A method, comprising: receiving, at a gateway, a request for accessing a network accessible page from an end-user device; processing the network accessible page to generate a first embedding (112A, 112B, 112C) that characterizes network attributes of a domain of the network accessible page, and a second embedding (112A, 112B, 112C) that characterizes content attributes of the network accessible page; generating, from the first embedding (112A, 112B, 112C), a first score (122A, 122B, 122C) that characterizes a predicted similarity between the network accessible page and one or more known network accessible pages; generating, from the second embedding (112A, 112B, 112C), a second score (122A, 122B, 122C) that characterizes a predicted likelihood that the network accessible page is asking for sensitive information; processing the network accessible page to generate a third embedding (112A, 112B, 112C) that characterizes visual attributes of the network accessible page; generating, from the third embedding (112A, 112B, 112C), a third score (122A, 122B, 122C) that characterizes a predicted similarity between the network accessible page and one or more known network accessible pages that ask for sensitive information; and using at least the first score (122A, 122B, 122C), the second score (122A, 122B, 122C), and the third score (122A, 122B, 122C) to determine a classification of the network accessible page, the domain of the network accessible page, or both, wherein using the first score, the second score, and the third score (122A, 122B, 122C) to determine the classification of the network accessible page comprises: computing a weighted combination of the first score, the second score, and the third score (122A, 122B, 122C); and comparing the weighted combination with a neighborhood similarity score. receiving, at a gateway, a request for accessing a network accessible page from an end-user device; processing the network accessible page to generate a first embedding (112A, 112B, 112C) that characterizes network attributes of a domain of the network accessible page, and a second embedding (112A, 112B, 112C) that characterizes content attributes of the network accessible page; generating, from the first embedding (112A, 112B, 112C), a first score (122A, 122B, 122C) that characterizes a predicted similarity between the network accessible page and one or more known network accessible pages; generating, from the second embedding (112A, 112B, 112C), a second score (122A, 122B, 122C) that characterizes a predicted likelihood that the network accessible page is asking for sensitive information; processing the network accessible page to generate a third embedding (112A, 112B, 112C) that characterizes visual attributes of the network accessible page; generating, from the third embedding (112A, 112B, 112C), a third score (122A, 122B, 122C) that characterizes a predicted similarity between the network accessible page and one or more known network accessible pages that ask for sensitive information; and using at least the first score (122A, 122B, 122C), the second score (122A, 122B, 122C), and the third score (122A, 122B, 122C) to determine a classification of the network accessible page, the domain of the network accessible page, or both, wherein using the first score, the second score, and the third score (122A, 122B, 122C) to determine the classification of the network accessible page comprises: computing a weighted combination of the first score, the second score, and the third score (122A, 122B, 122C); and comparing the weighted combination with a neighborhood similarity score. computing a weighted combination of the first score, the second score, and the third score (122A, 122B, 122C); and comparing the weighted combination with a neighborhood similarity score.