A company's users report that when they type their bank's URL into their browsers, they are redirected to a look-alike website that steals credentials. Investigation reveals that the resolver has cached forged records mapping the legitimate domain name to an attacker-controlled IP address. Which type of attack does this describe?