A cyberattack that redirects traffic from a legitimate website to a fraudulent one without the user's knowledge, typically by manipulating DNS settings or corrupting the host file on a victim's computer.
A cyberattack that redirects traffic from a legitimate website to a fraudulent one without the user's knowledge, typically by manipulating DNS settings or corrupting the host file on a victim's computer.
Think you've been targeted?
Paste the suspicious content here for an instant analysis.
No signup · 6 detection layers · Results in seconds · Cmd+Enter
Pharming is a portmanteau of "phishing" and "farming." While phishing requires the victim to click a malicious link, pharming is more insidious — it redirects users to fake websites even when they type the correct URL. The "farming" metaphor refers to the attacker maintaining a "farm" of fake websites.
There are two main types. Local pharming modifies the hosts file on a victim's computer to redirect specific domains. DNS pharming attacks the DNS server itself, affecting all users who rely on that server for domain name resolution.
Pharming is particularly dangerous because there's no suspicious link for the user to notice. They type the correct web address, their browser shows the correct URL in the address bar, but they're actually on a different server entirely.
In 2017, a pharming attack targeted users of a major Brazilian bank by compromising the bank's DNS records. For about 5 hours, all visitors to the bank's website — including online banking customers — were redirected to a perfect replica that harvested their credentials.