The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.