In the cyber threats, the terms of phishing and pharming are used to describe as act of stealing personal information through website. Both attacks are attempts to steal sensitive information such as user name and passwords, but the methods used behind are pretty different. They act with separate concepts and tactics used by attacker. Phishing attacks involve an attacker sending emails that appear to be from a company with which you do business promoting you to take action and log in to your account with link by email. This attack attempts to trick recipients into malicious website to provide their personal information. Attacker makes its imposter website that looks like real website and try to disguise link to its imposter website that seems legitimate to unsuspecting victim. Normally, you may have received emails before requesting you to change your password for social network accounts or emails from bank asking you to log for update. The result is that you will find yourself lock from fraudulent third-party. Pharming attacks are indeed different. Pharming can happen when you are going to a legitimate website, even you typed URL to access directly. In a pharming attack, the criminal hijacks the intended website’s DNS server. The attacker tricks a DNS server into caching a bogus entry and DNS server provides a cached record of malicious website. The user is pharmed via DNS cache poisoning. Phariming is more extensive than phishing, because it requires exploiting a DNS server to change the logic behind. There are some suggestions to prevent potential visitors from failing into phishing and pharming traps: - Be suspicious of any email with urgent requests for personal information - Do not use the links in an email to access to any website - Check regularly bank, credit card statements to ensure all transactions are legitimate - Make sure your browser/ software is up to date and security patches are applied - Run separate name servers for redundancy on different network segments - Separate external and internal name servers and use forwarder. - Adopt WAF and antivirus software