On most networks, anyone else on the same subnet as your IP can hijack your connection using ARP spoofing and send you whatever they want if you're connecting over Http instead of HTTPS. That's usually a lot easier to pull off than compromising the server and replacing the content there.