How a Familiar Address Can Lead Somewhere Else
A browser does not find a website by reading its name directly. It asks the Domain Name System (DNS)—the internet’s address directory—to translate a name such as `example.com` into the numerical network address of a server. Pharming interferes with that lookup, so the browser can be sent to an attacker-controlled server even when the person entered the right name.
Where the Redirect Can Be Hidden
The manipulation can happen at different points in the lookup chain. Attackers may alter a device’s local settings, compromise a home router, or tamper with a DNS server or its temporary records. Those records are often cached, meaning saved for reuse; a poisoned entry can therefore keep sending requests to the wrong destination until it is replaced or expires.
The counterfeit page can be made to resemble the real service and ask for a password or other sensitive information. Because the address was typed correctly, the usual clue of a misspelled web address is absent. That makes the redirection harder to notice, though a browser’s certificate or security warning should not be ignored: an incorrect destination may be unable to present a valid security certificate for the real site.
Why the Trick Matters
Pharming attacks the route to a destination rather than relying on a victim to click a deceptive link. That shifts the risk from a single message to the device or directory handling future lookups. If a router or DNS setting is compromised, more than one person using that connection may be affected. The key practical clue is that a familiar address alone does not prove the browser reached the genuine service.
