Reply-To Contains Look-alike Domain

The Reply-To address closely resembles a trusted domain (e.g., paypal-support.com instead of paypal.com), deceiving recipients into responding to attackers.