I'm not sure how many people that would work for. If malicious.example.com were some pithy little domain on a trendy ccTLD like bit.ly, I think most twitter users would ignore it, assuming it was yet another URL shortener.

This is probably the only viable choice other than randomizing user agents, which is dicey enough on its own.