# What is Pharming?

> Pharming is an attack that redirects a user who intends to reach a legitimate online service to a fraudulent destination, usually by altering name resolution, network or device configuration, or another trusted navigation mechanism.

- Canonical URL: https://yellowcube.eu/glossary/pharming/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Unlike phishing, it need not persuade the user to follow a deceptive message or mistyped link; the user may enter the correct address and still be redirected.

Redirection can result from modified endpoint settings, compromised routers or resolvers, poisoned Domain Name System (DNS) caches, or unauthorized changes to domain registration or authoritative DNS data. The destination may imitate a sign-in or payment service to capture information or deliver malicious content.

### Key points

- **Affected layer:** Compare results across trusted resolvers, networks, and devices; inspect endpoints, routers, resolvers, registrars, and authoritative DNS rather than assuming every redirect has the same cause.
- **Response and evidence:** Stop sensitive transactions, preserve DNS answers, timestamps, certificates, and destinations, and contact the relevant service, DNS operator, or registrar through trusted channels.
- **Defensive layers:** Secure registrar and DNS administration, network equipment, and endpoints; monitor DNS changes, validate DNS Security Extensions (DNSSEC) where supported, and use certificate validation and protective DNS.
- **Important limitation:** DNSSEC authenticates signed DNS data but cannot prevent endpoint, router, registrar, or authoritative-account compromise. Encrypted DNS protects the client-to-resolver transport; Hypertext Transfer Protocol Secure (HTTPS) certificate validation can reveal certificate/name mismatches, but neither establishes that a destination is legitimate or covers every redirection path.

### Related terms

[Phishing](<https://yellowcube.eu/glossary/phishing/>) · [Domain Name System (DNS)](<https://yellowcube.eu/glossary/domain-name-system/>) · [Domain Name System (DNS) security](<https://yellowcube.eu/glossary/domain-name-system-security/>) · [Domain Name System (DNS) hijacking](<https://yellowcube.eu/glossary/domain-name-system-hijacking/>) · [Domain Name System (DNS) cache poisoning](<https://yellowcube.eu/glossary/domain-name-system-cache-poisoning/>) · [Typosquatting](<https://yellowcube.eu/glossary/typosquatting/>)

### Sources

[NIST glossary: Pharming](https://csrc.nist.gov/glossary/term/pharming) · [NIST SP 800-81 Rev. 3](https://csrc.nist.gov/pubs/sp/800/81/r3/final) · [RFC 5452: DNS resilience against forged answers](https://www.rfc-editor.org/rfc/rfc5452.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.