ADP spam / 4.wapin.in and 173.224.209.165:

This fake ADP spam leads to malware on 4.wapin.in:

From: ADP.Security [mailto:5BC4F06B@act4kids.net]
Sent: 11 October 2012 14:22
Subject: ADP: Urgent Notification

This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.
If you have any questions, please contact your administrator for assistance.

---------------------------------------------------------------------
Digital Certificate About to Expire
---------------------------------------------------------------------
The digital certificate you use to access ADP's Internet services is about to expire. If you do not renew your certificate by the expiration date below, you will not be able to access ADP's Internet services.

Days left before expiration: 3
Expiration date: Oct 14 23:59:59 GMT-03:59 2012

---------------------------------------------------------------------
Renewing Your Digital Certificate
---------------------------------------------------------------------
1. Go to this URL: https://netsecure.adp.com/pages/cert/register2.jsp

2. Follow the instructions on the screen.

3. Also you can download new digital certificate at https://netsecure.adp.com/pages/cert/pickUpCert.faces.

The malicious payload is on [donotclick]4.wapin.in/links/assure_numb_engineers.php hosted on 198.136.53.39 (Comforthost, US).

Another variant of this goes to  [donotclick]173.224.209.165/links/assure_numb_engineers.php (Psychz Networks, US)