Pharming redirects users to a fake website even when they type the correct address, by tampering with DNS settings, routers or the device's hosts file.
Pharming is an attack that sends people to a fraudulent website even though they typed the right address or used a saved bookmark. Instead of luring victims with a link, as in classic phishing, the attacker interferes with how the domain name is translated into an IP address.
How it works
When you visit a website, your device asks DNS which server to connect to. Pharming manipulates that answer at one of several points:
- Device level: malware edits the local hosts file or DNS settings so a bank's domain points to the attacker's server.
- Router level: a home or office router with weak or default credentials is reconfigured to use a malicious DNS resolver.
- Resolver level: a vulnerable DNS server is poisoned with false records, affecting everyone who uses it.
- Domain level: the attacker takes over the brand's registrar or DNS hosting account and changes the records directly, often called DNS hijacking.
The fake site then collects logins or payment details, just like a credential harvesting page.
Example
As an illustration, a small office router still uses its factory password. An attacker changes its DNS settings, and from then on anyone in the office who types the address of a bank, say examplebank[.]com, is quietly served a copy hosted elsewhere. The address bar shows the expected name, but the browser warns that the certificate is not valid for the site.
How to spot it
- Certificate warnings on a site that normally loads without problems.
- A familiar site that suddenly looks slightly different or asks for unusual information.
- DNS settings on a device or router that point to resolvers you do not recognise.
- Unexpected changes to your domain's DNS records or name servers.
- Many customers in one network or region reporting the same "fake site" at your real address.
What brands can do
Protect your own domains first: use registrar lock, strong unique credentials and multi-factor authentication on registrar and DNS accounts, and monitor records for changes. DNSSEC helps resolvers detect forged answers for your domains. Use HSTS so browsers refuse plain HTTP connections. If customers report a fake site, find where it is actually hosted and get that server taken down. Phishvoid can help trace and report the hosting behind such pages; contact us with what you are seeing.
Read more: How to Spot a Phishing Website: 10 Warning Signs
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.