Point the obvious out to me in this email

[BarkingGhostar]

Yesterday I received an email on one of my Google Gmail accounts. It is setup in Thunderbird as an IMAP account. I have [tried to] replace the actual email address with a MYGMAILADDR and hopefully I didn't forget something in order to maintain privacy. If it is obvious that I failed on this front then please let the moderator know to edit/remove accordingly.

Now, I do buy stuff from Amazon. I do have a handful of Gmail accounts. But I have never used any Gmail email accounts with Amazon. Worse yet is that when I log into Gmail via the web browser this email isn't found. I checked the trash, the spam folder, etc., and it isn't available on the online account. My IMAP server settings are to leave email there for five days, so it should have been removed until the 7th of this month.

So, how does an email originate from Amazon, know to go to a Gmail account that I've never used with Amazon (1st suspicion trigger alert), let alone not be in the Gmail Inbox online? Here is the email header information:

From - Tue Oct  2 12:27:04 2018
X-MYGMAILADDR-Key: MYGMAILADDR32
X-UIDL: GmailId1663521665f176db
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Delivered-To: MYGMAILADDR@gmail.com
Received: by 2002:adf:e78f:0:0:0:0:0 with SMTP id n15-v6csp6196433wrm;
        Tue, 2 Oct 2018 07:14:33 -0700 (PDT)
X-Google-Smtp-Source: ACcGV61UsChzHwxEbH2cY5ZnfflmhUs1Jki/HkvdYdvnUnk9J4ngXdXEIg8tEBDwyL8zsDDnCYUR
X-Received: by 2002:a37:ccd5:: with SMTP id n82-v6mr11821305qkl.16.1538489673567;
        Tue, 02 Oct 2018 07:14:33 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1538489673; cv=none;
        d=google.com; s=arc-20160816;
        b=C94uAt2mal6rpVZL6haoFv+gg5NZsxh3iZKbgpISRNnvdsBgVH7HnZAtdQVecaUcxw
         Vggon1tBiXIiwgZtqtyXNkclNzM+5ssXiKDYWCgF8Rg3jR9mjg+XkGJ4R11Ikjnyvs/8
         Hr9lMSsNga9o+L3jt3PF6IGuyoUGG57/lyQj7VvDSiKJ8SdwCOf9GcjR1fBAJ+3pajoL
         qCYmQfz1usqb9q4VnCkVhKQ8aMyMuJcrl/u07DCXAbqek4GyXl53YUGfEzIvYvrbmfae
         T6lkS/500x0CGn3a9M6813uNl4GFd57hdFAwONYWi8QXFPRGz4dWDyfs4PxZW4nla2WZ
         lk+g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=feedback-id:date:bounces-to:mime-version:subject:message-id:to
         :reply-to:from:dkim-signature:dkim-signature;
        bh=PBgNaFEjOUgfbLKO8yIUjZA4MhJ9ZaQHsn/R1ybVkPw=;
        b=vI8nUHFWmOn7cKIMuPU1J1slyBD3RlH7TWF2TSfxwzK8Oogia+Bt8+25wGK1vLz+mi
         chLK6TjDVGC5mnm6lsWjLpJFx1AaOLloUKvx3gS0zZZYYsNgVDzSnDavB+guNqCA1hnO
         Q3bfraO88PKaoHtbJYP5YXrX+3Pe42f6KmIKVV1+N1VG2YUu5OvJ2eV/RjWshctKg9kf
         qH3Rou3A6J8JGcAXPhQbeTdca32l2TCPgg2BjElNyvcN4lG4NZXBHa9oQN7NdJ60771t
         tADUpmP+V0iHSSbJQrEW2mY+9EI8Ux0Dgx+eCw6l2qakNZdQKYaKIguKnNBetJBq2JuD
         YuLw==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@amazon.com header.s=eaxkvsyelrnxjh4cicqyjjmtjpetuwjx header.b=WFi5BQjF;
       dkim=pass header.i=@amazonses.com header.s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug header.b=cyMhOa5r;
       spf=pass (google.com: domain of 20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com designates 54.240.13.80 as permitted sender) smtp.mailfrom=20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.com
Return-Path: <20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com>
Received: from a13-80.smtp-out.amazonses.com (a13-80.smtp-out.amazonses.com. [54.240.13.80])
        by mx.google.com with ESMTPS id q16-v6si248002qtn.295.2018.10.02.07.14.33
        for <MYGMAILADDR@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
        Tue, 02 Oct 2018 07:14:33 -0700 (PDT)
Received-SPF: pass (google.com: domain of 20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com designates 54.240.13.80 as permitted sender) client-ip=54.240.13.80;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@amazon.com header.s=eaxkvsyelrnxjh4cicqyjjmtjpetuwjx header.b=WFi5BQjF;
       dkim=pass header.i=@amazonses.com header.s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug header.b=cyMhOa5r;
       spf=pass (google.com: domain of 20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com designates 54.240.13.80 as permitted sender) smtp.mailfrom=20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=eaxkvsyelrnxjh4cicqyjjmtjpetuwjx; d=amazon.com; t=1538489672;
    h=From:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type:Date;
    bh=xJBI5SsRioIMTFgrF8Dxu0ACOd9yfg59xy4/9DvrC1A=;
    b=WFi5BQjFx4TUvFTLd35fC+tL8iP1RSZu00JOFaOS+HpSZG4HpmMS1sttBU7RZZKi
    09hS4coURRq3J3yuM47rwZRBXWDq9nj14RJtbFgkqhif058SyRniz9tS8wfzU8Rqpg3
    iDF5hq5HCpfqX2eVt+VHaMoPb3BYJgILgx9qHuuo=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1538489672;
    h=From:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type:Date:Feedback-ID;
    bh=xJBI5SsRioIMTFgrF8Dxu0ACOd9yfg59xy4/9DvrC1A=;
    b=cyMhOa5rdd66TxWmwmUA6IQvAjxPkPlIBAV4HP8pRejTI8gpmf9ZArT34h3ai9mf
    qoRlHSDxo2t19nMXN0BOizVntwFep6rQVAZIxwfWDgwgInuG6LPDSgUCHf3k2XKQaFK
    kXVC1p6bZ8LLXkshR71gXLw5gDQg52G202fkjr8g=
From: Amazon <no-reply@amazon.com>
Reply-To: Amazon <NqsXu_no_reply@amazon.com>
To: MYGMAILADDR@gmail.com
Message-ID: <010001663521643a-95030eec-b31e-49ce-8dbc-2a3cb48bc828-000000@email.amazonses.com>
Subject: Amazon wants you to see this item at Amazon.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_Part_1251821_997791209.1538489672664"
X-AMAZON-MAIL-RELAY-TYPE: notification
Bounces-to: 20181002141432d11ab8a12f014302a106dd7dc750p0na@bounces.amazon.com
X-AMAZON-METADATA: CA=C8HYYFBED0G5T
X-Original-MessageID: <urn.rtn.msg.20181002141432d11ab8a12f014302a106dd7dc750p0na@1538489672665.rtn-svc-na-back-m4l1a-9a1d41cd.us-east-1.amazon.com>
Date: Tue, 2 Oct 2018 14:14:32 +0000
X-SES-Outgoing: 2018.10.02-54.240.13.80
Feedback-ID: 1.us-east-1.ZHcGJK6s+x+i9lRHKog4RW3tECwWIf1xzTYCZyUaiec=:AmazonSES

------=_Part_1251821_997791209.1538489672664
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Amazon sent you a message via Amazon

    
        I thought you might be interested in this page from Amazon.

 

[sourceninja]

That came from amazonses, which is the AWS email delivery service. It could be from anyone who uses AWS. So probably some strange phishing attempt.

 

[BarkingGhostar]

Ah, thanks for pointing that out. I figured as much.

 

[BarkingGhostar]

Still, this doesn't explain why when I logged into Gmail's website yesterday this specific email wasn't there. Does Gmail remove delivered email if it later decides it was a mass spam or phishing attempt?

 

[Plar]

I would seriously think about creating a new mail. You keep all levels of protection, but it remains unsafe for you.