My work web filter is blocking it as well due to "newly registered and observed domains", but I don't think Google should be using that as a heuristic.

It is very common for malware to use recently registered addresses. They absolutely should be using it as a heuristic.

Yeah fair, I guess I should've said they shouldn't be weighting it so strongly in the heuristic (if that's even at play in this case).