Payroll staff report the familiar portal URL opening a lookalike login page. Recursive resolver cache shows unexpected A records for the official hostname. Which malicious activity indicator fits best?

DNS cache poisoning injects fraudulent resolution data so clients reach attacker-controlled lookalike sites while believing they used the correct hostname. When payroll staff open the familiar portal URL yet land on a lookalike login page, and the recursive resolver cache shows unexpected A records for the official name, the malicious indicator is poisoned DNS—not a failure of endpoint allow lists. Municipal payroll portals are high-value phishing destinations because credential harvest yields direct access to wage and banking workflows.

Application allow listing blocking unapproved payroll binaries is a host execution control; it does not explain wrong A records in a resolver cache or a fraudulent web login page reached via DNS. Host-based firewall rules dropping outbound SMB on kiosks constrain lateral SMB, unrelated to forged DNS answers for a payroll hostname. Secure decommissioning of retired file servers removes stale systems from service; it is a hygiene mitigation, not an attack that redirects portal users.

Exam caveat: users typing the correct URL can still be victimized if resolution is wrong—do not assume “they clicked a phishing link” when the stem cites poisoned cache records. Distinguish DNS poisoning from simple typosquatting where the user mistypes the name.

Operational check: flush and rebuild trusted resolver caches, validate DNSSEC or authenticated DNS where deployed, force password resets for staff who authenticated to the lookalike, compare authoritative records to what recursors served, and monitor for further cache anomalies on civic resolvers.