Pharming redirects users to a false destination despite an expected address. Unlike classic phishing, the victim need not click a fraudulent link: manipulated name resolution, routers or local settings cause a correctly typed domain to point to an attacker's server.
How does pharming work?
| Attack point | Method |
|---|---|
| Local hosts file | Malware adds a false IP address for a known domain on the endpoint. |
| Router or DHCP | Changed DNS settings distribute an attacker-controlled resolver to devices. |
| DNS cache poisoning | A resolver stores a forged mapping and serves it to many users. |
| Compromised DNS account | Attackers alter authoritative records or nameservers at the provider. |
| Rogue access point | A malicious wireless network redirects DNS or web traffic to false services. |
The false site imitates a login or payment page. Without a valid certificate the browser should warn. Attackers therefore try to persuade users to bypass warnings, force HTTP or obtain a genuine certificate after compromising domain or DNS management. A certificate proves control of the visited domain, not the business legitimacy of its content.
How do pharming and phishing differ?
Phishing persuades a person through a message or page to open a false destination or disclose data. Pharming manipulates the technical route to the destination. They can be combined and both may use a copied site. Domain squatting generally uses another lookalike domain; pharming can resolve the genuine spelling to a false IP.
What warning signs exist?
- A certificate, HSTS or hostname warning on a normally familiar website.
- Multiple devices on the same network show the same unusual page or redirect.
- DNS answers differ unexpectedly between the local resolver, mobile data and a trusted external comparison.
- Router DNS, hosts file, browser proxy or network profile changed without a known reason.
- A service unexpectedly asks for new credentials, certificate exceptions or software installation despite the correct address.
How is pharming prevented?
- Never bypass TLS certificate warnings and use HSTS for domains that fully support HTTPS.
- Patch routers and resolvers and protect router and registrar accounts with unique credentials and MFA.
- Operate DNSSEC correctly and use validating resolvers, including secure key and registrar processes.
- Monitor unauthorized changes to DNS, nameservers, certificates and router configuration.
- Harden endpoints against malware and detect changes to hosts files, proxies and DNS configuration.
- Phishing-resistant MFA further reduces the value of a copied login page.
What should happen when pharming is suspected?
Do not enter credentials or add a certificate exception. Isolate the affected device or network and record domain, resolved IP, resolver, certificate and time. Comparison over an independent network helps separate local from authoritative manipulation. Inspect router, endpoint, DNS provider and registrar. Replace submitted credentials and revoke sessions from a trusted device.
Thank you for your feedback! We will review it and optimize this content.