1. A computer-implemented method for detecting suspicious web pages, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a plurality of malicious web pages; training a classification model for identifying suspicious web pages that comprises one or more classification algorithms using: features of the plurality of malicious web pages; features of a web-page link graph that comprises at least: a plurality of nodes, wherein each node within the plurality of nodes represents one of the plurality of malicious web pages; a plurality of edges that join the plurality of nodes and that represent links between web pages represented within the web-page link graph, wherein the one or more classification algorithms are configured to classify web pages as suspicious; identifying a website after the classification model has been trained; classifying a first web page of the website and a second web page of the website as suspicious using the classification model; determining that a probability of maliciousness of the first web page is greater than a probability of maliciousness of the second web page; in response to classifying the first web page and the second web page as suspicious and based at least in part on the probability of maliciousness of the first web page being greater than the probability of maliciousness of the second web page: selectively applying heavy analysis to the first web page and the second web page in order to conserve system resources of a monitored computer environment by: executing the first web page within the monitored computer environment to determine whether the first web page is malicious; refraining from executing the second web page within the monitored computer environment to determine whether the second web page is malicious; detecting a malicious behavior of the first web page resulting from executing the first web page; classifying the website as malicious based on detecting the malicious behavior of the first web page; when the website is classified as malicious, updating the classification model by updating the web-page link graph and the one or more classification algorithms based at least in part on the website having been classified as malicious.
11. The computer-implemented method of claim 1 , wherein updating the one or more classification algorithms comprises using the first web page to retrain at least one of the one or more classification algorithms.