The report describes an "in-the-cloud reputation-based system" for identifying URLs leading to malicious downloads (called "socially-engineered malware" in the

The report describes an "in-the-cloud reputation-based system" for identifying URLs leading to malicious downloads (called "socially-engineered malware" in the report). "From an initial list of 12,000 new suspicious sites, 1,756 potentially-malicious URLs were pre-screened for inclusion in the test ... Of the initial 1,756 URLs, ultimately 562 URLs passed our post-validation process and are included in the final results" Since they don't describe their pre-screening or "post-validation" process anywhere in the report, you can't assume it's a completely random set of malicious URLs. In fact, the URLs they tested might have been cherry-picked to give IE8 a higher score.