1. A data processing method providing an improvement in computer security, comprising: selecting a uniform resource locator (URL) for classification wherein the selected URL is associated with a webpage; determining a URL risk score for the selected URL; comparing the URL risk score to a URL risk threshold; in response to determining that the URL risk score exceeds the URL risk threshold, determining a maliciousness risk score for webpage content associated with the selected URL by retrieving the webpage content associated with the selected URL; extracting one or more content features from the webpage content, the one or more content features comprising a value that represents a text-to-image ratio of the webpage content and analyzing the webpage content by applying a content classifier to the one or more content features and to the URL risk score; comparing the maliciousness risk score to a maliciousness risk threshold; classifying the URL based on the comparison between the maliciousness risk score and the maliciousness risk threshold, wherein: in response to determining that the maliciousness risk score exceeds the maliciousness risk threshold, classifying the URL as malicious; and in response to determining that the maliciousness risk score does not exceed the maliciousness risk threshold, classifying the URL as benign; tracking the maliciousness risk score for the URL over time as webpage content of the URL changes over time; recording changes to the maliciousness risk score as they occur; generating and transmitting a notification regarding a change to a maliciousness risk score via any of device notifications, instant messages, social media updates, emails to third party user computers.