It's more like a reverse proxy. [1] You point your domain to their DNS, and then they cache your site on their CDN, reducing loading times and CPU consumption.

It also uses data from Project Honeypot to serve captchas and links to popular virus scanners to people who are listed as having a blacklisted IP addresses in Project Honeypot, the idea being that they're probably using a zombie computer and launching attacks without them knowing it. By raising their awareness that they've been listed, they're more likely (hopefully) to remove their malware.

[1] http://en.wikipedia.org/wiki/Reverse_proxy