It looks like one of those subdomain names used by scammers who use hijacked DNS accounts to create subdomains on legitimate domains and use them for phishing.

_IF_ that is the case, then it must have been in the UPS end.