Problem Statement: Phishing Link Detection at Scale
Problem Statement: Phishing Link Detection at Scale — phishing detection system design section.
Problem Statement: Phishing Link Detection at Scale
Enterprise security teams need deterministic, explainable decisions on billions of links embedded in email and chat—not opaque block lists that break payroll and investor updates.
Design anchors (1)
- Intercept email, chat, and webmail HTML before users click weaponized URLs.
- Combine fast reputation lookups with selective headless-browser sandbox for unknown destinations.
- Support link rewriting so every click passes through a policy-enforced reverse proxy.
Failure drills
If threat-intel feed stalls, continue with cached tiers but downgrade unknown links to WARN+rewrite instead of ALLOW. If sandbox pool is saturated, enqueue with SLA 30s and hold message delivery for high-risk tenants only.
Cost and capacity
| Signal | Target |
|---|---|
| Enterprise tenants | 12K |
| Inbound links/day | 2.4B |
| Peak link/s | 85K |
| Target scan p95 | 120ms |
1 public record LinkObservation(String urlHash, String tenantId, Instant seenAt) {}
1 def registrable_domain(host: str) -> str: 2 return host.split(".")[-2:] # simplified eTLD+1
1 export interface PhishingContext { channel: "email" | "chat"; tenantId: string; }
Deep dive notes
Phishing kits rotate faster than batch intel feeds. Combine delivery-time reputation with click-time rewrite so a link that was benign at SMTP accept cannot silently harvest credentials later. Appeals must reference immutable ledger rows keyed by policy hash—SOC analysts need to answer why a CFO's wire-transfer email was quarantined without hand-waving.
Operational guardrails
Shadow new rules for 48 hours logging would-block counts. Auto-disable any rule whose FP rate exceeds tenant budget within a sliding hour. Never stamp high-cardinality URL paths into metrics labels; aggregate per tenant and per verdict tier only.
Why interviewers care
Phishing Detection interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.
Interview checkpoint
Name one failure story for Problem Statement: Phishing Link Detection at Scale that proves you understand real outages, not happy-path diagrams.
Key Highlights
- •Intercept email, chat, and webmail HTML before users click weaponized URLs.
- •Combine fast reputation lookups with selective headless-browser sandbox for unknown destin
- •Support link rewriting so every click passes through a policy-enforced reverse proxy.
Section Rescue Kit
Buzzwords to use:
Safe statements:
- "For Problem Statement: Phishing Link Detection at Scale, I would quantify p95 scan latency and sandbox lag before naming vendors."
- "If time is short, I will sketch normalize → reputation → optional sandbox → rewrite."