Typosquatters use misspelled and slightly off but similar to the legitimate site URLs to conduct *typosquatting*. They rely on the fact that people will mistype URLs and end up on their sites, thus driving ad traffic or even sometimes using the typo-based website to drive sales of similar but not legitimate products. A related attack is known as **pharming**. Unlike typosquatting, pharming relies on either on changing a system's hosts files (which is the first reference a system checks when looking up DNS entries), or an active malware on the system's DNS servers.