1. A method of classifying web content, implemented on one or more computer processors, the method comprising: using at least one of the processors, receiving a request for a web page from a workstation over a computer network; using at least one of the processors, determining a first property associated with content of the web page, the first property comprising static content associated with the web page; using at least one of the processors, determining a second property associated with the content of the web page based at least in part on information determined via execution of active content associated with the web page in a sandbox environment; using at least one of the processors, evaluating a logical expression relating the first property and the second property, at least in part by evaluating whether a constant value matches at least a portion of the content of the web page; using at least one of the processors, associating the web page with a category based on a result of the evaluation; determining whether to allow or block network access to the web page based on the category; sending the request for the web page to the Internet in response to determining the network access is allowed; and blocking the request for the web page in response to determining the network access is blocked.