Attacker-Controlled Sending Domain

The domain the message came from, the part after the @, was registered, bought, or run by attackers. Owning a domain lets them set up the checks that confirm who sent a message, so their emails can pass.