Anti-pharming techniques in wireless computer networks at pre-IP state are disclosed. A user computer connecting to a wireless computer network may include an anti-pharming module configured to monitor data communications to and from a wireless access point of the wireless computer network. The anti-pharming module may be configured to determine if data communication going in a direction from the wireless access point to the user computer originated from a wireless station rather than a server configured to dynamically provide network addresses to computers connecting to the wireless computer network. The wireless station may be deemed a malicious computer perpetrating a pharming attack when it originated the data communication and is responding to a request to obtain network address previously sent by the user computer.