[krisoft]

Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots.

You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc

[bell-cot]

Disagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information.

(Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)

[JamesBarney]

A bad actor can do the same thing by putting together

Mybadpage1.com

Mybadpage2.com

Mybadpage3.com

[BoorishBears]

Except if you're a malicious actor you can also do:

msscanninghoneypot1.com

msscanninghoneypot2.com

msscanninghoneypot3.com

You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that...

edit: missed that multiple replies cover this