recent activity includes any time that your mail was accessed, using a regular web browser, through a POP client, from a mobile device, etc. We'll list the IP address from which the access was made, the associated location, as well as the time and date.
How to use this data
If you're concerned about unauthorized access to your mail, you'll be able to use this data to find out if and when someone gained access. It's information we'd use to troubleshoot unauthorized account activity, and now it's available to you. Does the Access Type column show any unusual access? If you don't use POP to collect your mail, but your Recent activity table is showing some POP access, it may be a sign that your account has been compromised.
The IP address column is also useful. We list the last 10 IP addresses and the associated location. If you received a warning about suspicious activity in your account, you may see up to 3 IP addresses that have been labeled as suspicious in addition to the 10 normal IP addresses. How do we guess the location? In most cases, we match your IP address to a broad geographical location. If you always or most often sign in to Gmail using a single computer, your IP address should be the same, or start with the same two sets of numbers (for example, 172.16.xx.xx). If you're seeing an IP address that differs greatly from your usual IP address, it could either mean that you've recently accessed your mail from a different location, or that someone else has accessed your mail. Your current IP address is displayed below the Recent activity table. In addition, you may notice that the location and IP mappings may not always be accurate, especially in cases where the logins are old.
Please note: If you have POP3 or IMAP enabled, you'll see this in your recent activity table. If you're fetching your messages to another Gmail account, a Google IP will appear; this is simply because the messages are being fetched through our servers. In addition, if you use a third party service with your Gmail service, such as social networking sites, we cannot guarantee the security of the third party service. In this case, you may consider using forwarding if possible. If not, please make sure that your account recovery details are fully up to date.
In addition, some mobile providers and internet proxies may also appear in your recent login history, and in some cases, may appear to come from a different geographic location than you are normally based in.
If you'd like to find more information than what is provided in the Last account activity section, it is Google's policy to only provide information pursuant to a valid third party court order or other appropriate legal process.
Concurrent sessions
If your mail is currently being accessed from another location, we'll list the other session(s) in the Concurrent session information table. This could mean that you simply have another browser window open with Gmail loaded, or that your home computer is logged in to Gmail while you're accessing your mail from work. If you're concerned about any concurrent access, you can sign out all sessions other than your current session by clicking Sign out all other sessions. By putting up a warning, aren’t you just signaling to the bad guys that they’ve been caught? We’ve designed the alert to only be displayed to users who have performed logins that we believe are legitimate. If we detect suspicious activity from a particular IP address, we will not show the alert to users coming from that IP address.