Avira that's for sure.. it is in fact a server for the Blackhole Exploit Kit.
This site is hosted on 220.127.116.11, an Iomart / Rapidswitch IP that appears to have been reallocated to:
person: Dimitar Kolev
address: QHoster Ltd
address: Apt 1859
address: Chynoweth House
address: Trevissome Park
address: TR4 8UN
source: RIPE # Filtered
Trevissome Park is a small business park in Cornwall, there certainly isn't a building with over 1000 apartments there, so we can assume that "Apt" is a euphemism for a post box. There's also no company in the UK called QHoster Ltd. In fact, if we check the QHoster.com domain we can see that it is a Bulgarian firm:
Dimitar Kolev (firstname.lastname@example.org)
27 Nikola D. Petkov Str.
QHoster has an IP block of 18.104.22.168/25 suballocated to it. A quick poke around indicates not much of value in this range, you may want to consider blocking the /25 as a precaution.