AR uses URL-based tactics to see if the site uses malware, and also check links and files.
Says Jeb Haber, the program manager lead for SmartScreen says:
Using reputation helps protect users from newly released malware programs - pretending to be legitimate software programs - that are not yet detected by existing defense mechanisms.
Reputation also enables IE9 to remove unnecessary warnings for downloads with an established positive reputation. Both publishers and individual applications build reputation. For example, a digitally signed application from a well-known publisher that has been widely downloaded has a better reputation than an unsigned application that has not yet been downloaded widely and has just been posted on a newly created Web site.
Furthermore, the manager adds:
From our experience operating these services at scale, we have found that 1 out of every 14 programs downloaded is later confirmed as malware.