In one embodiment, a device in a network classifies Internet content data using one or more classifiers to identify a plurality of content classes for the content data. Each content class has a corresponding classification score based on the classification. The device determines whether any of the classification scores exceed a threshold level. The device identifies a set of content groups, where each of the plurality of content classes is associated with one of the content groups. The device associates the content data with a selected one of the content groups based on a determination that the classification scores for the plurality of content classes do not exceed the threshold level.