What is Pharming? Definition and meaning

Pharming is a cyberattack that corrupts DNS resolution to redirect users from a legitimate domain to a fraudulent server – without any visible change in the browser's address bar.

Unlike phishing, which tricks a user into clicking a bad link, pharming operates at the infrastructure level: the attacker corrupts either the DNS cache of a resolver or the DNS records at the registrar or registry, so that every user who types the correct address is silently routed elsewhere. The legitimate domain name remains unchanged. The harm is invisible until transactions, credentials, or funds have already moved. Pharming is one of five DNS-abuse categories recognized in ICANN's 2024 amendments to registrar and registry contracts – alongside malware, botnets, phishing, and spam used as a delivery vector for those harms.

This page defines pharming precisely, distinguishes it from the terms most frequently confused with it, grounds it in the applicable rules, and explains what it means for a domain owner whose registration data has been altered without consent.

What pharming is not – and the terms people confuse it with

Pharming is not phishing. Phishing relies on deception at the user level – a lookalike URL, a spoofed email, a counterfeit login page that the user must navigate to. Pharming bypasses that choice entirely. The correct domain resolves to the wrong server. A careful user who types the address by hand and checks the address bar sees nothing wrong.

Pharming is also not simple domain theft. Domain theft – sometimes called domain hijacking – is the unauthorized transfer of a domain's registration to a new account or registrar. In domain theft, the registration record changes: the listed registrant, registrar, or both are altered. Pharming may accompany domain theft, but it can also occur independently, through DNS cache poisoning at a resolver that the domain owner never controls. The distinction matters because the legal routes differ. Domain theft is addressed at the registrar level and, where arbitration is unavailable, through court action and registrar escalation. Pharming without a registration change is more often addressed as a network-security or DNS-abuse matter.

Finally, pharming is not typosquatting. Typosquatting registers a confusingly similar domain and depends on a user mistyping. Pharming hijacks the correct domain's DNS path. One is a separate registration; the other is a corruption of an existing one.

Where pharming sits in the rules

ICANN's amendments to the Registrar Accreditation Agreement and Registry Agreement, effective 5 April 2024, named pharming as one of five recognized forms of DNS abuse. Contracted parties – registrars and registries – are now obliged to take "prompt, reasonable and appropriate action" to stop or disrupt pharming when it is well-evidenced. That is a mitigation duty. It is not an adjudication of rights, and it does not replace a UDRP or a court proceeding where the underlying issue is cybersquatting or domain theft rather than technical DNS manipulation.

This distinction is the most useful one a domain owner can understand. If a registrar receives a DNS-abuse report citing pharming, it may lock or suspend the domain. But that action is temporary and procedurally separate from any transfer or recovery remedy. A domain owner whose registration data was also altered – meaning the theft component is present – will generally need to pursue registrar escalation, and potentially court action, to restore the registration record itself.

How pharming happens in practice – three recognizable patterns

The first pattern is DNS cache poisoning. An attacker injects forged records into the cache of a recursive DNS resolver. Anyone using that resolver is redirected, regardless of which device they use or how carefully they type. The domain owner's registration records are untouched; the attack lives entirely in the resolver's cache. Detection requires monitoring DNS responses from multiple vantage points, not just looking at the registrar's control panel.

The second pattern is registrar-level record manipulation. An attacker gains access to the domain owner's registrar account – often through credential theft or social engineering – and changes the NS (name server) records or A records directly. From that moment, the authoritative DNS for the domain points to servers the attacker controls. This pattern overlaps with domain theft: when the attacker also transfers the registration to a new account, the result is full domain hijacking. We regularly advise registrants in exactly this situation, where pharming and theft have occurred in the same incident and the response must address both layers simultaneously.

The third pattern is BGP hijacking combined with DNS manipulation. A network-level route hijack allows an attacker to intercept DNS traffic destined for a legitimate name server and return forged responses. This is the most technically sophisticated variant and typically requires resources beyond an individual actor. From the domain owner's perspective, the effect is the same: correct domain, wrong server, no visible warning to users.

In all three patterns, the harm is compounded by the trust users place in a domain name. A brand's customers who reach a pharmed server may submit credentials, complete purchases, or download files – all believing they are dealing with the legitimate operator.

Why pharming matters for domain recovery and dispute strategy

If your domain stopped resolving correctly and the registration record changed without your consent, the first question is which layer was attacked. If the registration record itself was altered – meaning registrant data, name servers, or the registrar of record – the response path involves registrar escalation, a registrar lock, and, where the registration has been transferred to a third party, potentially a UDRP complaint or court action. If the record is intact and only the resolver cache is poisoned, the immediate response is a DNS-abuse report to the resolver operator and, where a registrar is implicated, to that registrar.

A domain-recovery lawyer advising on pharming will map the attack to its layer before recommending a route. A DNS-abuse report to a registrar is not a substitute for a UDRP where cybersquatting is the core issue – ICANN's 2024 amendments make this explicit. Conversely, filing a UDRP when the problem is a resolver-level cache attack addresses the wrong party entirely. Getting the characterization right at the outset determines whether the remedy works.

For matters where the pharming attack involved unauthorized changes to registration data, COGNOMEN handles registrar escalation, emergency registrar locks, and court anticybersquatting proceedings – working with local litigation counsel in the relevant jurisdiction where court action abroad is required. For an assessment of a domain that has stopped resolving as expected, contact info@cognomenlaw.com.

COGNOMEN focuses only on domain-name disputes – recovery, defense, and transactions. We handle domain theft and pharming-adjacent matters across gTLDs and ccTLDs, including registrar escalation, emergency lock requests, and referral to court where arbitration cannot reach.

Related at COGNOMEN

• court recovery – court action and registrar escalation for stolen or hijacked domains
• What is Registrar? Definition and meaning – what a registrar does and why it matters in a dispute
• enforce udrp decision us – how to enforce a UDRP transfer order through US courts

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.