Perhaps you meant an image-based classifier, though in this case Pharoah2's objection about speed is an insurmountable issue even on an enterprise server, since classifying a website on a CPU would take many seconds; on a GPU it would probably be several hundred milliseconds, which is a few hundred milliseconds too many!
They are not easily gamed either: they learn features as convolutional filters over the characters. These filters are more powerful than ngrams, as complex as the filters you may have seen for images.
Now, about gaming the nets, there's an issue, which is the same as for image-based CNNs: some combinations of letters (or pixel) do exist that do not make a difference to the eye, but push the classifier into the wrong class. However, in order to find these combinations, having a first-hand on the underlying neural net and its weights is mandatory.
EDIT: of possible interest is that these models output a probability and possibly a confidence of having a URL blocked. Base on these, an blocker could ask for confirmation.
Also, the neural net occupies something like 1.2 gigs of RAM, and something like 3 gigs of GPU memory.
The character-based net reads the URL, not the website. The common alphabet used in the model made public is of size 69, URL length can be for example 256.
Not only this is below the image size you are talking about, but after the first convolution the alphabet (in one-hot vector encoding) is collapsed, which leaves convolutions across length 256 in 1D.
Not that terrible. In proxy-like territory, passing batches of URLs to the GPUs could pave the way to new ad-blockers at large. To be tested :)