Phishing vs pharming: what is the difference?

Phishing persuades you to visit a fake site. Pharming sends you there without any action on your part, by poisoning DNS or altering a hosts file, so the address bar can appear correct. Phishing exploits a person; pharming exploits infrastructure.

Phishing needs the victim to click something. Pharming does not. If a resolver or a local hosts file has been tampered with, typing the correct address by hand still lands on attacker-controlled infrastructure, which removes the one check most people are taught to rely on.

That also makes pharming much harder to run. It requires access to DNS infrastructure or to the endpoint itself, rather than just an email address.

What the corpus shows

This library documents 173 cases and none of them is a confirmed pharming attack. That is not an oversight. Pharming does not depend on social engineering, so it falls outside the inclusion criteria set out in our methodology. We would rather record the gap than stretch a case to fill it.

The closest documented equivalents are the 8 ClickFix and SEO poisoning cases, where the victim reaches attacker infrastructure through a manipulated search result or a fake error message rather than through DNS. The fake ChatGPT download site documented in 2026 and GootLoader targeting legal services in 2021 are the clearest examples.

The control that breaks it

• Pharming is answered with infrastructure controls: DNSSEC where available, monitoring for unauthorised DNS record changes, and endpoint integrity checks that would catch a modified hosts file.
• For the social variants that do appear in this library, the control is verifying the domain before downloading anything, since a poisoned search result looks identical to a legitimate one.