Design a malicious-URL checking service using an isMalicious API
Design a backend service that determines whether a given URL is malicious.
You have access to an external dependency:
isMalicious(url) -> bool(black-box API)
This external API has the following characteristics:
- Rate-limited (e.g., 1k QPS max).
- Sometimes slow (p95 500ms) or unavailable.
- Potentially costly per call.
Your service should expose an internal API, for example:
GET /reputation?url=...→ returns{ verdict: "malicious"|"benign"|"unknown", checkedAt, confidence }
Requirements:
- Low latency for repeated queries.
- Must handle high traffic (e.g., 50k QPS reads) while respecting the external API limit.
- Avoid repeatedly calling
isMaliciousfor the same URL. - Provide reasonable behavior for timeouts/outages (no cascading failures).
- Support background re-checking because reputations can change.
Explain:
- APIs and key workflows (read path, cache miss path, async refresh)
- Data model and storage choices
- Caching strategy, TTLs, and deduplication of concurrent requests
- Rate limiting / backpressure / circuit breaker strategy
- Scaling, partitioning, and reliability
- Metrics and operational concerns
AI interview prep
Core dilemma
Balancing high read throughput and low latency against the strict rate limits, cost, and potential unreliability of a critical external dependency.
3 tradeoffs and 3 stress tests locked
Interview prep
Unlock the interviewer X-Ray rubric, tradeoff matrix, stress tests, clarifying questions, and key concepts.
Design a malicious-URL checking service using an isMalicious API
Design a backend service that determines whether a given URL is malicious.
You have access to an external dependency:
isMalicious(url) -> bool(black-box API)
This external API has the following characteristics:
- Rate-limited (e.g., 1k QPS max).
- Sometimes slow (p95 500ms) or unavailable.
- Potentially costly per call.
Your service should expose an internal API, for example:
GET /reputation?url=...→ returns{ verdict: "malicious"|"benign"|"unknown", checkedAt, confidence }
Requirements:
- Low latency for repeated queries.
- Must handle high traffic (e.g., 50k QPS reads) while respecting the external API limit.
- Avoid repeatedly calling
isMaliciousfor the same URL. - Provide reasonable behavior for timeouts/outages (no cascading failures).
- Support background re-checking because reputations can change.
Explain:
- APIs and key workflows (read path, cache miss path, async refresh)
- Data model and storage choices
- Caching strategy, TTLs, and deduplication of concurrent requests
- Rate limiting / backpressure / circuit breaker strategy
- Scaling, partitioning, and reliability
- Metrics and operational concerns