We use Fortinet (bleh) and it uses a database (ICAN I thought) that ranks sites based on content.

If a site uses the word(s) hack, hacking etc, it gets rated as a hacking site.