From what I can figure out (mostly intuition and guesses based on observation), what comes off the "TrustRank Server" is sites that are blacklisted through user submission (there is a report form in Firefox that sends it's report directly to Google) and through the crawler. One specific thing the crawler looks for is malware that is pushed to users. Supposedly this can also spot malware contained in iframes.

__________________
The best way to learn anything, is to question everything.