Evolution1 spam / 69.194.194.221

I haven't seen this spam before, it leads to malware on 69.194.194.221:

Date:      Mon, 01 Oct 2012 15:44:59 +0200
From:      "INTUIT" [D6531193@familyhealthplans.com]
Subject:      Information regarding Employer Contribution



INTUIT





Attn: Account Holder



You can view the information about all Employer contributions that are due to be made on 2/1/2012 by visiting the following link:



http://intuithealthemployer.lh1ondemand.com



Please let us know employment alterations on your enrollment spreadsheet within the period of two business days. The foregoing report shows the ACH amount we will withdraw from your bank account for the contributions on the first business day of the month. Please remember, if changes occur, this may affect the ACH amount.



Intuit Health Debit Card Powered by Evolution1 Employer Services.



This is a system generated email. Please do not respond.



� Copyright, Evolution1, Inc. 2004-2012,

ALL RIGHTS RESERVED

Powered by Lighthouse1TM, a product of Evolution1TM

The malicious payload is on 69.194.194.221 (Solar VPS, US) which is the same IP as found in this attack.