It's probably that that their software to crawl through sites has identified some sort of pattern of behavior that seems suspicious -- perhaps links or references to sites that were known to have malware or perhaps some suspicious-looking scripting.