Personally I block anything that I can find a "window.status=" in. They are all phish as near as I can tell.
No false positives? If not, you might enter a bugzilla to get it entered as an official rule. I'd love to see your entry from local.cf.
Personally I block anything that I can find a "window.status=" in. They are all phish as near as I can tell.