1. A computer-implemented method for detecting malicious content, comprising: under the control of one or more computer systems configured with executable instructions, generating a plurality of document object model snapshots wherein: the plurality of document object model snapshots comprises a first snapshot from a first webpage and a second snapshot from a second webpage, the first webpage and the second webpage identified via different domain names; and each document object model snapshot of the plurality of document object model snapshots represents a logical structure of one or more node elements of a respective webpage; generating a document object model template based at least in part on the plurality of document object model snapshots, the document object model template specifying a logical structure of permissible web content, the logical structure of the permissible web content including a plurality of node elements, the document object model template further specifying a node type associated with one or more node elements of the plurality of node elements and a hierarchal relationship between the plurality of node elements, generating the document object model template including: analyzing the plurality of document object model snapshots to identify commonalities between the first snapshot and the second snapshot; and incorporating the identified commonalities in the document object model template; and sending the document object model template to a user device for use in evaluating further web content.