Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/
https://forum.vestacp.com/viewtopic.php?p=68594#p68594
https://www.digitalocean.com/community/questions/how-do-i-de...
Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.