Users at a company report that when they type their bank's correct URL into their browsers, they are redirected to a fraudulent site that looks identical but has a different IP address. Internal DNS server logs show that the cached record for the bank's domain was modified without any authorized change. Which type of attack is MOST likely occurring?