A message is spam at 5 points and rejected at 15. Each test below adds or removes points; the result lists the ones that fired.
Change the thresholds with threshold and rejectThreshold. Change points with scores, either by setting key (scores: {deceptiveLink: 4}) or by test name, which fixes that test's points (scores: {FROM_NAME_BRAND: 4}).
The classifier's spam probability, on a log-odds scale: 2.4 points at 90%, 5 at 99% and 6.25 at 99.9%, so the classifier marks spam on its own only when it is at least 99% sure. The name gives the band: BAYES_999 is 99.9% or more, BAYES_99 99% to 99.9%, BAYES_50 40% to 60%. Setting keys bayesHam and bayesSpam set the two ends.
A link's domain imitates a brand with lookalike or swapped characters
MIXED_SCRIPT_DOMAIN
3
mixedScriptDomain
A domain label mixes alphabets
BRAND_IN_DOMAIN
1.5
brandInDomain
A brand name inside someone else's domain
TYPO_DOMAIN
1
typoDomain
One letter away from a brand's domain
DECEPTIVE_LINK
3
deceptiveLink
A link shows one address and goes to another
MALICIOUS_DOMAIN
6
maliciousDomain
Cloudflare's malware resolver blocks a linked domain
ADULT_DOMAIN
2
adultDomain
Cloudflare's family resolver blocks a linked domain
URIBL_<LIST>
5
uriblListed
A linked domain is on a domain blocklist, for example URIBL_DBL
Domains only named in the text, not linked, are checked for lookalikes too, but count only when they plainly imitate a brand: lookalike letters, or swapped characters for a brand of five letters or more. A reply or signature may name any site, and a company may have a short name one character from a brand's.