Pharming
An attack that redirects victims from a legitimate website's correct address to a fake copy of it by tampering with DNS resolution or a local hosts file, so even a correctly typed address lands on the attacker's page.
Definition
Pharming is an attack that redirects a victim from the legitimate website they intend to visit to a fake, attacker-controlled copy of it, typically by poisoning a DNS resolver's cache with false records or by planting malware that alters the victim's local hosts file, or by hijacking a router's DNS settings. Unlike phishing, no suspicious link or message is required: because the redirection happens at the network or name-resolution layer, even a victim who types the exact correct web address or uses a trusted bookmark can still land on the fake site.
Pharming relies on one of a few technical vectors: DNS cache poisoning corrupts a resolver's stored records so lookups for the real domain return an attacker's IP address instead of the legitimate server's; malware planted on a victim's device edits the local hosts file, a system file that overrides normal DNS lookups for specific domains; and router-level DNS hijacking changes a compromised home or office router's DNS settings so every device on that network is silently redirected. In each case, the victim's browser still displays the correct domain name in the address bar, since the deception happens in how that name resolves to an IP address, not in the address itself.
This makes pharming meaningfully different from and, in some ways, harder to catch than phishing: the usual advice to scrutinize a link or sender before clicking does not apply, since no deceptive link is involved at all. The one reliable visible warning is usually a browser certificate warning, since an attacker rarely holds a valid TLS certificate for the domain they are impersonating, so a mismatch or warning appears even though the address bar itself looks correct. Online banking and e-commerce customers are common targets, and any user on a network with a compromised router or an unenforced, unencrypted DNS resolution path is potentially exposed, a real concern anywhere ISP or corporate DNS security practices lag.
Defenses operate mainly at the infrastructure and endpoint level rather than through link scrutiny: DNSSEC cryptographically validates DNS responses so poisoned records can be detected and rejected, keeping router firmware updated and changing default administrator credentials closes off common router-hijacking vectors, and reputable endpoint protection can detect malware that attempts to modify a hosts file. Organizations should also use trusted, security-hardened DNS resolvers on corporate networks, and every user, employee or customer, should be trained to never dismiss a browser certificate warning, even on a site they visit and trust routinely, since it is often the only visible sign that something is genuinely wrong.
At a glance
- Severity
- High
- Prevalence
- Uncommon, but high-impact
- Primary targets
- Online banking and e-commerce customers, and any user on a compromised network or router
How it works
- 1
Vector selection: an attacker poisons a DNS resolver's cache, hijacks a router's DNS settings, or plants malware that edits a victim's local hosts file.
- 2
False resolution: when the victim's device looks up the real domain, it now resolves to the attacker's IP address instead of the legitimate server.
- 3
Silent redirection: the victim types the correct address or uses a saved bookmark, but their device sends them to a fake site without any suspicious link involved.
- 4
Convincing fake site: the fake page closely mimics the real login page, harvesting whatever credentials or payment details the victim enters.
- 5
Certificate mismatch: because the attacker rarely controls a valid certificate for the real domain, the browser typically shows a certificate warning, often the only visible sign something is wrong.
Warning signs
- A browser certificate warning on a site you visit regularly and normally trust
- A familiar login page that looks slightly different, asks for unusual extra details, or behaves oddly
- Unexpectedly different site behavior right after a network or router change
- Other devices on the same network reporting similar login problems around the same time
- Unexplained changes to your router's DNS settings
How to defend
- Never dismiss or click through a browser certificate warning, even on a site you trust
- Change default router administrator credentials and keep router firmware updated
- Use DNSSEC-validating, reputable DNS resolvers, especially on corporate networks
- Run reputable endpoint protection that can detect hosts file tampering and DNS-hijacking malware
- Verify unusual login prompts through a second channel, such as a known mobile app, before entering credentials
- Watch for reports of unusual login issues affecting multiple users on the same network
Real-world example
An employee at an Indonesian retailer works from a coffee shop whose router has had its DNS settings quietly changed by malware. When she types her bank's correct web address to check a balance, the router silently redirects her to a fake copy of the login page. Her browser flags a certificate warning, which she has been trained to never ignore, so she closes the page and reports it to her security team instead of entering her credentials.
How Claro helps
Claro's awareness content teaches employees and customers that a certificate warning or an unexpectedly different-looking login page on a familiar, correctly typed address is still worth stopping for, since technical redirection attacks like pharming can defeat address-bar vigilance alone, and reported warnings feed into the same risk visibility security teams already use for reported phishing.
Frequently asked questions
How is pharming different from phishing?
Phishing relies on tricking someone into clicking a malicious link or opening a deceptive message. Pharming instead redirects users away from the legitimate site at the network or DNS level, so even a correctly typed address or a trusted bookmark can lead to a fake page with no deceptive link involved at all.
Can pharming happen even if I type the address myself?
Yes. Because pharming subverts DNS resolution or the local hosts file, typing the exact correct address does not guarantee you reach the real server if your device or network has been tampered with.
What is the most reliable warning sign of pharming?
A browser certificate warning on a site you normally trust is the most reliable tell, since attackers rarely hold a valid certificate for the domain they are impersonating.
How can organizations reduce their exposure to pharming?
Deploying DNSSEC, securing routers with updated firmware and non-default administrator credentials, and using reputable, security-hardened DNS resolvers all reduce the points at which DNS resolution can be tampered with.
Related terms
Phishing
Phishing is a social engineering attack where criminals impersonate a trusted sender to trick people into revealing credentials, transferring money, or installing malware.
Typosquatting
Registering a domain name that closely resembles a legitimate one, relying on typing mistakes or visual similarity to trick visitors.
Credential Harvesting
Credential harvesting is the theft of usernames, passwords, and other login data, usually through fake login pages or deceptive messages, so attackers can access accounts and systems.
Reduce your human risk
Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.
Request a demo