And about 30 minutes ago, they switched the reddit post to flaired user only for comments.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Not sure if this post even qualifies to be on hacker news...its all rumors and any attempt to distill the incident to its facts is met with pushback.
They've added a comment explaining what they saw, with the offending URL. It's indeed archive.today itself sending visitors to the malware download site.
I see that now too!