UPS.com down/displaying a hacker's statement

Portal Home > Knowledgebase > Industry Announcements > Web Hosting Main Forums > Providers and Network Outages and Updates > UPS.com down/displaying a hacker's statement

Posted by axcessi, 09-04-2011, 04:46 PM
Currently going to www.UPS.com shows:
"
HACKED

"h4ck1n9 is not a cr1m3"

twitter.com/turkguvenligi

"4 Sept. We TurkGuvenligi declare this day as World Hackers Day - Have fun h4ck y0u"

© 2005 TurkGuvenligi Tayfa"

All the package tracking functions don't work. DAMN UPS. Holding my package from the east coast because of hurricane Irene is understandable even tho frustrating but being hacked by someone that uses twitter and uses numbers to replace letters? NO that's not ok. At this rate I'm never going to get my package.

I'm using fedex from now on just for security reasons.
Posted by freethought, 09-04-2011, 05:08 PM
NetNames seem to have been compromised in some way and several high profile web sites whose domain names are registered via them have had their nameservers changed to ns1.yumurtakabugu.com and ns2.yumurtakabugu.com.

So far I've seen ups.com, theregister.co.uk, acer.com, betfair.com and telegraph.co.uk.

There seems to be some sort of battle going on - some times these sites will display fine, sometimes you get the hacked message and sometimes they don't resolve at all!
Posted by Orannis, 09-04-2011, 05:10 PM
Use this, its the real IP address for the UPS site. 153.2.224.50
The hacker just reroutes your address to his fake one, 68.68.20.116
Posted by dotHostel, 09-04-2011, 05:40 PM

Quote:

Originally Posted by freethought

NetNames seem to have been compromised in some way and several high profile web sites whose domain names are registered via them have had their nameservers changed to ns1.yumurtakabugu.com and ns2.yumurtakabugu.com.

So far I've seen ups.com, theregister.co.uk, acer.com, betfair.com and telegraph.co.uk.

Impressive! Thanks for the heads-up!
Posted by Dunkan, 09-04-2011, 05:52 PM
I have the same problem at the moment with betfair, am getting either an error message and cannot reach the site or the hackers webpage. Is there any way to fix it? and is there any danger to my own computer?
Posted by wasbondy, 09-04-2011, 06:03 PM
I bet there are tons of shopping carts that are out because of this, customers that use the XML service that UPS provides. Even if you use the IP address to get the to UPS home page, the site tried to redirect you to ups.com which then goes nowhere. Bad!!
Posted by jzukerman, 09-04-2011, 08:23 PM
http://www.thehackernews.com/2011/09...-site-got.html

http://blog.sucuri.net/2011/09/ascio...nd-others.html

Looks like the domain registrar Ascio got compromised somehow?

Flush your dns cache on your local computer, as that may restore access to the affected sites, since the TTL was increased after the compromise to 24hrs.
Start -> Run -> ipconfig /flushdns
if you are on a Windows based computer.
Posted by KMyers, 09-05-2011, 12:21 AM
Acer too, this is bad
Posted by (Stephen), 09-05-2011, 02:31 AM
wow ups.com is still down!
Posted by QuickWeb-Roel, 09-05-2011, 03:01 AM
damn i'm tracking a bunch of gears luckily this IP works 153.2.224.50 just replace the domain after query.