Not neccessarily, I wouldn’t be that quick to blame them. The server/domain might have been infected because of an outdated sw or other security breach, and according to my statistics, this is much more likely.
Makes sense. Thanks for fixing the problem for me! 8)