Just spoofing a DNS reply would be enough if it arrives first, wouldn't it?