[wolrah]

This assumes the bad actor only put one thing there. If they put multiple things there they don't know what was detected unless told.

[JamesBarney]

But if a bad actor wants to know what's detectable they can just put each malware on separate domains.