Pharming steers people to a false copy of a trusted site by corrupting name lookup or the host mapping stored on a device.
The address bar can show a familiar name while the connection actually lands on a server the victim did not choose.
How it works
One path poisons a shared resolver so many users receive the wrong numeric address for a real domain.
Another path edits the name table on a single computer so only that device is misled.
The false site then imitates a bank, a mail service, or a shop and asks for secrets.
Because the name looks right, the usual advice to read the address is no longer enough on its own.
Concrete examples
- A cafe resolver sends a bank name to a lookalike server for everyone on that network.
- A compromised laptop maps a mail domain to a hostile address only on that one machine.
- A small office finds its router handing out a resolver that nobody on staff configured.
Protective measures
- Prefer name resolvers you operate or explicitly choose, and lock down who may change them.
- Watch for sudden resolver changes on routers and endpoints and alert when the setting drifts.
- Use certificate checks so a familiar name that presents the wrong certificate fails closed.
- Teach people that a correct looking name is not proof when the device or the resolver may be altered.