ADP Spam / 108.61.57.66

There's masses of ADP-themed spam today. Here is another one:

Date:      Thu, 11 Oct 2012 14:53:17 -0200
From:      "ADP.Message" [986E3877@dixys.com]
Subject:      ADP Generated Message

This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.

If you have any questions, please contact your administrator for assistance.


---------------------------------------------------------------------

Digital Certificate About to Expire

---------------------------------------------------------------------

The digital certificate you use to access ADP's Internet services is about to expire. If you do not renew your certificate by the expiration date below, you will not be able to access ADP's Internet services.

Days left before expiration: 3

Expiration date: Oct 14 23:59:59 GMT-03:59 2012

---------------------------------------------------------------------

Renewing Your Digital Certificate

--------------------------------------------------------------------

1. Go to this URL: https://netsecure.adp.com/pages/cert/register2.jsp

2. Follow the instructions on the screen.

3. Also you can download new digital certificate at https://netsecure.adp.com/pages/cert/pickUpCert.faces.

In this case the malicious payload is at [donotclick]108.61.57.66/links/assure_numb_engineers.php  hosted by Choopa LLC in the US. The IP is probably worth blocking to be on the safe side.