This is the proof it was a malware domain:
http://wepawet.iseclab.org/domain.php?hash=1a0e1f0af7b01bf5a4d8394852f87b7f&type=js

polonus