Most of the existing methods used to detect phishing threats rely on a predefined set of features, which can limit their flexibility and robustness. In this article, we proposed a mathematical model for detecting and preventing phishing attacks using functioning tables. The process modeling includes the steps of data processing, URL classification, and decision making to block phishing sites. Within the framework of the proposed model, a functioning table has been developed, which is a formalized tool for analyzing parallel processes in the phishing prevention system. The mathematical formalization of functioning tables is based on components such as positions, transitions, arcs and arc weight function. These elements model the various stages of data processing, including URL collection, preprocessing, URL feature extraction, training a machine learning algorithm, applying classification, and blocking phishing pages. The incidence matrix, which is the basis of the functioning table, establishes a relationship between positions and transitions, determining which stages depend on others. For each stage of the process, the corresponding places and transitions are specified, as well as the weight coefficients of the arcs that reflect the number of markers transferred between the system states. The model allows tracking how data passes through the system, starting from URL collection to taking action to block a phishing resource. Analyzing data in real time and listening to user feedback can also improve the performance and reliability of threat prevention systems by reducing response times and false positives. This approach will improve the overall effectiveness of cybersecurity measures against phishing attacks.