I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with
.php at the end.
I was asking myself why they might use a PHP script instead of just faking the look of the given page and submitting entered data to a form.
Or am I not able to access the PHP file, as it is executed by the server?
Are there other ways of analyzing this file and its behavior without any danger?