It looks like one of those subdomain names used by scammers who use hijacked DNS accounts to create subdomains on legitimate domains and use them for phishing.

It looks like one of those subdomain names used by scammers who use hijacked DNS accounts to create subdomains on legitimate domains and use them for phishing. _IF_ that is the case, then it must have been in the UPS end.