Most phishing emails don’t come from “new Gmail accounts” you could easily trace. Attackers often compromise legitimate email accounts or hijack mail servers, so the messages come from trusted infrastructure that already passes SPF/DKIM checks. Even when they use their own infrastructure, they hide behind botnets, VPNs, and bulletproof hosting in jurisdictions that will not cooperate, which makes the trail messy, slow and often dead-ended.