Unless I know for sure that it is legit, I mark anything that comes through with a rave and a .php suffix as a phishing mail.