3 ms·
Some of these tracking websites (not UPS) require fairly simple data to reveal the sender & recipient. I'm sure with enough time & patience you could enumerate
by stef25 3y ago
Some of these tracking websites (not UPS) require fairly simple data to reveal the sender & recipient.
I'm sure with enough time & patience you could enumerate the hell out of them or use data from previous leaks to get your hands on the good stuff. It's all about rate limiting, but that can also be defeated pretty easily.
- waselighis 3y agoThat seems unlikely to me as UPS certainly would have spotted that kind of activity in their logs (enumerating). However, it may not be entirely impossible either. UPS tracking numbers are long but not completely random, they encode a lot of info about the shipment which can greatly reduce the search space. https://www.trackingmore.com/tracking-status-detail-en-238.html https://www.trackingmore.com/tracking-status-detail-en-238.h...
- stef25 3y agoWasn't talking about UPS but smaller shipping companies here in EU.
- dools 3y agoYeah so the existence of URLs for specific retailers like Lego and Adidas suggest to me that they ordered from the shipper, got their account number, then just got a botnet to enumerate (or randomly query) with different package identifiers.