And about 30 minutes ago, they switched the reddit post to flaired user only for comments.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Not sure if this post even qualifies to be on hacker news...its all rumors and any attempt to distill the incident to its facts is met with pushback.

They've added a comment explaining what they saw, with the offending URL. It's indeed archive.today itself sending visitors to the malware download site.