One reason it can look legit is it asks to update your account billing info, and if you go into your Google panel to change or update, it has blank fields... They look as if they need to be updated.
> it looks EXACTLY like a Google mail. But, rollover the link and sure enough it goes to some .cn domain. Be careful, people!
I got three. But none of them show .cn on the rollover. When I click on them, it doesn't go to a .cn URL; it goes to google.com.
One of the emails shows a yahoo.com return address. One of the servers is listed as in Romania.
It looks kind of weird with three emails all from "Google" for the same purpose, but each one with a different subject line.
Update Your Billing Information
Please Re-activate your account
Please Update Your Billing Information
They had these URLs:
Did they forget to change them to .cn? Or are they mixing legit links in with forgeries, hoping they'll get lucky with one of them?