# Design a phishing URL detection system: system design interview question

> Fast URL reputation checks with sparse evidence, hostile pages, changing campaigns, and costly false alarms.

Source: https://sysround.com/questions/design-phishing-url-detection-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a service that classifies URLs and websites as safe or potentially malicious. It must detect new phishing campaigns and answer reputation checks quickly."

## What to clarify first

- Clients and verdicts
- Traffic and read:write ratio
- Latency and availability
- Discovery and detection delay
- Scan budget
- Consistency and freshness
- Error costs
- Retention and record sizes
- Deployment and page access
- Scope boundaries

## Scope of a strong answer

Core requirements:

- Return a URL verdict with its age and reasons.
- Inspect new URLs and inspect known URLs again when their evidence expires.
- Detect new phishing campaigns across related URLs and websites.
- Distribute verdict changes and corrections to the services that answer reputation checks.

Usually out of scope:

- Train a complete machine learning model.
- Analyze full email messages or downloaded programs.
- Decide how browsers and mail clients enforce verdicts.
- Inspect pages that require a user account.

## What interviewers probe

### New phishing campaigns

New campaigns have no reputation history. Attackers change URLs faster than the service can inspect every page.

### URL and website identity

Small URL differences can change page behavior. A broad website verdict can also harm unrelated pages or tenants.

### Page inspection

The service must execute hostile page content without exposing its own network, credentials, or scan capacity.

### Verdict changes and mistakes

A false verdict can affect millions of checks before correction. Late results and stale regions can restore an obsolete decision.

## Common mistakes

- Treats unknown URLs as safe because no threat feed lists them.
- Places page fetches and browser scans on the synchronous check path.
- Uses broad domain verdicts without support for shared hosts or compromised pages.
- Trusts hostile pages with network access or service credentials.
- Ignores scan selection when measuring detection quality.
- Provides no correction path for false positives or stale verdicts.

## The bar by level

- **Senior:** Budgets scan capacity and defines URL identity. Detects related campaigns. Handles hostile fetches, versioned updates, cache freshness, and false-positive corrections.
- **Staff+:** Defines guarantees during partitions and source compromise. Controls adversarial scan demand. Measures selection bias and detection delay. Quantifies correction speed and cost trade-offs.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=phishing-url-detection


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.