No, it most probably wasn't a "killswitch" but a sandbox test environment detection mechanism. Inside the box the virus could decide to stay silent & invisible. Since they mostly just intercept, but apply no intelligence (if the contacted domain exists or not)
And even worser, since that domain got flagged as "beeing malware related" many antivirus programs DO BLOCK IT SO ***aaaaargh*** making the virus spread again, since the antivirus hides the existence of that distinct domain from it.
You could spin in your grave it's all so overly stupid a true security nigthmare
So to mitigate the risk they block the website, damn! How on earth are they going to stop the 1000's of versions of this malware that might come
from this, if this is the method they are going to use? I also have my doubts if this blogger is not in one way or the other involved in this. The
timing of this, when the price of Bitcoin skyrocketed.. is also very suspicious.